Privacy notice

1. Who is responsible

The Service is a project run by a private individual, not by a company. The controller of the personal data described here is that individual, who can be reached at support@aetheria.trade for any request about your data.

Blockchain addresses and transaction identifiers can relate to an identifiable person, so we treat them as personal data even though they are public.

2. What we process, and why

Comparing routes: the assets, the amount and, when you enter one, the receiving address. Our server forwards them to the protocols that quote, so that they can return a quote and a transaction you can execute. They are not stored.

A swap you start: the addresses, amounts, transaction identifiers and deposit-channel details needed to show its status on the tracking page. They are kept for 30 days and then erased automatically; only the outcome of the swap, without any address or identifier, is kept for aggregate statistics.

Your swaps from any browser: once our tracker has matched a signed EVM transaction to the swap prepared for it, it keeps the address that sent the transaction with that swap and erases it with the other identifiers after 30 days. If you sign a message with that wallet (it authorizes no transaction or token spending), the history page lists the swaps it sent: assets, amounts, status and status page, and nothing about other wallets. The message expires after five minutes and the session after thirty minutes; our server keeps them, with the wallet address, only until then or until you hide the list, and the session stays in browser memory.

Portfolio: the public addresses you paste are forwarded by our server to the balance providers listed below, to read the balances, and are not stored on our side.

Private operational statistics: verified senders of completed EVM swaps are counted as unique trading wallets during the existing 30-day tracking retention. Sender identifiers are erased with the swap identifiers; anonymous fee receipts remain for accounting. Authorized operators may view these aggregate statistics, the referral reward balances of members who have invited others, the list of swaps made through the Service (assets, amount sent, protocol, status and time, never an address) with their status page, which shows the swap’s transactions, while it is kept, and, to look into what went wrong, the transaction identifier of the swaps that failed, were refunded or were never confirmed, while it is kept. Statistics access is controlled by a wallet signature and a revocable access list; only the primary owner can grant access. Authentication challenges expire after five minutes and sessions after thirty minutes; credentials stay in browser memory.

Optional referral membership: when you explicitly join, we store your Ethereum address, invitation code, inviter relationship, accepted notice version, verified qualifying swap records, volume and reward accounting, and withdrawal requests. These programme records are separate from the 30-day swap tracker and are retained for the membership and reconciliation of outstanding rewards. If you accept an invitation, your inviter can see your wallet address and cumulative eligible volume in their authenticated dashboard. Contact us to close your membership or request deletion; outstanding accounting records need to be reconciled before removal.

Referral sign-in: a wallet signature proves ownership without authorizing a transaction. Challenges expire after five minutes. Referral sessions last up to seven days on the same browser unless you sign out. Expired authentication records are removed by the retention job. A necessary first-party Secure, HttpOnly cookie stores the session credential; browser JavaScript cannot read it. Reconnecting the same wallet restores access without another signature while the session is valid. Joining and accepting an invitation require explicit in-app consent, but no additional signature in an authenticated session. Withdrawal requests still require a fresh message signature. An invitation code from a link is remembered in tab-scoped session storage for up to 24 hours and cleared after acceptance; it does not bind a wallet without confirmation. An existing member without an inviter can accept one later. The inviter cannot subsequently change, and earlier swaps are not attributed retroactively.

Optional Aetheria Points: when you explicitly join, we store your wallet address, the date you joined, the version of this notice you accepted and, for each swap counted, its identifier, dollar value and date. When you join, the swaps of that wallet still kept by our tracker (up to 30 days) are counted too. These records are kept while the programme runs and you remain a member, and are deleted when the programme ends; leaving deletes them at once, and if you join again only the swaps still kept by our tracker then are counted. Seeing your Points requires a wallet signature that authorizes no transaction or token spending: the message expires after five minutes and the session after thirty minutes, and our server keeps them, with the wallet address, only until then or until you hide your Points.

Connection data: your IP address is used only in memory and for a few minutes, to limit abuse of the Service (rate limiting). It is not written to our logs and is never associated with a blockchain address. Our hosting provider processes connection data to deliver the site.

Messages: if you write to us, we use your message and contact details to answer you.

3. Legal bases

We process data to provide the Service you request (Article 6(1)(b) GDPR), to protect the Service and its users from abuse, and to screen addresses against sanctions lists (Article 6(1)(f) GDPR, our legitimate interest, and Article 6(1)(c) GDPR where a legal obligation applies). Aetheria Points relies on your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by leaving the programme.

