Privacy policy

1. Controller

The controller under the GDPR and the revised Swiss FADP is:

Kujtim Murati\ Gartenstrasse 6\ 9240 Uzwil\ Switzerland

Email: info@propcrab.io

2. Principle

We process as little personal data as possible. This site works without a user account, without third-party tracking cookies, without advertising networks and without loading a single script from someone else's server. Our audience measurement also runs on our own server and without a cookie — which is why you see no consent banner here. Section 4 explains why we consider that lawful. Optional AI source selection in topic help requires separate consent at that feature (section 8a).

3. Server and logs

This site runs on a server of its own (see section 10). Our web server keeps no access log: the pages you open are not recorded together with your IP address.

Your IP address is necessarily transmitted when you open a page and is processed briefly in memory, for example for the rate limit against automated access (sections 4, 6, 7, 8 and 8a). For trader reviews we store a check value instead of the address (section 9). Technical error messages of the server, such as failed connection attempts, may contain an IP address.

• Purpose: technical operation, security and error analysis
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation)
• Retention: error messages at most 14 days, then deleted automatically

4. Audience measurement — first-party and cookieless

We want to know which pages get read. So we run our own measurement: on a page view your browser sends one small record to our own endpoint /api/track. It contains only the page requested and its language. No third-party script is loaded, no cookie is set, and no identifier is placed on your device.

Exactly the following is stored — nothing more:

The visitor hash. So that ten page views by one person are not counted as ten visits, we need something to tell readers apart within a single day. We build it as a SHA-256 hash of a random daily salt, your IP address and your user-agent string, and store only the first 20 characters. The daily salt is 32 random bytes, generated fresh for each calendar day (UTC) and kept only in the server's memory: it is never written to the database or to a backup copy, and it is discarded once the day is over. The following day an automatic deletion run removes the hash from all of the previous day's rows (see retention). This limits the ability to reproduce past identifiers. It does not by itself rule out linkability using additional information.

What is not stored: no IP address, no user-agent string, no record of the page you came from (referrer), no cookie, no fingerprint, no cross-site identifier, no dwell time, no mouse or scroll movement, and no search terms. IP address and user agent are used transiently in memory only — to compute the hash, to determine the device class, to rate-limit automated requests, and for a simple filter that drops known crawlers — and are then discarded.

• Purpose: audience measurement as a basis for editorial decisions
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimal audience measurement). A daily hash can connect visits within a day and is conservatively treated as pseudonymous data; hashing alone does not guarantee anonymity.
• Recipients: none. The rows sit in our own database; they are not shared, not combined with other sources and not sold.
• Retention: the visitor hash is only needed for the day it is created. The following day an automatic deletion run removes it from all of the previous day's rows; all that remains of it is that day's number of visits. The other details of a row (path, language, device class, country, timestamp) are deleted automatically 13 months after the page view. After that only daily totals remain — the number of page views and of visits per day — with no link to individual page views. In the file-based variant of the store, at most the most recent 50,000 rows are kept as well.

Objection (opt-out). Two ways, both effective immediately and without an account:

1. 1Turn on "Do Not Track" in your browser. The measurement reads that setting in your browser (navigator.doNotTrack) and then sends nothing in the first place — no record is created that we would have to discard. We do not evaluate the DNT: 1 HTTP header server-side; mainstream browsers set both together, and where they diverge the browser setting decides. Many sites ignore this signal — for this measurement we do not (for clicks through /go see section 6).
2. 2Set the switch on the privacy settings page. It stores the value pc-no-analytics in your browser; while it is set, nothing is sent.

Why there is no cookie banner for this. Consent is required under Art. 5(3) of the ePrivacy Directive — in Germany § 25 TDDDG, formerly TTDSG — when information is stored on your device or read from it that is not strictly necessary for the service you asked for. This measurement sets no cookie and places no identifier on your device. It is limited to what a simple page counter needs: on every page view your browser reports to our own server which page was opened in which language. It does not read any other property of your device — such as screen or window size, installed fonts or the page you came from. Before sending, it only checks whether you have turned on "Do Not Track" or objected on the privacy settings page; that check serves solely to honour your objection. We therefore do not consider consent necessary for this measurement. A banner asking for it anyway would only teach you to click "accept" without reading.

