Privacy Policy
Last updated: 2026-09-16
1. What we don't collect
The Service is designed to collect as little as possible. We do not collect, store, or transmit:
- Your mnemonic phrases or seed words
- Your private keys
- Your wallet addresses (except as described in §3 below)
- Your email address (unless you voluntarily contact us)
- Your name, physical address, or phone number
- Your government ID or any KYC information
- Your transaction history
- Your browsing history on other sites
All wallet processing — derivation, signing, broadcasting — happens entirely in your browser. Your keys never leave your device.
2. What we do collect
2.1 Server logs
When you load our website, our hosting provider (Cloudflare Workers, or similar) records standard HTTP logs: IP address, timestamp, requested URL, HTTP method, user agent, referer. These are used for security, abuse prevention, and troubleshooting. Retention: up to 30 days.
2.2 RPC proxy logs (if you use our proxy)
If you use our RPC proxy (as opposed to running your own RPC), the proxy records: IP address, timestamp, which chain was queried, HTTP status. We do not log:
- The request body (JSON-RPC method and parameters)
- Wallet addresses being queried
- Transaction hashes
- Response bodies
Retention: up to 7 days.
2.3 Sweep receipts
When you complete a live sweep, our payment worker records a receipt for accounting purposes. A receipt includes:
- Your pseudonymous client ID (a random 48-character hex string stored in your browser's localStorage — it is not linked to any identity)
- The source wallet addresses involved in the sweep
- The destination address you chose
- The amount swept and the service fee taken
- On-chain transaction hashes for the swap transactions
We do not record your mnemonic, private keys, or any data that could be used to derive them. The receipt exists so we can audit service fee collection and reconcile with on-chain activity. Retention: up to 1 year.
2.4 Analytics
We may use privacy-respecting analytics that do not use cookies, do not fingerprint users, and do not collect personal data. We only see aggregate page views and referrers. Analytics are currently disabled.
3. What third parties see
When you use the Service, your browser makes requests directly to:
| Party | What they see | Why |
|---|---|---|
| Blockchain RPC providers (Alchemy, Helius, or public RPCs) | Your IP, the wallet address you're querying, the transactions you broadcast | Necessary to read balances and broadcast transactions |
| 0x (EVM swap routing) | Your IP, the swap quote you request, the wallet address executing the swap | To compute swap routes and execute swaps on EVM chains |
| deBridge (Solana → Ethereum routing) | Your IP, the Solana wallet address, the destination EVM address, the order amount | To bridge Solana assets to Ethereum USDC |
| THORChain (Bitcoin → Ethereum routing) | Your IP, the Bitcoin address, the destination EVM address, the swap amount | To bridge Bitcoin to Ethereum USDC |
| mempool.space (Bitcoin) | Your IP, the address you're querying | To read UTXOs and broadcast Bitcoin transactions |
| Cloudflare (hosting) | Your IP, the URL you requested | Serving the site, DDoS protection |
| Square (credit purchases, if used) | Whatever you provide during checkout | Processing credit card payments (optional; crypto payments do not use Square) |
We cannot control what these third parties do with the data they see. Their privacy policies apply. If you require maximum privacy, run your own RPC endpoints and use the Service from a VPN or Tor.
4. Cookies and local storage
The Service does not set any cookies. It uses
localStorage to persist:
- A pseudonymous client ID (a random hex string used to track credit balance)
- Your credit balance cache
It does not persist your mnemonic, private keys, destination address, or sweep history. When you click "Clear" or close the tab, everything except the client ID is discarded. You can clear the client ID at any time through your browser's developer tools or settings.
5. Data retention
Server logs are retained as described in §2.1. RPC proxy logs are retained as described in §2.2. Sweep receipts are retained as described in §2.3. Everything else is not collected in the first place, so there is nothing to retain.
6. Children
The Service is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has used the Service, contact us and we will take appropriate action.
7. Your rights
Depending on your jurisdiction, you may have rights under GDPR, CCPA, or similar laws, including rights to access, correct, or delete personal data. Because we don't collect personal data, most of these rights are moot — but if you have a question or want us to delete a sweep receipt associated with your client ID, contact us at privacy@sweeper.cloud.
8. Security
We use industry-standard practices to protect the limited data we do collect. See our security model for details on how keys are handled and what you can verify yourself.
9. Changes
We may update this Privacy Policy from time to time. Material changes will be posted on this page with a new "Last updated" date.
10. Contact
Questions about privacy? Contact us at privacy@sweeper.cloud.