Last updated: November 2026
The short version. Perly keeps your account, the records you create, the few things you switch on and what you buy. The market charts keep nothing about you unless you leave them a note, and count your visits with Google Analytics only if you allow it. The invoicing site keeps the documents you write, which carry your clients' details, and shows a document to whoever you give its link. Everything each product keeps is listed below, product by product, with how long it stays. No wallet connections, no seed phrases, no exchange API keys, no access to your funds. Nothing is sold, shared with advertisers or used to train anything.
Who is responsible. Perly is the controller of the data described here, and hi@perly.io reaches it. One kind of data has different roles, and they are worth saying plainly: the details of your clients on a document you write in Perly Invoice — their names, addresses, e-mail addresses, tax numbers and what they owe — are yours. You decide to collect them and to send them a document, so you are their controller, and we process them on your behalf under these terms: to store the document, to show it to whoever holds its link, and to print it. Their questions about that data go to you; ours go to hi@perly.io. Perly Pay, at pay.perly.io, is run under its own Terms of Service and Privacy Policy, which say what it keeps and who is responsible for it.
The site has no accounts and no database of its own. It sets no cookies unless you allow it: Google Analytics starts only after you choose Allow in the cookie notice, and declining leaves the site cookie-free. Your answer is kept in your browser's own storage, not on a server, and the Cookies link in the footer of the home page opens the notice again, so you can change it at any time. When Google Analytics runs, its cookie tells one browser's visits apart without saying whose browser it is; we see pages and counts, not people, and Google Analytics does not store IP addresses. The pages are served by Vercel.
Counting page views. Whatever you answer in the notice, perly.io and pay.perly.io count page views as anonymous daily totals by page, language, screen class, country and referring site, with no cookie and no identifier; a tab-only marker that is never sent tells a first page from a second one. The totals are kept in our own database, and Supabase sees the request like any request. The country is a two-letter code that the network in front of the database works out from the request's IP address, and the referring site is its host and nothing else. So that one script cannot flood the totals, page views are also counted per network address, as a salted hash of it kept apart from the totals, the way sign-in attempts are, deleted within a day.
What Perly keeps.
Encrypted portfolios. Your portfolios are encrypted in your own browser, all of them at once, with a key only you hold — a new account sets that password before its first portfolio, and Settings can turn it off. An encrypted portfolio's amounts, prices, fees, totals, notes, tags, description and target reach our servers only as ciphertext we cannot open. What stays readable is what lists and sorting need: the portfolio's name and the currency it is kept in, each entry's coin and time, and fingerprints that spot a duplicate import. Alerts, plans and watched addresses you set on it are stored in the clear, because the server has to read them to act on them. The password never reaches us and the recovery code is shown once: lose both and those portfolios cannot be opened again by anyone, ourselves included.
Cookies and counting. The application keeps you signed in with one session cookie, shared by the application and the invoicing site, and remembers your language, your display settings and, for an hour, where you arrived from — and, for fifteen minutes, an invite code you sign up with through Google or X, so that it survives the trip there and back. Inside the application we count which screens are opened, in our own database and in the same shape as the charts site: one row per day, screen, language and screen size, with counts on it, and, in rows of their own, visits by the two-letter country their connection comes from. No account, identifier or IP address is stored with any of them. The pages a stranger can see — sign in, sign up — load Google Analytics only after you answer yes to the question they ask; it is the same Google Analytics as on this site. Apart from the bot check described next, a signed-in page loads no third-party script.
The site you came from. When you arrive with no session and the link does not say where it came from, the application keeps the name of the referring site, taken from what your browser sends, in a first-party cookie on its own host for an hour, with any chart or language the link named, and attaches it to the account only on sign-up. This happens whatever you answer to the question on the sign-in and sign-up pages. Only the site's name is used: the rest of the address is never read or kept, a site outside our short list of known sources is kept only as “referral”, and nothing in the cookie tells one browser from another. Without a sign-up we write nothing else anywhere, and the cookie expires. On sign-up it becomes the “where you first arrived from” listed above, and the cookie is deleted.
Your browser and other people's servers. The sign-in, sign-up and password-reset pages, and the Settings forms that ask for your current password — to change your e-mail or password, or to delete the account — carry Cloudflare Turnstile, a check that tells a person from a bot. It loads with the page or the form, without waiting for your answer about analytics, because nobody can sign in without passing it: it is what stops scripts from guessing passwords and opening accounts by the thousand, and keeping them out is our legitimate interest. Cloudflare sees your IP address and what your browser says about itself, such as its user agent and the fingerprint of its encrypted connection; our sign-in service learns from it only whether the check was passed. Cloudflare also uses those signals to improve the check, under its own Turnstile privacy terms. Otherwise a signed-in page talks to our servers and our database and to nobody else, with two exceptions we have not closed yet: coin icons on portfolio pages load from CoinGecko's image service, and the icons of news sources beside the market charts from Google's icon service; both see your IP address and which icons were asked for. The addresses you watch are looked up in public blockchain explorers and nodes from our servers, not from your browser, so an address is not tied to your IP; when you scan a wallet for what it was bought with, the same explorers are asked about that address, and public name registries about the addresses that paid it.