That is a statement about today, not a permanent guarantee: the moment we embedded a third-party tool — Google Analytics, a Meta pixel, an ad network or a hosted analytics script — the assessment would change. Such tools set identifiers and pass data to third parties; they need consent before they load. We would update this policy first and actually collect that consent.

5. Local browser storage

We use localStorage and two cookies for purely functional purposes:

Earlier versions of this site used the names bp-theme and bp-no-analytics for these. If one of them is still in your browser, we move its value to the new key on your next visit and delete the old one.

The local-storage values never leave your device — they are not sent to the server. The bp-locale and bp-country cookies are sent with every request because language routing and the country selection are decided on the server; they contain nothing but a language or country code and are not used to recognise you. When you follow a link that takes you to a firm (through /go), the chosen country code is stored with the click, so that we can analyse clicks by market and — where partner agreements that apply per country exist — attribute them correctly (see section 6). None of these values is used for profiling or for tracking across websites. As these are strictly necessary or user-initiated functions, no consent is required.

You can inspect all six entries, and clear them with one click, on the privacy settings page.

Sharing saved scenarios. Public JSON exports and shared links contain only the calculation and source data shown for review before sharing; private titles and notes are excluded. The link carries data in its URL fragment and anyone with the link can read them. A private backup export explicitly includes private details. Local deletion cannot remove copied links or exported files and cannot revoke their onward sharing. Text entered into local criteria recognition is neither stored nor sent externally.

6. Clicks on links to providers

Every link that takes you to a firm, whether labelled a direct link or a partner link, goes through an internal redirect (/go/...) that forwards you to the provider. Source references, next to single values as well as in the source lists, and the pages we checked for a data gap are the exception: they link straight to the evidence or the checked page, are not counted and are never partner links. Neither the switch on the privacy settings page nor "Do Not Track" covers these clicks; both apply only to the audience measurement in section 4. The server counts clicks through /go at the redirect even if you objected there or turned on "Do Not Track". For every such click we store: a click identifier, the firm clicked, where on the site the link sat, the programme and the account size where the link names them (for example on a deal for exactly one account), the language version, a country code, whether the click ran through a partner agreement (with our internal contract reference), the time, and only the hostname of the referring website. The country code is the country of residence you selected, otherwise the market the link belongs to, otherwise the code the hosting platform supplies. The click identifier is a random number; it is not derived from your IP address, your device or your browser. IP addresses, URL paths, query parameters and user-agent strings are not stored.

We do not count requests that identify themselves as search engines, link previews or other programs, browser prefetches, or bare HEAD requests. To tell them apart, the server reads the user agent in memory without storing it. So that the same click on the same day is not counted twice, the server forms a hash of IP address and user agent in memory, using the daily key described in section 4. That value is never stored and is gone when the day ends (UTC) or the server restarts.

Where a partner agreement only covers certain countries and we do not know your country of residence, we ask before redirecting you. We store your answer as the bp-country cookie (section 5). "Another country or rather not say" sets no cookie and takes you to the provider's regular website; only the click is then counted as described above. The question itself is not logged.

• Purpose: measuring reach; for partner links also reconciling payouts with the partner programme concerned. Whether any partner agreements currently exist is stated in the advertising disclosure.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach measurement and in verifiable reconciliation with partner programmes)
• No personal profile: we do not store an IP address and build no user profile. Click counts do not prove registration or a commission entitlement; confirmed partner statements are authoritative for that.
• Retention: individual clicks are deleted after 18 months. What remains is the number of clicks per day, firm, placement, language version, country code and agreement, without click identifiers. 18 months cover the period in which partner programmes report or reverse purchases late. Where a partner has sent a report about a click, that click's identifier and details stay with the report for as long as the report is kept (see below). In the file-based variant of the store, only the most recent 20,000 clicks are kept in addition.

Partner links and reports from partners

Where the link does not run through a partner agreement, we append utm_source=propcrab, utm_medium=referral and utm_campaign with the placement to the destination URL, unless the link already carries its own parameters. Those parameters say nothing about you; we do not pass on the click identifier in this case.

