Delete your data
This page explains what data FortiSwap (operated by FortiBlox Labs LLC) can hold about you, and how to delete it. It covers the web app at app.fortiblox.com and the FortiSwap Android app.
Before you delete: export your wallet key
If you signed in with email, a passkey or a social login and use a wallet that Privy created for you (an embedded wallet), deleting your Privy sign-in account permanently deletes that wallet. Any funds in it can no longer be reached unless you exported its private key first.
Export your private key first and store it safely, or move your funds to another wallet you control.
Wallets you created on your device (self-custody wallets) are not affected by deleting server data — see below.
Your wallet keys stay on your device
FortiSwap is self-custody. Wallet keys you create or import are generated and stored on your device and never leave it. We cannot see, access, recover or delete them. Deleting the app or the browser extension, or clearing its data, removes them from that device — make sure you have your recovery phrase or private key backed up first.
What our servers may hold, and how to delete it
- Android install record. When the Android app verifies your device, we store a random install ID, the install's public key, the Google Play Integrity result (device and app verdict tier), the app version, and the country of the request; if you are signed in, the Privy user ID and wallet addresses of that sign-in. We also store your acceptance of the Terms, Privacy Policy and AML Policy (consent records) and, if you turned on notifications, the device's push registration. To delete: in the app, open Settings → Delete my data, or use the form below.
- Privy sign-in account. If you signed in with email, a passkey or a social login, Privy holds that account. To delete: use the in-app option while signed in (it sends the deletion request to our support team, who delete the account in Privy), or request it with the form below. Read the warning above about embedded wallets first.
- Request and rate-limit logs. These are not deleted on request; they expire automatically.
What the in-app deletion removes
The install record (replaced by a deleted-install marker, see below), its sign-in sessions, its consent records and its push registration. The app's session stops working and the install cannot be used again; reinstalling registers a new one.
What is kept, and for how long
| Data | Kept for |
|---|---|
| Request/access logs (request id, route, status, timing, install id of a verified session) | [RETENTION] — host log retention, set by the owner |
| Rate-limit counters (scope, key, timestamp) | 1 day (rate_limit_events TTL) |
| Revoked refresh-token hashes for this install (SHA-256 only) | 30 days after the token's own 7-day expiry (mobile_sessions TTL) |
| Notification delivery ledger for this install | 30 days (push_fcm_events TTL) |
| Swaps/bridges the app asked to be notified about | 7 days (push_tracked TTL) |
| Deleted-install marker: the random install id, the install PUBLIC key and a 'deleted' flag — no device verdict, wallet, Privy id or country | Kept so the install id is never reused and repeat requests are recognised |
Public blockchain data (your transactions and balances) is recorded on public networks, not by us, and cannot be deleted by anyone.
Request deletion
Use this form if you cannot use the in-app option, or to ask for deletion of a Privy sign-in account. We reply to the email you give and may ask you to confirm that the wallet or install is yours before we act. You can also email support@fortiblox.com.
See also the Privacy Policy.