Privacy Policy

Last updated: September 22, 2026

Token Exchange (the “Wallet,” “Service,” “we,” “us”) is operated by Matthew Sanders. This Privacy Policy explains what information the Service collects, why, and how it is handled when you use the Token Exchange website at tokenswaphub.org or the Token Exchange browser extension.

Token Exchange is a self-custody, non-custodial wallet. Your private keys and recovery (seed) phrase are generated and encrypted entirely on your own device. We do not create, see, store, or have any ability to recover your keys, seed phrase, or password. Please read the “Your responsibility for your keys” section of our Terms of Service as well — it matters for how you should think about this policy.

1. Information we do not collect

To use the core wallet — creating a wallet, viewing balances, sending and receiving crypto, and swapping tokens — you do not need to give us your name, email address, phone number, government ID, or any other identifying information. We do not require an account to use the wallet.

2. Information we collect directly

2.1 On-device wallet data

Your private keys, recovery phrase, and transaction history are generated and stored locally, encrypted, on your own device (in your browser's local storage or the extension's local storage). This data is never transmitted to our servers in unencrypted form, and in the normal course of using the wallet it is not transmitted to us at all.

2.2 Optional account (cross-device sync)

Token Exchange lets you optionally create a username and password so you can restore your wallet on another device. This feature is designed so that we never see your password or your unencrypted vault:

Your browser derives a one-way value from your username and password (via PBKDF2-SHA256) and sends only that value to our server — never your actual password.
Our server stores only a further one-way hash (scrypt) of that value, so we cannot reconstruct your password from what we store.
If you choose to back up your wallet for cross-device restore, the encrypted vault we store is ciphertext (AES-256-GCM) produced entirely in your browser under your password. We cannot decrypt it, and we do not have a way to recover it if you forget your password.
We use a session cookie (a random token, marked HttpOnly and SameSite=Strict) solely to keep you signed in. It is not used for advertising or cross-site tracking, and we only store a hash of it, not the token itself.

2.3 Feedback and support

If you submit a feature request or feedback through the app, we receive whatever you choose to type. If you email us directly, we receive your email address and the contents of your message, used only to respond to you.

3. Information processed through third-party services

Certain optional features work by connecting to third-party services. When you use these features, information necessarily passes to those third parties under their own privacy policies — we encourage you to review them. We select providers that do not require us to hold your funds or identity documents ourselves:

Blockchain networks and RPC providers (for example Cloudflare, LlamaRPC, PublicNode, and Ankr's public endpoints): to send a transaction or check a balance, your wallet address and transaction data are sent to a public blockchain node. This is inherent to how any blockchain wallet works, and the resulting transactions are recorded permanently and publicly on the relevant blockchain — not something we control or can erase.
CoinGecko: we query CoinGecko's public, keyless API to show live prices and market data. No personal or wallet information is sent to CoinGecko as part of this.
0x (api.0x.org): when you request a swap quote, your wallet address, the tokens, and the amount you want to swap are relayed (through our server, so our API credentials stay confidential) to 0x's Swap API to generate a quote and the transaction you'll sign.
Coinbase Onramp/Offramp: if you use Coinbase-powered Buy/Sell, Coinbase handles identity verification and payment processing directly and under its own privacy policy. We generate a random reference identifier for your session and pass your wallet address to Coinbase to open it; we do not receive your Coinbase account details.
Onramper: if you use Onramper-powered Buy/Sell, you interact with Onramper's own widget, which routes your request to one of its underlying payment/payout partners. Onramper and its partners independently collect and verify whatever identity and payment information they need to comply with their own regulatory obligations (KYC/AML) — we do not receive, see, or store that information. We only pass Onramper your destination wallet address.
WalletConnect: if you connect Token Exchange to a third-party decentralized app (dapp), WalletConnect relays connection requests and transaction proposals between that dapp and your wallet.

We may receive a referral or affiliate payment from Coinbase or Onramper when you complete a Buy or Sell transaction through their widgets inside our app. This is a commission paid to us by the provider — it does not require any extra information about you beyond what's described above.

4. Server logs

Like most web services, our server infrastructure automatically processes basic technical data (such as IP address, timestamp, and requested path) for the limited purpose of keeping the service running reliably and preventing abuse of endpoints such as our swap-quote proxy and feature-request form (for example, basic per-IP rate limiting). We do not use this data for advertising, profiling, or analytics, and we do not sell it.

5. No advertising or analytics trackers

We do not use Google Analytics, Meta/Facebook Pixel, or other third-party advertising or analytics trackers on the Token Exchange website or extension.

6. How information is shared

We do not sell your information. We share information only: (a) with the third-party services described above, to the extent necessary to provide the features you choose to use; (b) if required by law, regulation, legal process, or governmental request; or (c) to protect the rights, property, or safety of Matthew Sanders, our users, or the public.

7. Data retention and your choices

On-device data (your keys, seed phrase, local transaction history) stays on your device until you clear your browser/extension storage or use the app's own reset/delete-wallet feature. If you created an optional account, you can stop using it at any time; contact us to request deletion of your account record and any stored encrypted vault backup. Because we cannot decrypt your vault, deleting it means any wallet backed up only that way and not saved elsewhere cannot be restored afterward.

8. Children's privacy

Token Exchange is not directed to children, and we do not knowingly collect information from children. Financial services generally require users to meet the minimum age of majority in their jurisdiction.

9. International users

We make Token Exchange available worldwide. If you access it from outside the United States, be aware your information (limited as described above) may be processed in the United States or in the jurisdictions where our third-party service providers operate.

10. Changes to this policy

We may update this Privacy Policy from time to time. We'll update the “Last updated” date above when we do. Continued use of the Service after a change means you accept the updated policy.

11. Contact us

Questions about this Privacy Policy, or requests regarding your information, can be sent to amunra325@gmail.com.