Approved partner links are used unchanged so that required or signed tracking parameters remain valid. Where the partner agreement provides for it, we append exactly one further parameter: the click identifier, possibly together with placement, language version and country code. The partner receives it through your browser when it opens the partner's page. If you then buy a challenge, the partner programme can use this identifier to tell us that the click led to a registration, a qualified account or another event defined in the agreement, and which commission is due for it, or was confirmed, reversed or paid. We receive these reports directly from the partner programme (postback) or as a statement file.

From them we store only: the partner programme, the partner's transaction reference, the click identifier, the type of event, its status, amount and currency, the times, the details of the matching click (firm, placement, language version, country code, agreement) and these fields as worded in the report, plus further fields the agreement provides for that say nothing about you, such as the partner's product or campaign identifier. We do not request names, email addresses, account numbers or other details about you; if a partner sends such fields anyway, we do not store them. This tells us which click led to a paid purchase, but not who you are. The firm knows you from your purchase; the identifier lets it match your purchase to a click on our site.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in verifiable reconciliation); for retention additionally the Swiss bookkeeping obligation under Art. 958f of the Code of Obligations.
• Retention: these reports are business records. We keep them for ten years after the end of the year of their last change and then delete them automatically. Technical receipt logs of the reports (time, result, names of the fields sent, no contents) are deleted after 90 days.

The firm you are forwarded to is independently responsible for its own processing and usually sets its own cookies. Please read its privacy policy.

7. Newsletter and rule alerts

If you subscribe, we store your email address, the language version, the sign-up source (e.g. the site footer), the timestamp, a random token, and the confirmation and unsubscribe status. We do not store your IP address; it is used transiently for rate limiting only.

• Legal basis: Art. 6(1)(a) GDPR (consent)
• Process — genuine double opt-in: the address is stored unconfirmed first. You receive a single email with a confirmation link carrying a random token. Only when you open that link does the subscription take effect. Without confirmation you receive no newsletter — after the confirmation email, nothing further goes out to an unconfirmed address.
• The token: a random string that exists only in the email, is never shown on a page, and later also powers one-click unsubscribe.
• Unsubscribing: every email carries an unsubscribe link plus the List-Unsubscribe and List-Unsubscribe-Post headers per RFC 8058. Your mail client can therefore remove you with a single click — no confirmation step, no login. Withdrawal takes effect for the future.
• Unconfirmed sign-ups: if the confirmation link is not opened, an automatic deletion run removes the address 30 days after sign-up.
• After unsubscribing: the record is kept with the time of the unsubscribe so the address is not accidentally mailed again. On request we delete it entirely.
• Sending: emails go out over the operator's own SMTP server or SMTP service. No third-party newsletter tool that measures opens or clicks is involved. Mail is sent through the mailbox info@propcrab.io at METANET AG, Josefstrasse 218, 8005 Zurich, Switzerland.

Rule alerts by email

On the rule alerts page you can select firms (or "all firms") and be notified by email when a new entry for one of those firms appears in the change history. Rule alerts are separate from the newsletter: signing up for one does not sign you up for the other.

