Privacy Policy

1 Overview

SwapWidget ("the App"), operated by Swap Widget LLC, is a decentralized finance (DeFi) trading tool that enables users to monitor cryptocurrency prices, execute token swaps on the Base network, and analyze market data. Your privacy is important to us. This policy explains what data we collect, how we use it, and your rights. It also covers our website, swapwidget.com. If the shorter privacy summary inside the app says something different, this page is the one that applies.

2 Non-Custodial Wallet

SwapWidget is a non-custodial application. Your wallet is an embedded wallet from Privy, created when you sign in, with no seed phrase. Privy manages the wallet and its private key. Our code in the app and our server never see or hold your private key. Our server cannot sign anything from your wallet or send your coins anywhere. Every transaction is signed through Privy at the request of the app on your phone. When a stop or limit order you set fires, our server sends your phone an alert; if your phone is on and signed in, the app can then make the swap without asking you again. If your phone is off, nothing trades.

Google is the only way to sign in, and it goes through Privy, so Privy holds your Google account identity and email address. Our server never receives your email or name. It identifies you by your public wallet address, which the app proves by signing a one-time code with your wallet.

3 Data We Collect

We collect the following data to run the app, count website visits, and answer emails you send us. Our server links app data to your public wallet address, never to your name or email:

• Public Wallet Address: Used to fetch on-chain balances, quote and check your swaps, and identify you to our server. This is public blockchain data. With it we keep your app version, when the app last checked in, and any other wallet you link to your account.
• Orders & Cloud Alerts: Your stop-loss, take-profit, trailing-stop and limit orders and cloud price alerts are stored on our server so it can watch prices around the clock: the token, order type, trigger price, amount, status, and when it fired. Orders waiting to fire stay until they fire or you cancel them. Fired, finished and cancelled orders are deleted about 30 days later (the first time the server restarts after that).
• Settings & Subscription: Your alert and playbook notification settings, Swap Assurance retry settings, when you accepted the in-app disclaimer, any fee waiver or free Pro access we have granted, and your Pro subscription status (active or not, the Pro access it gives, expiry date and the latest billing event, reported to us by RevenueCat).
• Device Push Token: Used to send price alerts, order notifications and, if you turn them on, the paper bot's trade alerts via Firebase Cloud Messaging (FCM). We also log which playbook alerts were sent to you. A token is removed when Firebase reports it no longer works, or when another wallet signs in on the same phone.
• Support Messages: Feedback you send from the app is stored with your wallet address until you ask us to delete it or we remove it. Messages we act on or reply to can become public: the app's support log shows the message to everyone, and our server gives out your full wallet address with it. Please don't put personal details in a support message.
• Token Requests: When you import a token we don't track yet, the app asks our server to start tracking it. We keep the token and your wallet address until we review the request.
• Trade History: Records of your swaps and sends are stored locally on your device. How each swap attempt ended is also sent to our server (see Swap Results).
• Swap Results: Each time the app tries a swap (from the swap screen, a fired order or the widget), it tells our server how it ended: the swap type, the two tokens, a size range, whether it went through, failed, was cancelled or was stopped, the step that failed with a short error message (addresses, links, emails and long numbers removed), retries, slippage, how long it took, the transaction hash if there is one (already public on the blockchain), the app version and when it happened. We store this with your public wallet address only to find and fix failed swaps, and delete it automatically about 90 days after the swap.
• AI Chat (Pro): Your question, the conversation so far, and the wallet balances, recent trades and alerts the app attaches are sent to our server and on to our chat AI provider (Section 6). No private keys or wallet credentials are ever included. Playbooks, chart reads and news summaries are written from market data only and contain nothing about you.
• Chat Records: Chat data is transient: the question and answer are deleted from our server as soon as your phone receives the answer, and any left uncollected are cleared when the server restarts. We keep a usage record per wallet (time, tokens used, and cost) to apply daily limits; records older than 7 days are deleted the next time anyone uses the chat.
• Website Visits: Some swapwidget.com pages (currently the home page and the SwapWidget page) count visits. For each visit our web server records your IP address, the page, the page that linked you there, your browser's user agent (browser and device type), and an approximate country and city looked up from your IP address at ip-api.com. Nothing currently deletes these records or the location lookups automatically: they are kept until you ask us to delete them.
• Emails You Send Us: If you email us (for support, a deletion request or early access), we keep your email address, the name on your email, and your message, including any IP address you give us, in our Gmail inbox, which Google hosts, until you ask us to delete them. For early access, we add the email address you give us to the app's tester list on Google Play.

