Privacy policy

Last updated: October 19, 2026

Crashcast estimates the chance that a Solana pump.fun coin crashes in the next few minutes. You can use it through the Crashcast Chrome extension, the Telegram bot @CrashCastBot and the Crashcast API (api.crashcast.io). This page explains, in plain language, what each one sends and keeps, and what we never do. "We" means the people who run Crashcast; you can reach us at crashcastapp@gmail.com.

Chrome extension

What it sends, and when

Coin lookups. When you open a coin page on pump.fun, Axiom or DexScreener (on a site where the panel is switched on), or click the extension's toolbar button on such a page, the extension reads the coin or pool address from the page's web address, inside your browser. It then sends the Crashcast API:

• that coin or pool address, and
• your API key, so the API can check your plan and daily limit.

It does not send the full web address, the page's content, your other tabs, or anything about other sites you visit. On sites where you switch the panel off, it sends nothing unless you click the toolbar button.

Scores change as a coin trades, so while a coin page is open and visible with the panel expanded (or the toolbar popup is open), the extension repeats the same lookup at the "Auto-refresh" interval in its options (every 60 seconds by default; 30 seconds, 2 minutes or off can be chosen). A coin with no trades yet is checked again every 15 seconds, at most 8 times. Each repeat sends the same two items and nothing more.

Accuracy figures. The toolbar popup asks the API for its public accuracy numbers. That request carries no API key and no coin address. The "Accuracy" link opens the public accuracy page without passing along the page you were on.

Where requests go. Only to the API address in the extension's options, https://api.crashcast.io by default. No cookies are sent with these requests. The "Get a free key" and "Upgrade to Pro" buttons simply open @CrashCastBot in Telegram.

What it stores on your device

• Settings: the API address, your API key, which sites show the panel, whether the panel starts collapsed, and the auto-refresh interval, in Chrome's extension storage. If you use Chrome sync, Chrome syncs them to your other computers through your Google account.
• Panel layout: whether the panel is collapsed and where you dragged it, per site, on this computer only.
• Short-lived cache: recent scores are kept in memory for about 15 seconds (accuracy figures for about 5 minutes) to avoid repeat requests.

Uninstalling the extension deletes all of this from your browser.

Telegram bot

When you use @CrashCastBot, Telegram delivers your messages to us. The bot only acts on commands and on coin addresses or pump.fun, Axiom and DexScreener links. To run it we keep:

• your Telegram user ID and the IDs of chats the bot is used in, with each chat's alert setting;
• how many free checks you used today, so the daily free limit works;
• your plan: when Pro ends, Telegram Stars payment IDs and amounts, and whether a payment was refunded;
• a fingerprint (one-way hash) of your extension API key, never the key itself;
• if you joined through a partner's link, which partner, so they can be paid their share;
• what you send to /paysupport or /partner, which is passed to us so we can answer;
• a short technical log (chat IDs, commands and coin addresses, for fixing problems), which overwrites itself after a few megabytes.

We don't read or keep other messages in group chats, and we don't collect your phone number or contacts.

Payments

Crashcast Pro is paid in Telegram Stars inside Telegram. Telegram (and Apple or Google, if you buy Stars in their app stores) handles the payment under its own terms. We receive only a confirmation with a payment ID, the amount in Stars and your Telegram user ID. We never see card, bank or wallet details.

Crashcast API and servers

• Network data: like any website, our servers see the IP address, time and browser user-agent of each request. Web server logs are deleted after 14 days.
• API keys: stored only as one-way hashes, with the plan, an expiry date if any, and, for keys made by the bot, the Telegram user ID they belong to.
• Daily usage: a count of lookups per key per day, to apply plan limits.
• Lookups: to measure and improve accuracy, we keep the coins that were looked up, the time, the score and what the coin did next. These records are not linked to your key or Telegram account.
• Coin data: to score a coin, our server asks public sources (pump.fun and a Solana RPC provider) about that coin. Those requests contain the coin's address, never anything about you.

Our servers run with DigitalOcean. We don't use your data for advertising, sell it, or share it with anyone except the providers above as needed to run the service, or when the law requires it.

Your choices

• Switch the extension's panel off for any site in its options, or remove your API key at any time.
• Cancel Pro in Telegram: Settings → My Stars → Subscriptions.
• Ask us to delete your bot account data or your keys at crashcastapp@gmail.com or with /paysupport. We keep payment records as long as we need them for accounting.

Children

Crashcast is for adults who trade crypto. It is not meant for anyone under 18.

Changes

If this policy changes, the new version will be posted here with a new date. Significant changes will also be announced in the bot.

Contact

crashcastapp@gmail.com