Security at GlobalSwap.

Your coins go from your wallet to the partner you choose, and the new coins go from the partner straight to your wallet. GlobalSwap never receives them.

During the swap, your coins are with the partner. A partner can pause a swap for a check under its anti-money-laundering policy; only the partner can release it.

Before a swap is created, we check your address against its network's format and, where the network has one, its checksum. We also apply the partner's own address rules where the partner publishes them.

We warn you when an address looks like one from another network, or when you pasted a known token contract instead of a wallet.

Checks catch many typos and wrong networks, but not all. They can't tell whether an address belongs to you, so always compare it with your wallet.

Each swap gets a random tracking code that only you receive. We keep only a scrambled version of it (a hash), which can't be turned back into the code.

The code is in the part of the link after “#”, which stays out of server logs and links to other sites. Your browser sends it to us only to open your swap.

After you open your swap once, a cookie lets this browser open it again without the code. It works for up to 30 days, and only while we still store the swap.

For each swap, we store the coins, networks and amounts, the rate type and the partner. We also store the status history, the transaction IDs and the addresses and memos you entered.

For each support request: your email address, the topic, the swap ID if you gave it, and the conversation.

• Swaps: deleted 7 days after they end, or after they were created if they are still waiting for coins. Open swaps are deleted after 30 days at the latest. We keep a swap longer only if we need it to meet a legal duty or for a legal claim.
• Support requests: deleted 7 days after they were sent once they are closed, and after 30 days at the latest. We keep a request longer only if we need it to meet a legal duty or for a legal claim.
• Security log, with no wallet addresses, customer email addresses or tracking codes, but a scrambled IP address per swap created: deleted after 90 days.

Our database doesn't store IP addresses in readable form. It keeps a scrambled version (a hash) instead. Counters against abuse keep it for one to two days, and our security log keeps it with each swap you create for 90 days.

QR codes are drawn in your browser, not by an outside service. The pages of your swap load no advertising scripts, and our visitor statistics never count them.

Our team gets short internal notifications about swaps: the swap ID, coins, amounts, partner, the partner's swap ID and status. They never contain tracking codes, email addresses or wallet addresses.

The website is hosted by Vercel, and its server functions run in Frankfurt, Germany. Vercel delivers the pages through its worldwide network.

Swaps and support requests are stored in a Supabase database. Every connection uses HTTPS.

Anyone with your tracking link can see your swap, and the partner keeps its own record of it.

In our admin area, only our team can open swap details. Every login needs a password and a two-factor code, and every change there is logged.

Nobody from GlobalSwap will ask for your seed phrase, private key, passwords, two-factor codes or remote access to your device. Not in the help chat, not in a support request, not by email.

Found a vulnerability on our website? Email support@globalswap.io with the steps to reproduce it. Please don't access other people's data, and give us time to fix the issue before you share it.

Someone is using our name, or a page looks like ours but isn't? Send a support request.