Apart from server logs (Section 7), server-side data with no period stated above is kept until you ask us to delete it.

4 Data We Do NOT Collect

5 App Permissions

The app lists these Android permissions. Only Notifications and Display over other apps ever ask you:

• Notifications: For price alerts, order notifications, and bot trade alerts. Android 13 and later ask you first.
• Display over other apps: Only for the floating price overlay and floating chat, and only when you switch one on. Android asks you to allow it.
• Foreground service, wake lock, and vibrate: Keep the price service running in the background with a visible notification, let repeating alert sounds finish while the screen is off, handle an incoming alert or fired order while the phone is asleep, and vibrate for alerts.
• Internet and network state: Reach our server and the services in Section 6.
• Google Play billing and push messages: Pro purchases through Google Play, and notifications through Firebase.
• Run at startup: Added by Android's WorkManager library so scheduled background work resumes after your phone restarts.
• Fingerprint / biometric: Added by a library the app includes. Our code never asks for your fingerprint or face.

The app does not ask for your location, contacts, camera, microphone, photos, or files.

6 Third-Party Services

The App and its backend server integrate with the following third-party services to provide functionality. Only data necessary for each service's function is shared:

Wallet & Authentication:

• Privy: Embedded wallet infrastructure and user authentication. Privy creates and manages your wallet and its key, runs the Google sign-in, and signs transactions when the app asks. Privy holds your Google account identity and email address, your Privy user ID, and your wallet address. Privy may collect device identifiers and session data. Privy Privacy Policy
• Google Sign-In: The only sign-in method, through Privy. Google knows that you used your Google account to sign in. Google Privacy Policy

Subscriptions & Funding:

• RevenueCat: Manages Pro subscriptions. The app identifies you to RevenueCat by your public wallet address, along with your Google Play purchase record and basic device information, and RevenueCat tells our server whether your subscription is active. RevenueCat Privacy
• Google Play Billing: Takes payment for Pro. Your payment details stay with Google; we never see them. Google Privacy Policy
• MoonPay: The MoonPay option under Add Funds opens MoonPay's website in your browser with your wallet address filled in. Anything you give MoonPay, such as identity checks or payment details, goes to MoonPay under its own policy; our server receives nothing from it. MoonPay Privacy Policy

Swap Execution & Pricing:

• 0x Protocol: Prices and builds every swap. Our server requests each quote from 0x with your public wallet address as the trader, checks it, and passes it to your phone to sign. 0x Privacy Policy
• Coinbase API: Server-side spot price data for BTC, ETH, and other assets used in price calculations. No personal data is shared.

Blockchain Infrastructure:

• Alchemy RPC: Base network node. The app's balance reads, gas estimates, swap test-runs and transaction-status checks go through our server to Alchemy, so they include your public wallet address and the swap you are about to make. Swaps and sends are submitted through Privy, not through our server. Alchemy Privacy
• Public Base RPC nodes (1rpc.io, mainnet.base.org, PublicNode, dRPC, MeowRPC): Our server's own on-chain price reads. Only public blockchain interactions occur.
• Basescan and the stream shortcut: Links open transactions on Basescan in your browser, and the stream shortcut under Add Funds opens YouTube (or the link you set); nothing is sent to either unless you tap it.
• Base L2 Status Page: Used to check network health and incident status. Your phone reads its public status feed directly, so the status page's host sees your phone's IP address like any website; no account data is sent.

Market Data & Analytics:

• GeckoTerminal API: Token price data, pool information, and market analytics. No personal data is shared.
• DexScreener API: Token metadata, market data, and liquidity information. No personal data is shared.
• Alternative.me: Fear & Greed Index data for market sentiment. No personal data is shared.
• Other public data: Binance price candles, TradingView chart images, and economic calendars (faireconomy.media, the Federal Reserve, BLS, and BEA), all read by our server. No personal data is shared.

AI & Analysis:

• Google Gemini API: Writes chart reads (from chart images), trading playbooks, and news summaries. Only chart images, market data, headlines, and our own prompts are sent, never your chat or wallet data. These requests may run on Google's free tier, where Google may use what we send to improve its products. Gemini API Terms
• OpenRouter: Carries the AI chat (Pro) to the model we choose, currently a DeepSeek model. OpenRouter picks the provider that runs it, which may be DeepSeek itself, in China, and that provider's own terms apply. What chat sends is listed in Section 3. OpenRouter is also the backup for chart reads, playbooks, and news summaries when Google is unavailable. OpenRouter Privacy · DeepSeek Privacy

No wallet credentials, private keys, or seed phrases are ever sent to any AI service. Chart reads, playbooks, and news summaries use market data only; chat also carries your questions and the balances, trades, and alerts the app attaches.