4. What stays in your browser

Your swap history, the consolidation, rebalancing and two-step plans you start, the portfolio addresses you choose to remember, the state of your wallet connection and your display preferences are stored in your own browser storage. They are not sent to us, and you can delete them at any time by clearing the site data in your browser. The CSV file of your swaps is made in your browser from that storage, or from the list your wallet signed in to read: nothing is sent to us or to anyone else to make it.

We do not use cookies for tracking, advertising or analytics, and we do not use third-party analytics, pixels or fingerprinting.

5. Who receives data

Railway (hosting of the site, the server and the database).

Liquify THORNode gateway (THORChain quotes and swap status), Chainflip (quotes, deposit channels and their status) and KyberSwap (same-chain quotes and transactions): they receive the addresses needed for the swap you prepare, sent by our server.

Chainflip Broker as a Service (chainflip-broker.io), the broker through which Chainflip collects our fee: it opens the deposit channels and prepares the Vault transactions of Chainflip swaps that carry that fee, and receives the addresses needed for them, sent by our server.

PublicNode by Allnodes, mempool.space and the Solana Foundation public RPC: they receive the portfolio addresses you look up, sent by our server. PublicNode also receives, when your wallet cannot simulate a same-chain swap or a deposit into Chainflip’s Vault, the simulation request directly from your browser, as the page states.

To follow a swap you signed, our server reads its transaction by its identifier, which leads to your address: from PublicNode for Ethereum, Avalanche and Polygon, and from the public endpoints given in each chain’s official documentation for Arbitrum (arb1.arbitrum.io), Base (mainnet.base.org), BNB Smart Chain (bsc-dataseed.bnbchain.org) and Optimism (mainnet.optimism.io).

Before a Chainflip deposit address is shown, your browser contacts Chainflip directly, on its own, about that channel and for Chainflip’s own quote of the same swap; the page says so next to the check.

For a swap through NEAR Intents: Intents Technology’s 1Click service receives from our server the receiving and refund addresses of the swap you prepare, opens the deposit address and screens the addresses with its own anti-money-laundering providers (Binance AML, AMLBot, PureFi and TRM Labs). Our server then reads the status of that deposit address from 1Click to follow the swap. Before the deposit address is shown, your browser asks 1Click directly about it, because only 1Click can confirm the fee and the deadline, and for 1Click’s own quote of the same swap, asked with placeholder addresses and never yours; 1Click then sees your IP address next to the deposit address, and the page says so next to the check.

For a THORChain swap from Tron, your browser contacts TronGrid, the public node of the Tron network, directly: for the latest block and the network’s fees, which carry nothing of yours, and, with your Tron address, for your account’s TRX and resources and for a trial run of the deposit before you sign, which TronLink cannot run for the page; the page says so next to the check. The transaction you sign then reaches the Tron network through TronGrid, sent by our server.

To check what our server proposes, your browser also reads public data directly: prices, vaults and halts from the Liquify THORNode gateway, the list of open deposit channels from Chainflip’s public RPC and, before you sign or see a deposit address, a second quote of the same swap from the service that executes it: from the Liquify THORNode gateway for a THORChain swap, from Chainflip for a Chainflip swap and from KyberSwap for a same-chain swap. None of these requests contains an address of yours; the quotes contain the assets and the amount of the swap. Like any site your browser contacts, these services see your IP address.

Links to block explorers and protocol pages open third-party sites only if you click them.

We do not sell personal data and do not share it for marketing.

6. Transfers outside the European Economic Area

Some of the providers above may process data outside the European Economic Area, in particular in the United States. Where they do, the transfer relies on the safeguards those providers offer under the GDPR, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

7. Public blockchains

Transactions you make are recorded on public blockchains by their nature. We cannot change or erase data recorded on a blockchain.

8. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to its processing and to data portability, within the limits set by the GDPR. To exercise them, write to us at the address above.

You also have the right to lodge a complaint with a supervisory authority, in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority of the country where you live or work.

9. Security

We limit the data we collect to what the Service needs, keep it for as short a time as possible, and protect it with technical and organisational measures. No system is completely secure; if you find a vulnerability, see the security policy linked from the help page.

10. Changes

We may update this notice. The date of the latest version is shown at the top of this page.