What a sender's account keeps. Your business profile — name, legal name, e-mail, phone, website, tax number, address, logo, colour and the counters your documents are numbered from. Your contacts: every client or vendor you have written a document to, with name, e-mail, phone, tax number, address and your private notes. Saved line items. The ways you get paid — wallet addresses, or bank accounts with their IBAN or account number, BIC, the bank's name and the holder's name and address. The documents themselves, each with a frozen copy of both parties and of the payout details it offers, its lines, totals, notes, terms and dates, its status, when it was first opened, when it was marked paid and how much arrived, a payer's reported transaction and when they said they had paid; repeating schedules; and the per-document switches for Telegram alerts, chain watching and the private link, whose code is stored as you typed it. On the receiving side: which documents in your Inbox you have read, and the senders you refused.
Who sees a document. Anyone who holds a document's link sees the whole document — both parties, the lines, the totals and the payout details — for as long as it exists; a private link asks for its code first, and once the code is entered the browser keeps it in a cookie for thirty days so the document does not ask again. Unless the document is private, a chat or mail program that previews the link is shown its number, the issuer's name and the total. The addressee with a Perly account under the same confirmed e-mail sees it in their Inbox, and their Telegram, if connected, gets a message with the number, the amount, the due date and the link. Your logo is a public file. Opening a document records only that it was opened, once, with the time — no address and no browser.
Your clients' data, and their rights. Your clients did not sign up for anything. Their details reach us because you typed them, and we hold them for you as your processor: to store and print the document, to show it to whoever holds the link, and to put it in their Inbox if they have an account. We do not use them for anything else. We send your clients no e-mail; the only message that ever reaches one is the Telegram notice above, and only when they have their own Perly account with Telegram connected. A client who wants their details corrected or removed asks you: you can edit or delete a contact at any time — a document already written keeps its own copy of the details — and edit a document until it is paid, which takes effect for everyone who holds its link at once. You can delete a document whatever its status — its link stops opening and it leaves your client's Inbox — and every document goes when your account does. A client who writes to us instead is passed on to you, and we help you answer.
Reading a chain, and drawing a PDF. If you switch on watching for a document, our job asks public blockchain nodes and explorers, from our servers, whether the payout address on that document has received the amount, and when it has the document is marked paid — and you are told on Telegram if you connected it. The address it asks about is the one you printed, on the chains it can read. The PDF of a document is drawn on our servers from the same page a client sees, and is not kept — a download draws it again. The free generator on the front page keeps your unsaved draft in your own browser for up to fourteen days after your last change, and stores nothing on a server until you press keep; its PDF is drawn from what you send and not kept either. So that a script cannot turn a free tool into somebody's bill, an account's new documents and PDFs are counted against the account each day, and the PDFs drawn without an account are counted per network address, as a salted hash of it, the way sign-in attempts are. Besides the session it shares with the application and a private link's code, the site keeps your language and your time zone in cookies, each for a year — the zone so that a document is dated by your calendar, not by ours — and, for thirty days, a cookie that says only that you are signed in, so that its pages can show the right link at once. Its public pages — the front page with the free generator, and the guides — load Google Analytics only after you answer yes to the question they ask; it is the same Google Analytics as on this site, and the Cookies link in their footer asks again. A document's own page, the pages behind the sign-in and the printed sheet never load it.
Nothing about you. The charts site has no accounts and no sign-in, and loads Google Analytics only if you allow it (below). What it counts itself, it counts in our own database in a shape that cannot hold a person: one row per day, kind of event, page, subject, language and screen size, with counts on it — how many arrived, how many went on to a second page, how long they stayed, how far they scrolled. One of those kinds counts the site a reader arrived from, by its host and nothing else. Another counts each visit under the country its connection comes from, as a two-letter code that the network in front of our database works out from the request's IP address; the address itself is counted only as a salted hash kept apart from the totals, the way sign-in attempts are, deleted within a day. The site also counts how fast its pages appear, by your browser's own speed measures — largest paint, responsiveness, layout shift, first paint and server response — each recorded per page only as “good”, “needs improvement” or “poor”. And when a page runs into an error in your browser, it counts the error's name against that page — “TypeError”, say — never its message or anything else about your browser. Our counters have no event rows, no cookies, no IP addresses and no identifiers. Whether a page was your first in this tab, and whether you went on to a second, is settled in your browser tab and arrives as a yes or a no. The cost is that our own counters cannot count unique readers, and they are not meant to.