News & Sentiment:

• News RSS feeds: CoinTelegraph, CoinDesk, The Block, Decrypt, CryptoSlate, BeInCrypto, Bitcoin Magazine, and the Federal Reserve's press releases, read by our server. The app loads each story's picture straight from the publisher's site, which sees your phone's IP address like any website, and tapping a story opens it there.

Notifications:

• Firebase Cloud Messaging (FCM): Push notifications for price alerts, order notifications, and bot trade alerts. Your phone registers a push token and a Firebase installation ID with Google, and the token is stored on our server to deliver notifications. Each notification passes through Google's servers with its contents; for orders and alerts that includes which token, the order type, trigger price, amount, current price and your public wallet address. Firebase Privacy

Website & Email:

• ip-api.com: Looks up an approximate country and city from a website visitor's IP address (Section 3). Our web server sends this lookup over plain HTTP, which is not encrypted. ip-api.com Legal
• Google Fonts: swapwidget.com pages load their fonts from Google, so your browser's request, including your IP address, reaches Google. Google Fonts Privacy
• Gmail: Google hosts our email inbox, swapwidget@gmail.com, so emails you send us are stored by Google (Section 3). Google Privacy Policy

7 Data Storage & Security

• On your phone: Your trade history, the addresses you save in Send, and most app settings are stored locally on your device.
• In your Google backup: If Android backup is on, Android may copy the app's data to your own Google backup. The app leaves out its sign-in token for our server.
• On our server: The app data in Section 3 is stored under your public wallet address; website visit records are stored by IP address. Chat data stays transient as described in Section 3. Our server and website are hosted by DigitalOcean.
• Server logs: Like most web servers, ours keep standard request logs for the app and the website: your IP address, the time, the address requested (which can include your wallet address and swap details) and your app or browser type. Our server's activity logs also hold wallet addresses, order details, transaction hashes, short notes on failed swaps and the text of support messages. Request logs are deleted after 14 days; activity logs are trimmed automatically as they fill (currently after about five weeks).
• Encryption: Everything the app sends is encrypted via HTTPS/TLS; the app refuses unencrypted connections. The one unencrypted transfer is the website's location lookup at ip-api.com (Section 6).

8 Data Retention

• On your phone: Kept until you uninstall the app or clear its data (and in your Android backup, if you use one).
• On our server: Kept for the periods in Section 3; anything with no period stated is kept until you ask us to delete it. Market price data is kept to run the service.
• Server logs: Kept until they are deleted automatically (Section 7). We don't remove copies from server logs one by one; they go when the logs are deleted.
• Swap results: Deleted automatically about 90 days after the swap.
• Asking for deletion: Email us (Section 13) to delete any server-side data linked to your wallet address, your website visit records (tell us your IP address and roughly when you visited), or emails you sent us.

9 Your Rights

You have the right to:

• Access and export your trade history at any time from within the app
• Delete all local data by clearing app storage or uninstalling
• Request deletion of server-side data by contacting us
• Opt out of push notifications via device settings

10 Children's Privacy

SwapWidget is not intended for use by individuals under the age of 18. We do not knowingly collect data from minors.

11 Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date at the top of this page. Continued use of the App after changes constitutes acceptance of the updated policy.

12 Financial Risk Disclaimer

SwapWidget facilitates decentralized token swaps and provides market analysis tools. This is not financial advice. Cryptocurrency trading involves significant risk, including the potential loss of your entire investment. By using the App, you acknowledge that:

• You are solely responsible for your own trading decisions
• Token swaps are executed on decentralized protocols and are irreversible once confirmed on-chain
• AI-generated analysis and playbooks are for informational purposes only and should not be relied upon as financial advice
• Past performance does not guarantee future results
• Smart contract interactions carry inherent risks including but not limited to bugs, exploits, and liquidity issues
• The App relies on third-party APIs and public data feeds for real-time pricing, news, and sentiment metrics. We do not guarantee the accuracy, completeness, or uptime of third-party data feeds

13 Contact

If you have questions about this Privacy Policy, please contact us at:

Email: swapwidget@gmail.com