Privacy policy
Last updated 2026-10-13
This policy covers the Swapper web app at xmrtousdc.xyz, its HTTPS API (/api/v1), the MCP server (https://xmrtousdc.xyz/mcp) and the A2A endpoint. Swapper asks for no account and no identity documents. It records what it needs to create and track a swap, to answer support requests and to keep the service running, and nothing else.
The values below are the defaults in Swapper's source code. The values the running service uses are published as data: GET /api/v1/agent/capabilities (trust.data, trust.data.retention) and the MCP resource swapper://trust. Where they differ, they are the source of truth.
With every request
- The application request log: client IP address, method, path (query values redacted) and status. Its retention follows the host's system log settings.
- The HTTPS access log: client IP address, user agent and path, with lookup secrets redacted. It is rotated by size (5 files of 50 MiB).
- Operator metrics: a visitor token (an HMAC-SHA-256 of the IP address and user agent under a server secret, truncated), not the IP address itself, kept 30 days.
- Agent usage statistics for the operator: which client called (the agent key's id, the MCP or A2A client name, or the user agent's product name), which operations it used and where they failed. IP addresses are kept only as a count of distinct salted hashes.
With every order
The order record: order ID, deposit address, destination (payout) address, amounts, the session ID the client sent or Swapper derived, the provider's order session, the status history, the idempotency key and Swapper's signed statement of the deposit instructions (attestation). Kept 30 days by default. Quotes are kept for the quote window plus one hour. Operator alerts about an order carry its ID, status, amounts and assets, with the destination shortened to its first 6 and last 4 characters.
Support tickets
The message, category, order ID, session ID and wallet address you give, the public thread (your follow-ups and Support's replies) and a hash of the reply token (never the token itself). Kept 90 days by default. The operator is alerted with the ticket ID, order ID, category, an excerpt of the message and a shortened wallet address. Email to support@xmrtousdc.xyz is kept by the mail provider like any email.
Agent keys (optional)
An agent that asks for an agent key gives a self-declared name and, optionally, a contact and a purpose. Swapper stores them with the channel used, usage counts and the time of last use, and stores the key itself only as a SHA-256 hash. The operator sees this record. It is kept until the operator revokes or deletes the key.
Feedback (optional)
A rating after a swap stores the rating, the comment, the order ID, the self-declared agent name and the channel. A comment is published only when its author marked it publishable and the operator approved it; it is shown as untrusted third-party text.
In your browser
The web app keeps your recent orders and settings in your own browser's local storage so you can find them again. Swapper's servers do not read that storage; clearing your browser data removes it. The web app sets no tracking cookies and loads no third-party scripts.
What Swapper never asks for
Seed phrases, private keys and identity documents. Swapper never holds funds or keys and never signs transactions. Anyone asking for them in Swapper's name is not Swapper.
The swap provider
Swaps are executed by the provider, Wagyu (wagyu.xyz). To create and track an order Swapper sends it the swap request (chains, tokens, send amount and the destination address), the refund address when one is given, Swapper's integrator key, an order session Swapper derives for each order and, for status reads, the order's session or its destination. The provider sees Swapper's server IP address; your IP address and user agent are not forwarded. The deposit goes to the provider's address, so the provider also sees the deposit transaction. Wagyu's own privacy policy and terms apply to what it receives, and it may apply its own compliance screening, which Swapper cannot check.
How long records are kept
| Record | Default | Live value |
|---|---|---|
| Order records | 30 days (ORDER_RETENTION_DAYS) | trust.data.retention.orderRecordDays |
| Idempotency records (create retries) | 24 hours (IDEMPOTENCY_WINDOW_MS) | trust.data.retention.idempotencyRecordSec |
| Quotes | the quote window (300 s) plus 1 hour | trust.data.retention.quoteSec |
| Support tickets and their thread | 90 days (TICKET_RETENTION_DAYS) | trust.data.retention.supportTicketDays |
| Live support chat | 7 days (SUPPORT_LIVE_RETENTION_MS) | trust.data.retention.liveChatDays |
| Operator metrics (visitor tokens, counters) | 30 days (ADMIN_METRICS_RETENTION_DAYS) | trust.data.retention.operatorMetricsDays |
| HTTPS access log | rotated by size: 5 files of 50 MiB | infra/caddy/Caddyfile |
| Application request log | the host's system log settings (not set in the source) | trust.unknowns |
| Agent keys | until the operator revokes or deletes the key | trust.data.agentKeys |
| Feedback | until the operator deletes it | trust.data.feedback |
If the operator turns on the append-only event log, operator events are kept in it without automatic deletion (trust.data.retention.operatorEventLog).
Sharing
Swapper does not sell or rent data. It shares what is listed under The swap provider with the provider, sends operator alerts to the operator's own channels (a webhook or email, when configured) and runs on hosting infrastructure that processes the logs above. If Swapper receives a legally binding request, it can only disclose the records listed on this page, for as long as they are kept.
Questions and requests
Swapper cannot link records to a person without an identifier. To ask about or delete records tied to an order or a ticket, email support@xmrtousdc.xyz with the order ID or ticket ID. Records the provider holds are covered by its own policy.
Changes
When this policy changes, the date at the top changes too. Related: Terms of service · Security policy.