Data posture

not collected

no accounts, no email, no cookies, no analytics or fingerprinting scripts, no KYC data — ever. The receive address you paste is used to build the swap and nothing else.

temporary

an active swap keeps only what /track and the signed receipt need: deposit address, amounts, reference, txids. Unfunded quotes are deleted at expiry; completed-swap records prune after 21 days.

never stored

we don't index by destination address — you can't look a swap up by where it's going, and neither can anyone else. Lookup is by reference, deposit txid or deposit address only.

server logs

access logs disabled in production. The onion mirror serves byte-identical content; Tor is a first-class path, not an afterthought.

partner pairs

on XMR routes the custodial partner keeps its own order data under its own policy (erased within about a week per their terms) — that's the partner's system, disclosed on /lines.