Privacy Policy

When you submit our comparison form, we collect: • Loan type (general loan or mortgage) • BTC owned (approximate amount from slider) • Loan amount desired • Email address (optional — provided only if you want the comparison emailed to you and to receive rate-drop alerts, new-lender announcements, and our whitepapers) When you use our refinance comparison form, we also collect the lender you currently borrow from, your current interest rate (chosen as a range, not an exact figure), and your current loan balance. We collect these refinance fields solely to generate a side-by-side comparison of refinancing options for you. They are not used to facilitate a loan application, and we never share them with any lender. The refinance form is a comparison tool, not a loan application: to refinance, you apply directly with whichever lender you choose. When you use our results page, we collect: • Filter selections you make (state, custody preference, etc.) • Sort selections you make • Lender rows you expand for detail • Lender links you click • Tooltips you open • Page views and timestamps When you separately subscribe to our mailing list or download a whitepaper from our Resources page, we record your email address and the source of the signup in a subscribers list that is kept separate from form submissions. If you choose to create an account, we collect: • Your email address, which we use to sign you in. Sign-in is passwordless: we email you a one-time link, so we never set or store a password. • The lenders you save to your watchlist • Your alert and email preferences • Bitcoin addresses you choose to save, with their balances and any loan details you enter for alerts (see "Bitcoin wallet addresses" below) • A link connecting your account to comparisons you previously ran on this device, so you can revisit them once signed in An account is entirely optional. The comparison form, rate tables, calculators, and lender links all work without one. An account holds only the items above; it never stores private keys, seed phrases, financial credentials, account numbers, income, Social Security numbers, or KYC documents. Across the site generally, our own server keeps a record of the pages you view. For each page view we record: the page path (never the query string — so search terms, share links, and anything else carried in a URL are excluded), the page title, the names but never the values of any URL parameters, how long you stayed on the page, how far down you scrolled, the domain of the site you arrived from (its domain only, never the full address), your device type, your IP address with the final portion removed, and your browser's user-agent string. If you later submit the comparison form, we link that record to your submission, so we can see which of our pages were useful to the people who asked us for a comparison. We keep this on our own servers and do not share it with lenders or anyone else. We also collect standard technical information: IP address, browser type, referrer URL, and UTM parameters from links you arrived through.

• To deliver the lender comparison you requested • Where you provided an email, to send the confirmation email containing your comparison and links to our whitepapers • Where you opted in to our mailing list, to email you when a lender we track lowers its rate or when we add a new lender, and to share our latest research • Where you create an account, to sign you in, save the lenders and preferences you choose, and let you revisit your past comparisons • Where you save a Bitcoin address, to show your balance, send the loan-to-value alerts you turn on, and understand, in aggregate and internally, how much Bitcoin our users hold • Where you separately opt in to offers relevant to your holdings, to use your saved balance to choose which offers we email you • To improve the site (which lenders are viewed, which content is helpful, which technical terms are unclear) • To respond to messages you send us • Where you've explicitly opted in (e.g., by replying "borrower" to the confirmation email), to follow up about your request Mailing-list and new-lender announcement emails are voluntary opt-in. Every marketing email includes a one-click unsubscribe link.

• We do not collect financial credentials, account numbers, or KYC documents • We never ask for a wallet's private keys or seed phrase, and never ask you to sign or approve a transaction • We do not collect phone numbers • We do not sell your personal information • We do not share your email address with lenders • We do not submit your information to lenders on your behalf or act as a loan originator or mortgage broker

On our rates dashboard you can paste a Bitcoin address to see its balance. This is read-only: we look up the address's public balance and never ask for keys, a seed phrase, or a signature. If you are not signed in, the address is sent to our server once to look up the balance and is not stored. The only record we keep is a daily count of lookups grouped by balance range (for example "between 1 and 5 BTC"), with no address, no exact amount, and no IP address. If you are signed in and choose to save an address, we store it in encrypted form, together with its balance, which we refresh daily. If you enter a loan amount and lender and turn on alerts, we use those with your saved balance to email you when your loan-to-value crosses the level you set. Our staff can see each signed-in user's email address and total saved balance, but not the addresses themselves, and we use this information internally to understand our users. If you separately opt in to offers relevant to your holdings (off by default), we may also use your saved balance to decide which offers to email you. To read balances, our server queries mempool.space, a public blockchain data service. It receives the address from our server, not from your browser, so it does not see your IP address. We do not share your saved addresses or balances with lenders or anyone else. You can remove a saved address at any time from your account page, which deletes it, and deleting your account deletes all saved addresses and alert settings.

When you use BoB, the chat assistant on this site, we store: • The questions you ask and BoB's answers, linked to your account if you are signed in, or, if you are not, to the random visitor ID our site already sets in your browser (described in the Cookies section), not to your name or email • The page you opened BoB from (the page address only) • Any thumbs-up or thumbs-down rating you give an answer • Technical details of each answer, such as its length and cost You can ask BoB a few questions without signing in. If you then sign in and carry on that conversation in the same browser tab, it is moved to your account. Questions asked without signing in are checked by Cloudflare Turnstile, the same spam check our comparison form uses. We also count, without storing any question text, when BoB is opened, where it was opened from, and when its sign-in screen is shown, so we can see how BoB is used. We use these to operate BoB, to apply its usage limits, and to improve BoB and the site, including by reviewing conversations to find questions our content does not answer well. To generate answers, the text of your question and the recent messages in the same conversation are sent to OpenAI, which provides the AI model behind BoB and processes that text under its API terms. We do not send your email address or account details to OpenAI. Some answers, such as whether a lender operates in your state, come directly from our lender records without the AI model. BoB's answers are general information about lenders and loan terms, not financial advice, and they can be wrong. Confirm terms with the lender before applying. We keep your BoB conversations until you ask us to delete them by emailing michael@borrowonbitcoin.com, or until you delete your account, which deletes them along with your other account data. Conversations held without an account are not linked to your email, so to have one deleted, tell us roughly when you asked and what you asked, and we will find and delete it.

