Privacy policy

The short version

A swap stores what a swap needs and nothing else: the amounts, the on-chain transaction ids, the address you asked us to pay, and the swap’s status. There is no account, no email and no identity document unless you choose to create an account, and then we store an email and a password hash. We run no analytics, no advertising and no third-party tracking scripts.

What a swap stores

• The asset and network you send, and the exact deposit amount.
• The asset and network you receive, the quoted amount, rate and fees.
• The destination address you give us, and the refund address if you add one.
• The on-chain transaction ids of your deposit and of our payout.
• The swap’s status history and the times each status changed.

A swap is identified by a random link. We do not ask for a name, email, phone number, identity document or wallet ownership proof at any swap size.

If you create an account

Accounts are optional. If you open one we store your email address, a hash of your password (never the password), and the swaps attached to the account. For each sign-in we keep a session record with the browser’s user-agent string and the IP address it connected from, so you can recognise and revoke sessions; these expire with the session. If you were a guest first, a signed cookie in the browser you used lets us attach your earlier swaps to the new account.

Cookies

One cookie, only if you sign in: the session token, marked HttpOnly and SameSite. Your light/dark preference and the fiat currency you chose in the widget are kept in your browser’s local storage and never sent to us. No advertising or analytics cookies exist on this site.

Server logs and rate limiting

The web server keeps standard access logs (IP address, requested URL, time, user agent) for operating and securing the service; they are rotated and not used to profile visitors. Abuse protection counts requests per IP address in memory only, for a few minutes, and writes nothing to disk.

Third parties

• Price data — we fetch market prices from CoinGecko and Kraken from our server. Your browser never contacts them.
• Blockchain data — to verify deposits and payouts, we query public block explorers (including mempool.space). Those queries contain a deposit address, never anything about you.
• Email — if you open an account, sign-in and verification emails are delivered through Resend. Guests receive no email.

We do not sell, share or rent any data to anyone.

What is public anyway

Your deposit is a normal transaction on the chain you sent from, and the payout is a normal transaction on the chain you receive on. Those are visible to anyone with a block explorer, as they would be for any transfer. Swapping into a shielded Zcash address or a Monero address makes the receiving side private; it does not make the sending side private. See trust and transparency for how a swap works.

Retention and removal

Swap records are kept so that a swap can be traced, refunded or disputed later. Write to support@swaptozec.com from the account email, or with the swap link, to have an account deleted or a swap’s destination and refund addresses removed once the swap is complete and no refund is pending. Transaction ids and amounts are on public chains already and are kept for accounting.

Changes

If what we store changes, this page changes with it, with a new date at the top.