Privacy Policy
Shieldz Swap (swap.shieldz.cash and api.shieldz.cash) is non-custodial and has no accounts. We collect as little as we can to route swaps and keep the Service running. We do not sell data, do not build advertising profiles, and do not use advertising or tracking networks.
What we don't collect
No names, emails, phone numbers, passwords or identity documents. No KYC. We never see your private keys or seed phrase. The app sets no cookies.
What our servers process
| What | Why | Kept |
|---|---|---|
| Quote requests: the assets, the amount, and any addresses you entered | To ask the protocols for prices | Not stored |
| Swaps you start: the protocol, the assets and amounts, the address you pay from (used for refunds), the address you receive at, and the deposit address | To track the swap's status and show it in your Activity | 90 days |
| Request links: the asset, amount and receiving address you set, and what was paid to the link | To show the link and its payments | 180 days |
| Wallet balances: the address the app reads balances for | To show what your connected wallet holds | 10 seconds, in memory |
| Usage counts: anonymous funnel steps (for example "quote shown", "swap confirmed") with coarse details such as the chains, the protocol and a USD range, tied to a random id that lasts for one browser tab. Never an address, an exact amount or a transaction hash. Turned off if your browser sends Do Not Track. | To see where swaps fail or people drop off | 90 days |
| Error reports: the error message and code location, the page path, the app version and your browser's user agent. Anything shaped like an address or a transaction hash is removed in your browser and again on our server. | To find and fix broken flows | 30 days |
| IP address | Rate limiting and abuse prevention; our web server's access logs | In memory for rate limiting; access logs up to 14 days |
Swaps and request links are public in effect anyway: the addresses and amounts are on public blockchains, and anyone with a swap or link id can look it up.
Who else sees what
- Swap protocols: NEAR Intents (1Click), Chainflip, Relay and THORChain receive the details of the quotes and swaps they are asked about, including addresses. Jupiter receives the details of Solana memecoin swaps.
- Blockchain node providers: to read balances and fees we, and your browser, send your address to public RPC endpoints and node providers for the chain in question (for example Relay's RPCs, PublicNode, dRPC, NOWNodes for Zcash, and block explorers' APIs for Bitcoin-family coins).
- Cloudflare serves the site and protects it from attacks, so it sees your IP address and requests. Cloudflare Web Analytics, which is cookieless, may count page views.
- Image hosts: some token logos load from Trust Wallet's public GitHub repository and CoinGecko, which see your IP address when your browser fetches them.
- Your wallet and, if you use one, its vendor's software (for example Trezor Connect for Trezor devices) see what you ask them to sign.
- Block explorers see your visit when you open a transaction link.
No one else. We may disclose information if the law requires it.
What stays in your browser
The app keeps some things in your browser's local storage so they survive a reload. They never leave your device unless the feature needs them (for example, checking a swap's status): your swap history, addresses you have hidden, your theme and slippage settings, the last wallet you used, the addresses of hardware wallets you connected, and a copy of the asset list. Clearing your browser's site data for swap.shieldz.cash removes all of it.
Your choices
- Use the Service without connecting a wallet: quotes do not need one.
- Send Do Not Track to turn off usage counts.
- Ask us to delete the swap or request-link records for an address you control: email [email protected]. We cannot delete anything from a blockchain or from a protocol's own systems.
Security
Records are stored on our own server and served over HTTPS. Backups are kept on that server, with an encrypted copy off-site. No system is perfectly secure; please report anything you find to [email protected].
Children
The Service is not for anyone under 18.
Changes
We will update this page if what we collect or why changes, and revise the date above.