In your browser. One cookie, perly-display, remembers your choice of bitcoin or fiat and the display settings behind it for a year, and our server never reads it. The site's other preferences — the tour you finished, sound on or off, how a board is arranged, the fish tank's settings — live in your browser's own storage and never leave it. If you choose Allow in the cookie notice, Google Analytics loads and sets cookies of its own to count page views, the same Google Analytics as on this site; if you decline, it never loads. Your answer is kept in your browser's own storage, and the Cookies link in the site's footer opens the notice again.
Third parties your browser meets. Most feeds are read by our servers. A few things your browser fetches itself, and those hosts see your IP address as any website you open does: the news page loads publishers' icons from Google's icon service and posters' avatars from X's own image host, pbs.twimg.com; the food-chain page opens live connections from your browser to the exchanges it draws — Kraken, Binance, OKX, Bybit, Bitfinex and Hyperliquid; “Share on X” opens X with the page's address; and the counters above go to our database, so Supabase sees the request like any request. Nothing your browser sends to any of them says who you are.
Feedback. A note you leave in the feedback form is stored in our database: the words you wrote, a contact if you chose to leave one — an e-mail address or a handle, used only to answer you — the page you were on, its language, the width class of your screen and the time. The note keeps no IP address, no browser details, nothing you did not type. So that one script cannot flood the form, notes are counted per network address — five an hour — as a salted hash of the address, the way sign-in attempts are, deleted within a day. Notes are read by a person on our admin panel and kept for a year.
E-mail. We write to the address on your account through Resend, from perly.io: mail for the account itself — confirming your address, resetting your password, confirming a new address; a receipt for what you pay at the application's own checkout, and, the day after an invoice there lapses unpaid, a note that you can try again; reminders 30, 7 and 1 days before a paid year ends, and once after it ends; three letters about your fourteen free days if you have bought nothing — shortly before they end, once they have ended and a week after; one letter, sent once, to an account that two days after sign-up still has no portfolio of its own, on how to begin, with a link in it that stops letters like it; and answers to what you ask us. Nothing else: no newsletter, no advertising, nothing on anyone else's behalf. We note which letters went out and when, so that none goes twice, and when a stop link was used. When you pay for a seat or a year on Perly Pay's checkout, the application gives Perly Pay your address, and the receipt comes from Perly Pay, as do the reminders for a year that Perly Pay renews, under its own Privacy Policy. Perly Invoice sends no documents by e-mail.
Telegram. If you connect a chat to our bot, we keep its id, username and first name, and the bot sends you what you asked for: price alerts and goals, DCA reminders, market alerts, and from Perly Invoice that a document was opened, paid or is due, or that one addressed to you has arrived. Telegram is not end-to-end encrypted: the message — a target, a note, an amount, a link — sits on Telegram's servers, where Telegram can read it. Messages already delivered stay in that chat when you disconnect or delete your account.
Browser push. If you turn notifications on, we keep the push address your browser hands us and the keys that encrypt messages to it, for up to ten browsers. Delivery goes through your browser's own push service — Google's, Mozilla's or Apple's — which carries a message it cannot read.
Perly runs on a few providers that process data on its behalf and for no one else:
Access is locked down. Nobody outside Perly is given your records — not partners, not advertisers, not analytics vendors; the providers above process them only to run the service. Inside Perly, access is restricted to what keeping the service running strictly requires — restoring a backup, fixing a fault you reported, reading the notes readers leave. The admin panel shows counts, recent sign-ups and payments; it does not browse ledgers, and it cannot open an encrypted one.
What we can never reach. Perly holds no wallet connection, no seed phrase, no private keys and no exchange API keys — there is nowhere in the system for them to live. Your funds are outside our reach by construction: we could not move, freeze or spend them if we wanted to, and we cannot trade on your behalf.
Where it lives, and where it travels. Your data is stored in the European Union — the database in Ireland, the servers in Dublin and Frankfurt, the backup in an EU bucket. The person who administers it reaches the database under the access rules above. Google, X and Telegram take part only where you chose them, under their own terms; Cloudflare's bot check runs on Cloudflare's own worldwide network; the blockchain nodes and market feeds our servers ask are wherever they are, and receive an address or a symbol, never your identity. By Perly Pay's own Privacy Policy, its database, the servers its worker runs on and its backups are in the European Union, and Vercel serves its pages.
For most of them you do not have to write to us: the application does them itself.
Nothing here asks how old you are, and there is no age gate. Decisions about money are better made grown up; that judgement stays with you. When this policy changes, the date at the top changes with it.
Questions or requests: hi@perly.io
© 2026 Perly. All rights reserved.