Privacy Policy

A swap needs coins and an address. It does not need to know who you are. This policy explains the little we keep and why.

Who is responsible

The controller of the data described here is HiddenSwap. Write to legal@hiddenswap.com about privacy or your data, and to contact@hiddenswap.com for help with a swap.

What we collect

Swap records. For each swap we store:

the order ID,
the coins, networks and amounts,
the deposit and receiving addresses, the sending address if you give one, a refund address if one is added, and any memo or tag,
transaction hashes,
the order status and times,
where the visit that led to the swap started: the first page you opened on our site, a referral tag or campaign name from the link you followed, the name of the website that sent you, and which of our web addresses you used. This tells us which pages and links help people. It is not linked to you in any other way.

Hidden orders. After a swap is complete, refunded or expired, anyone who opens its order link can hide the order. Its page and our API then show only that the order is hidden and its order ID, to anyone who opens the link. Hiding changes what our site shows from then on; pages that are already open, and copies saved before, stay as they are. We keep the swap record as described below, and the service provider that carried out the swap keeps its own records under its own terms. That provider may still show the swap on its own site by the same order ID. If you write to us about a hidden order, include its order ID.

Anonymous swap statistics. When a swap ends, we also keep a separate record with the pair, the rate type, the outcome, the day, how many minutes it took and, as a percentage, how far the final amount was from the estimate. It has no order ID, amounts or addresses. We use these records to publish completion times on our swap pages.

Browser storage. While you browse, our page keeps the first page of your visit in your browser’s session storage, so it can be added to a swap you start; it is deleted when you close the tab. If you arrived from a partner site or a link with a referral tag, the name of that partner and the date are kept in your browser’s local storage for 30 days, so a swap you start later still credits them. We do not use cookies for this, and neither contains anything about you.

Website analytics. We use Google Analytics to count visits and see which pages people use. It sets first-party cookies and sends page views, device and browser details and an approximate location to Google. It is not loaded on order pages or on the tracking page, so it never sees an order ID. You can block it with a browser setting or extension; swaps work without it.

Product analytics. We use PostHog to see which pages and links lead to swaps and which swaps earn us anything. It works in two parts.

From your browser, we send the page you are on, the referring website, a referral tag or campaign name from the link you followed, and four steps of the swap box: a rate was shown, a swap was submitted, it failed, it started. Only the pair and the rate type go with those steps. The amount you type, the address you paste and any memo are never sent. PostHog sets no cookies; it keeps a random ID in your browser’s local storage, which you can clear at any time. Requests go to our own domain and we pass them on, so your browser never contacts PostHog directly: we shorten your IP address to its network part first, which is enough to tell a country and not enough to tell an address, and PostHog is set to discard IP addresses after that. Like Google Analytics, it is not loaded on order pages, on the tracking page or on our onion address, and it honours a “do not track” browser setting.

From our server, when a swap is created, receives its deposit or ends, we send a record of it: the pair, the rate type, the amounts, an estimated value in US dollars, what we earned, and the referral tag, campaign or referring website the visit started with. These records carry no order ID, no address, no memo and no transaction hash. The events of one swap are tied together by a one-way code, so the analytics data cannot be matched back to your order.

Chat on our site. Our chat button opens a chat on our own site, which we run ourselves. Some replies are automatic: a hello, the live status of the order the chat is about, and short answers to common questions. When our AI assistant is on, it answers first: the messages of that chat and, if the chat has an order ID, that order’s status are sent to the company that provides the AI model (Anthropic or OpenAI, whichever we use at the time) to write the answer. Automatic and AI answers are marked as such, and a person from our team can read every chat. We keep the messages you and we write, when they were sent, the page you started the chat on and, if you started it on an order page, that order’s ID. We do not ask for a name or email. Nothing about the chat is saved in your browser beyond the open tab. To come back to a chat, you get a chat code, and we store only a one-way hash of it; a chat started on an order page also opens again from that order’s page, so anyone with the order link or the chat code can read it. Once an order is hidden, its link no longer opens its chat. Please do not write your seed phrase or private keys; we never ask for them. If a message looks like it contains one, we remove that part before the message is saved, so it is never stored, shown or sent anywhere. If you write a transaction hash, we look it up in our swap records to tell you that swap’s status; for a swap whose order ID the chat does not have, we tell you only its status. We may also look the hash up on public blockchain services from our server, to tell you whether the transaction confirmed and reached your order; only the hash is sent to them, never your IP address or anything else about you. When the AI is on, it also notes the language you write in and, if it is not English, translates your messages into English for our team and our replies into your language. If you rate an AI answer as helpful or not, we keep that rating with the chat to improve the answers. You can ask us to delete a chat at legal@hiddenswap.com.

Chat on Telegram. You can also write to our Telegram account (@hidden_swap). Our pages load nothing from Telegram. If you write to us there, Telegram processes the messages under its own terms, and we see your Telegram name and anything you send. If you write to our Telegram support bot, your messages are handled like a chat on our site (automatic and AI replies, and a person when needed); we keep the Telegram chat ID with the chat so we can reply, not your name, username or phone number.

HiddenPay payment links. If you create a HiddenPay link (a payment link or button), we store the coin and address you are paid to, any memo, the name, note and amounts you enter, the button style, a one-way hash of your owner key and, for each payment through the link, its order ID, coins, amounts and status, plus a running total. If you add an email for payment notices, we keep it encrypted, send to it only after you confirm it, and delete it when you remove it or stop the notices. Payers see the name and note you chose and the end of your address, never your email. We do not tell link owners who paid them.