We retain submissions and engagement data for as long as we operate the service, unless you request deletion. Aggregated analytics may be retained longer in non-identifying form. If you create an account, we keep your account data until you delete the account. You can delete your account at any time from your account page, which permanently removes your saved lenders, preferences, linked comparisons, and email from our lists.

You can request that we delete your submission and associated data by emailing michael@borrowonbitcoin.com. We will confirm and complete deletion within 30 days. If you have an account, you can also delete it and all associated data yourself, immediately, from your account page. California residents have additional rights under the California Consumer Privacy Act (CCPA); see the section below.

We use cookies and similar technologies for session continuity (so you can return to your results page from the confirmation email), analytics, and advertising measurement. For analytics, we use Plausible Analytics (privacy-friendly, sets no cookies), Google Analytics 4 (loaded through Google Tag Manager, which sets first-party "_ga" and "_ga_*" cookies), and PostHog, a product-analytics tool that helps us understand how visitors move through the site. PostHog sets first-party cookies and browser storage (prefixed "ph_"); we do not use its session-recording feature. For advertising, we run Google Ads conversion tracking to measure which campaigns lead to form submissions. It sets Google's first-party advertising cookies, primarily "_gcl_au" (the conversion linker, which stores ad-click information for up to 90 days). If ad personalization is enabled on a campaign, Google may set additional cookies to support remarketing. When you arrive from one of our ads, we also store that ad's click identifier (Google's "gclid", "wbraid", or "gbraid") in a first-party cookie set by our own server, for up to 90 days, and we record your outbound clicks to lenders and any comparison you submit. This is our own first-party measurement of which ads lead to genuine interest, and we may report these events to Google Ads as "offline conversions" to measure and improve our advertising. We do not include your email, name, or the details of your request in this measurement — only the ad click identifier and the fact that a click or submission happened. Whether our analytics and advertising cookies (Google's browser tags and PostHog, described above) load by default depends on where you are, managed through Google Consent Mode v2 and applied to PostHog the same way: • If you are in the United States (and most regions outside the areas listed below), these cookies load by default, consistent with the opt-out approach of US state privacy law. You can opt out at any time using the "Cookie settings" control in our footer, and we automatically honor Global Privacy Control (GPC) browser signals as an opt-out — in which case these cookies do not load. • If you are in the European Economic Area, the United Kingdom, or Switzerland, these cookies are denied by default and load only if you grant them in the consent banner we show you. Strictly necessary session cookies are exempt and always set. Our first-party ad measurement described above operates on the same opt-out basis: if you turn on GPC, opt out via "Cookie settings," or decline in the consent banner, we exclude your clicks and submissions from any conversion reporting to Google. We honor Global Privacy Control (GPC) signals as an opt-out. To protect our comparison form and the questions asked of BoB without signing in from automated abuse, we use Cloudflare Turnstile in its invisible mode. It runs a background check to confirm a submission comes from a real browser rather than a script, and it replaces the need for a CAPTCHA — you will never see a puzzle or a checkbox. Turnstile is a security measure necessary to provide the service, not analytics or advertising: it sets no advertising cookie, builds no profile of you, and is not used to track you across other sites. Because a spam protection a visitor could switch off would not protect anything, it is not covered by the analytics and advertising opt-out above and runs on all form pages. Cloudflare processes a limited set of technical signals (including your IP address and browser characteristics) to make that determination, as described in Cloudflare’s Turnstile Privacy Addendum, available at https://www.cloudflare.com/turnstile-privacy-policy/, and in Cloudflare’s Privacy Policy at https://www.cloudflare.com/privacypolicy/. Separately from all of the above, we set two of our own cookies to keep the page-view record described under "Information we collect": "bob_vid", a random identifier that lasts up to 365 days, and "bob_sid", a random session identifier that lasts 30 minutes. Both are random values that hold no personal information, both are readable only by our server, and neither is shared with any third party. Because this record stays on our own servers, is not advertising, and is not used for targeted advertising or shared with anyone, it is not covered by the advertising and analytics opt-out above and continues if you opt out — we do record your opt-out alongside it. If you would prefer we delete it, email michael@borrowonbitcoin.com; the same request that deletes your submission deletes this record too.

This site is not directed at children under 13 and we do not knowingly collect data from minors. If we learn we have collected personal information from a child under 13 without parental consent, we will delete that information.

California residents may request: (1) what personal information we have collected about them, (2) deletion of that information, (3) to opt out of any sale or sharing of that information (note: we do not sell personal information). You can opt out of advertising and analytics cookies at any time using the "Cookie settings" control in our footer, and we honor Global Privacy Control (GPC) signals as a valid opt-out request. Email michael@borrowonbitcoin.com to exercise these rights.

Residents of these states have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or use for targeted advertising. We do not sell personal information. We do run Google Ads, which may constitute targeted advertising; you can opt out using the "Cookie settings" control in our footer, and we honor Global Privacy Control (GPC) signals as a valid opt-out. Email michael@borrowonbitcoin.com to exercise these rights.

We may update this Privacy Policy. Material changes will be noted at the top of the page with a new "Last updated" date. Continued use of the site after an update constitutes acceptance.

Questions about this Privacy Policy: michael@borrowonbitcoin.com.