• What we store: your email address, the language of the emails, your selection (the short names of the chosen firms or "all firms"), a random identifier of your entry, and the times of sign-up, last change, confirmation and the last alert email, plus the point in time up to which new entries in the change history have already been taken into account for you. We do not store your IP address; it is used transiently for rate limiting only. We do not measure opens or clicks.
• The link in the emails: it contains the identifier and a check value computed from it with a secret server key (HMAC-SHA-256). The check value is not stored, and the key is neither in the database nor in its backups. Anyone who knows the link can confirm, change or cancel the alert, so please do not pass it on. The management page shows your address only in shortened form.
• Purpose: notification of new entries in the change history for the firms you selected
• Legal basis: Art. 6(1)(a) GDPR (consent)
• Process — double opt-in: the sign-up is stored unconfirmed first. You receive an email with a link; the alert only takes effect once you press the "Confirm" button on the linked page. Merely opening the link changes nothing. No alert email goes to an unconfirmed address. If an address already has a confirmed alert, signing up again changes nothing; we then only send the management link to that address.
• Content and frequency: an alert email lists the new entries for your firms with date, previous and new value, scope and source, as they stand in the change history. At least 20 hours pass between two alert emails to the same address, and an email goes out only when there is a new entry. The emails contain no advertising and no partner links.
• Withdrawal and unsubscribing: every alert email carries a management link and the List-Unsubscribe and List-Unsubscribe-Post headers per RFC 8058, so your mail client can remove you with a single click. Unsubscribing deletes your entry entirely at once; we keep no suppression list. Withdrawal takes effect for the future.
• Retention: for as long as the alert exists. An automatic deletion run removes unconfirmed sign-ups 30 days after the last sign-up. Deleted entries are gone from the backups at the latest after the period in section 10.
• Sending log: for each sending run we store numbers only (such as how many emails were sent or failed), no email addresses. The last 100 runs are kept.
• Sending: as for the newsletter, through the mailbox named above, without any third-party tool.

8. Contact form

Messages from the contact form are stored and additionally emailed to the operator's inbox — stored because a message must not be lost to a mail outage.

• What is stored: the topic you chose (data error, accessibility, partnership, press, general), your name, your email address, the subject, the message text (including the firm and page URL if you supplied them), the language version, the timestamp, and a note of whether the notification email could be delivered.
• What is not stored: your IP address. It is used transiently for rate limiting only.
• Sending: the notification goes to the operator's inbox with your address as the reply-to. You receive an acknowledgement at the address you gave. If no SMTP access is configured, the message is stored only and flagged internally as undelivered — we do not pretend an email went out.
• Legal basis: Art. 6(1)(a) GDPR (your explicit, not pre-ticked consent when submitting) and Art. 6(1)(f) GDPR (legitimate interest in answering you).
• Use: solely to handle your request. Your address is not added to the newsletter and not shared.
• Retention: until your request is settled and no retention obligation stands in the way. An automatic deletion run removes the message stored in our database no later than 12 months after it was received. On request we delete a message earlier, at any time.

8a. Topic help and optional AI source selection

Topic help explains PropCrab's published subject content. When you submit a question, its text and the selected language are sent to our own server for processing. Please do not enter personal information, account details or credentials.

Without AI consent: Our server searches only a fixed selection of public PropCrab guides. The reply consists of matching excerpts with source links. No AI service is called and no web address you enter is opened.

Optional AI source selection: Only if you expressly select the checkbox, which is not pre-ticked, and the feature is available may our server use OpenAI's API to select matching excerpts. It sends fixed subject and question-type labels recognised from a predefined list, together with public guide excerpts and source identifiers. Your question text, conversation history, IP address and other input are not forwarded to OpenAI. The model selects sources; the displayed reply remains limited to their existing text.

Storage: We do not record conversations or questions in a database, logs or persistent browser storage. Your input and the reply remain in browser memory while the dialog is open. Our server processes the individual question to answer it and may briefly cache public excerpt replies. To prevent abuse, it uses a time-limited check value of the IP address or IPv6 network in memory only; this is not linked with questions or answers to create a user profile.

Purpose and legal basis: Providing the topic help you requested and protecting the service, Art. 6(1)(f) GDPR; optional OpenAI processing uses Art. 6(1)(a) GDPR. You can deselect the checkbox before any further question. This takes effect for the future and does not undo processing already completed. Help without AI source selection remains available.

OpenAI may process data outside the EU, EEA and Switzerland. The request disables storage for later API retrieval (store: false); this is not a promise that the provider retains no data at all. OpenAI describes its own security logs and possible retention in its API data controls.

9. Trader reviews

On the trader reviews page you can describe your experience with a prop firm. We read every review before it appears; it is published only once we have approved it. The rules published there apply.

