Privacy Policy

1. Data minimization philosophy

We limit collection to information used for account access, exchange accounting, wallet settlement, security, support, and reliable operation. We do not build advertising profiles or add third-party tracking tools to the interface.

2. What we do not request

• Government identity documents, photographs, or document scans
• KYC profiles or third-party background checks
• Phone numbers or SMS verification
• Residential addresses, legal names, or dates of birth
• GPS coordinates or device location permission
• Advertising or cross-site analytics profiles

3. Data we use

• Account: username, email address, and a one-way password hash
• Trading: orders, executions, balances, fees, and market activity
• Wallet: deposit and withdrawal addresses, amounts, statuses, and transaction references
• Security and operations: rate-limit state, security events, application errors, and infrastructure request metadata
• Site statistics: page categories, visit times, referring domains, and broad browser/device categories. A server-keyed hash of the connection address and browser information estimates distinct visitors; traffic reports do not store raw IP addresses, full browser strings, URL queries, or private page identifiers. Recent authenticated activity is used to count accounts active in the last 30 minutes.
• Communications: support tickets, public trollbox messages, and email delivery records
• Referrals: referral codes, account attribution, eligible fees, and commission credits. Affiliates see counts and fee earnings, not referred usernames, email addresses, guest swap identifiers, or wallet addresses. Authorized administrators can reconcile the underlying accounting references.

4. Cookies and tracking

The site uses essential session and security cookies for authentication, CSRF protection, and abuse prevention. When you visit a valid referral link, a first-party referral cookie remembers the last valid referrer for up to 30 days. It attributes a new signup or guest swap; signup attribution remains linked to the account after the cookie expires. A guest swap's attribution is fixed at session creation and retained for payments into that session, even after the cookie expires. Ordinary visits do not renew the cookie's 30-day expiry. It does not include advertising pixels, cross-site trackers, or third-party analytics. Infrastructure access logs may contain a network address and request metadata. First-party site statistics use no additional tracking cookies and stay on our server. Traffic records are retained for up to 400 days; the recent-account presence list is cleared after one day of inactivity. Visitor estimates cannot reliably distinguish people sharing connections or recognize someone whose connection or browser changes.

5. Data security

Passwords are stored as one-way hashes. Administrative, wallet, and operational access is restricted by role and service boundaries. No internet-connected service can guarantee absolute security, so records are limited to what the platform needs to operate and protect accounts.

6. Service providers and public networks

We do not sell account data or share it for advertising. Limited data may be processed by infrastructure, email, and blockchain RPC providers when needed to deliver the service. Cryptocurrency addresses and transactions may also be permanently visible on public blockchains.