Affiliate and API accounts. If you open an affiliate or API account, we store your username, a one-way hash of your password, your recovery codes (as one-way hashes), the email you give if any (encrypted, and used only for sign-in, password resets and notices about your account and payouts), the secret for two-step codes if you turn them on (encrypted), the public part of any passkey you add, your Telegram chat ID if you connect Telegram for alerts, the sessions you are signed in with, your affiliate code, the coin and address you are paid to and any change to it, a count per day of clicks on your link, and for each finished swap that came through your link or your API keys its order ID, month, value in US dollars and the fee and share that applied, plus every payout with its transaction. For an API request we store what you tell us about your project. For API partners we also store the fee we agreed, the partner ID used with our service provider, and one-way hashes of the API keys. We count a click once per visitor and day using the temporary in-memory hash described under Technical data; nothing about the people who click is stored. An affiliate sees the swaps their link brought: the time, the coins, the amounts, the status, what they earned and the first characters of the order ID, never addresses or transactions. An API partner sees every detail of the orders made with its own keys.

Messages to us. If you write to us, we keep your message, any attachments, and the name and email address or chat account it came from.

Technical data. Our servers use your IP address to deliver pages and to limit abuse. It is not stored in swap records. Abuse limits use a temporary one-way hash that is kept in memory only. Our hosting provider may keep short-lived connection logs for security.

What we do not collect

Your name or email address (unless you write to us), phone number or ID documents.
Passwords or accounts. There are none.
Advertising or remarketing trackers.
Your IP address in swap records. Your IP address is not passed on with your swap.

Why we use it

To create and run your swap and show its status. This is needed for our contract with you.
To answer support requests and handle refunds, as part of that contract or, for other messages, our legitimate interest in replying.
To learn which pages and links help people, from the visit data and analytics above, which is our legitimate interest.
To prevent fraud and abuse and keep the service secure, which is our legitimate interest.
To meet our legal obligations.

We do not trade data for money, and we do not use it for marketing.

Third-party service providers that help us carry out swaps. To run a swap, they receive the coins, networks, amounts, addresses, memos and transaction hashes. They use them to process the swap and to meet their own legal duties, as independent controllers under their own privacy terms, and may keep records for longer than we do where the law requires it. Anything you give them directly is handled by them, not by us.
Service providers that host our website and our email for us.
Google, which provides Google Analytics and the mailbox where we read your messages, and processes this data under its own terms.
Telegram, if you choose to write to us there, under its own terms.
PostHog, which provides the product analytics described above and processes this data for us under its own terms.
Anthropic or OpenAI, whichever provides the AI model behind our chat assistant when it is on, which processes chat messages for us under its own terms.
Authorities, when the law requires it.

Where data is processed

The providers listed above may process data outside the place where you live. When the law requires it, we use appropriate safeguards for these transfers, such as adequacy decisions or standard contractual clauses; ask legal@hiddenswap.com for details.

How long we keep it

Swap records: 90 days, then we delete them.
Hidden orders: the same as any other swap record.
Affiliate and API accounts: while the account is open. When you delete it, the sign-in details, email, two-step secret, passkeys, sessions and payout address are deleted at once; the username stays so nobody else can take it, and earnings and payout records are kept for 2 years after the last payout, so payouts can be checked. Earnings records keep only the order ID, month and value, not addresses.
HiddenPay links: until you delete the link. Deleting it removes the address, name, note and email at once. Payment records follow the swap record period; the running total per link has no payment details.
Chats on our site and with our Telegram bot: 30 days after the last message, then we delete them.
Messages to us: as long as we need them to handle your request and any dispute.
Analytics data: up to 14 months in Google Analytics, and in PostHog for the retention period of our plan, which is 12 months today.
Backups: our database is backed up once a day and each backup is kept for 6 days, so a deleted record is gone from the backups within 7 days.

We keep data longer only when the law requires it or while a claim is open. Blockchain transactions are public and permanent, and nobody can delete them.

Cookies and third parties

Our own cookies are only the ones the site needs to work, and we never use them for analytics or advertising: a sign-in cookie for the page where you manage a HiddenPay link, which ends after 12 hours, one for affiliate and API accounts, which ends 14 days after your last visit or when you sign out (plus a five-minute one while you enter a two-step code), and one for our staff sign-in. Google Analytics sets first-party cookies (named _ga) and loads a script from Google on our clearnet pages, except order and tracking pages. PostHog sets no cookies at all: it keeps a random ID in your browser’s local storage and its script is served from our own domain, so no request goes to PostHog from your browser. We use no other third-party scripts, fonts or images, no advertising cookies, and the site works with JavaScript turned off.

Security

We use encrypted connections, restrict who can access data, and store as little as possible.

Your rights

Depending on where you live, you can ask us to show, correct or delete your data, to limit its use or object to it, or to give you a copy. You can also complain to a data protection authority. To make a request, email legal@hiddenswap.com. As there are no accounts, include your order ID so we can find your records. Hiding an order does not change these rights. We reply within one month.

Children

HiddenSwap is not for anyone under 18.

Changes

We may update this policy. The date at the top shows the latest version.

Contact

Privacy questions and data requests: legal@hiddenswap.com
Help with a swap: contact@hiddenswap.com