• What we store: the firm, the programme and account size you chose (if given), the year and month of purchase (the month is optional), the outcome, the range of payouts received (optional), your star rating, title and text, the display name you choose yourself, a disclosed relationship with the firm, the language version, the times of submission and of our decision and, where applicable, a reply from the firm. We do not ask for an email address. We do not accept receipts, screenshots or other files through this form. Optional event/request/receipt dates, payout method, known rule version and declared evidence availability are stored too. Editorial evidence reviews and resolution states have an audit history; private evidence references and review notes remain internal.
• What we publish after approval: firm, programme, account size, purchase month, outcome, payout range, title, text, the display name, a disclosed relationship, the date of submission, a reply from the firm and — once five reviews of the firm are approved — the stars. From five approved reviews of a firm we also output stars, title, text, display name and date as structured data for search engines. Optional event dates, rule version, payout method and separately identified evidence/resolution status are public too; private notes and evidence references are never published. Choose a display name under which you cannot be recognised if you prefer that.
• Protection against abuse: we do not store your IP address. For the limits per connection (at most three reviews in 24 hours and one per firm in 30 days) we store a check value with every accepted review — an HMAC-SHA-256 value of your IP address (for IPv6, of your /64 network) computed with a secret server key — together with the firm and the time, separately from the review and without any reference to it. The key is kept neither in the database nor in its backups. An automatic deletion run removes these check values after 30 days. The form contains a signed timestamp that holds nothing about you and is not stored; it makes automated submissions harder. In addition, your IP address is used briefly in memory for a rate limit (section 3). We compare new texts with the reviews of the last 90 days to detect duplicate submissions.
• Purpose: publishing experiences with prop firms and protection against abuse (automated submissions, multiple reviews, orchestrated bursts)
• Legal basis: Art. 6(1)(a) GDPR (your consent when submitting) for storage and publication; Art. 6(1)(f) GDPR (legitimate interest in undistorted reviews) for the protection against abuse.
• Retention: published reviews for as long as they are published. Reviews not yet decided until our decision. An automatic deletion run removes reviews we did not publish 30 days after our decision; until then they serve to correct a wrong decision and to detect duplicate texts. A log of our decisions (firm, decision, reason, time, review identifier) contains no text and nothing about you; it is kept, and the public moderation record is counted from it.
• Withdrawal and deletion: you can withdraw your consent at any time with future effect and ask for your review to be deleted — by email to info@propcrab.io with the link to the review. As we store no email address, we cannot verify your authorship with certainty; where in doubt, we ask back.
• Reports: anyone who reports a published review via the “Report this review” link gives a reason and an explanation, optionally also a name and an email address. We store the report with its time in order to examine it and use the email address only to inform about our decision. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 of Regulation (EU) 2022/2065 (Digital Services Act) and Art. 6(1)(f) GDPR. An automatic deletion run removes settled reports 12 months after they were settled.
• Notification: for every new review and every new report the operator's mailbox receives an email. It names only the firm — no content and nothing about you.

10. Hosting

The website runs on a server we rent from netcup GmbH, Emmy-Noether-Strasse 10, 76131 Karlsruhe, Germany; the server is located in a data centre in Nuremberg. We operate the server and its software ourselves. Email to and from info@propcrab.io is handled by METANET AG, Josefstrasse 218, 8005 Zurich, Switzerland.

Hosting and email data are processed in Germany and Switzerland. Separate optional OpenAI processing and possible processing outside the EU, EEA and Switzerland are described in section 8a.

Backups: the database is backed up once a day on the same server. The backup copies are accessible to the operator only and are deleted automatically no later than 16 days after they were made. Whatever we delete from the database — on request or through the deletion runs described above — is therefore also gone from the backups after that period at the latest.

11. Fonts

Fonts are served from our own server. No connection is made to Google Fonts or any other external font service.

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw consent at any time with future effect.

One honest note about audience measurement: from what we store we cannot attribute those rows to a person — we keep neither your IP address nor your user-agent string, the daily salt exists only in memory and is discarded once the day is over, and from the following day the rows no longer carry the visitor hash either. Access or targeted deletion would require additional information from you that makes attribution possible; if you can supply it, we will act on your request. We are expressly not claiming those rows are anonymous — section 4 treats them conservatively as pseudonymous data. Independently of that, the objection described in section 4 takes effect immediately and prevents future records.

You also have the right to complain to a supervisory authority.

13. Changes

We update this policy when our processing changes. The version published here is authoritative.