FortiSwap — Privacy Policy

Effective date: 2026-08-22 Version: 4.1 Operator: FortiBlox Labs LLC Contact: [email protected] Canonical URL: https://app.fortiblox.com/privacy

1. Summary

FortiBlox Labs LLC ("we", "us", or "our") operates FortiSwap, a non-custodial decentralised-exchange aggregator at app.fortiblox.com (the "Interface"). This Privacy Policy describes the limited data associated with your use of it.

The short version: the Interface does not require an account, collects no name, email, password, or government identification, and takes no custody of your funds. To use the Interface you connect a self-custodial wallet you already control and sign your own on-chain transactions; swaps and the cross-chain bridge need nothing more, while the fiat on-ramp and off-ramp additionally require you to sign in through Privy first (Section 5). We do not run a KYC programme and we do not hold or transmit fiat for your swaps. FortiSwap also surfaces an optional fiat on-ramp and off-ramp operated by independent Fiat Providers — Stripe, Coinbase, Transak, and MoonPay — that let you buy USDC with a card or bank payment, or sell USDC for fiat paid to your own account; in those flows the Fiat Provider collects and processes your payment, payout, and identity data directly, under its own privacy policy, and we do not receive it (see Section 4). An optional cross-chain bridge quotes routes from Rango and MoonPay Trade (Swaps XYZ Ltd, a MoonPay company), which receive only your wallet addresses and the route parameters (see Section 4). Separately, a sign-in powered by Privy — optional for swaps and the bridge, required for the on-ramp and off-ramp — lets you connect by email one-time passcode, a passkey, or a social login (Google, X, Discord, GitHub, or Telegram) and, if you have no wallet, receive a user-owned, non-custodial embedded wallet; that sign-in data is processed by Privy directly under Privy's own privacy policy, and connecting an external wallet yourself does not involve it (see Section 5). The data footprint is deliberately minimal, and most of what makes a Swap work is public blockchain data that exists independently of us.

This Policy is incorporated by reference into our Terms of Service and should be read together with our AML & Sanctions Statement.

2. What we do not collect

The Interface does not collect, and we do not ask you for, any of the following:

• Name, date of birth, or any government-issued identification.
• Email address, phone number, postal address, or password. Where you choose to sign in through the Privy-powered email, passkey, or social sign-in (Google, X, Discord, GitHub, or Telegram), your email address or the basic profile data your chosen provider returns is collected by Privy directly, under Privy's own privacy policy, and used to authenticate you — it does not create an account with us, and we do not store a password for you (the sign-in is passwordless). See Section 5.
• Card numbers or any payment-card data. There is no fiat payment path inside FortiSwap itself; where you buy or sell USDC through a Fiat Provider (Stripe, Coinbase, Transak, or MoonPay), your card, bank, or payout details go directly to that provider and never reach us (Section 4).
• Biometric identifiers, proof of address, source-of-funds evidence, or politically-exposed-person data.
• Your wallet's private keys or seed phrase — these never leave your wallet and we have no ability to see or recover them.

Because the Interface has no accounts of its own, there is no user profile in our systems; the only per-user record we keep is the pseudonymous transaction-status record described in Section 4.

3. What is inherently public (and not ours to control)

Using any blockchain interface involves public data:

• Your wallet address and on-chain activity are public. When you connect a wallet and broadcast a Swap, your wallet address, the tokens and amounts involved, and the resulting transaction are recorded on the X1 public blockchain. This information is public by the nature of a permissionless blockchain, is visible to anyone, and is not created, owned, or controllable by us. Anyone can inspect it using a block explorer, independently of the Interface.
• Transactions are irreversible and permanent on-chain. We cannot delete, alter, or reverse anything recorded on X1.

We may read this public on-chain data to compute quotes, routes, and balances, but we do not need — and do not ask for — any personal identifier to do so.

4. Fiat on-ramp and off-ramp (Fiat Providers) and cross-chain bridge — data flow

FortiSwap offers an optional way to buy USDC with a card or bank payment and to sell USDC for fiat paid to your own account, operated by independent Fiat Providers — currently Stripe (Crypto Onramp), Coinbase, Transak, and MoonPay. FortiSwap surfaces each provider's hosted widget or checkout; the Fiat Provider (or its regulated partner), not FortiSwap, is the party that sells or buys the crypto and processes the purchase or payout. MoonPay is the merchant of record for transactions made through its widget. The privacy consequences are:

• The Fiat Provider collects your payment, payout, and identity data directly. Any information required to buy or sell USDC — including your name, contact details, government-issued identification, payment-card, bank, or payout-account details, and any other data needed for identity verification (KYC), anti-money-laundering, payment processing, and fraud and sanctions screening — is collected and processed by the Fiat Provider directly, under its own privacy policy and terms. Your data relationship for a purchase or cash-out is with that provider, not with us.
• We do not receive your payment or identity data. FortiSwap does not receive, store, or process your card number, bank or payout details, or the personal identity information you provide to a Fiat Provider. We do not perform KYC, and we do not store the outcome of a provider's identity verification (where a provider notifies us that an identity check changed, we do not keep that event). What we do receive — from the provider, by webhook or API — is limited to the transaction's identifier, status, amounts, settlement network and asset, the destination or deposit wallet address, the on-chain settlement hash, and a bounded failure code. We keep that record against a pseudonymous reference derived from your sign-in (a keyed hash — not your email address or identity) so that the Interface can show you the status of your purchase or cash-out and, for a cash-out, build the deposit transfer to the address the provider issued. Never your payment credentials or verification documents.
• MoonPay and your IP address. To open MoonPay's widget, the Interface includes in the signed widget link a keyed hash of the public IP address from which you made the request — a MoonPay requirement so that MoonPay can confirm the widget was opened from the same connection. MoonPay compares the hash against the connection it observes; we do not send MoonPay your IP address in clear. MoonPay observes your IP address directly when you use its widget, as any website does, under MoonPay's privacy policy.
• Settlement is on Solana; the X1 step is yours. Each Fiat Provider delivers the USDC you buy to — and receives the USDC you sell from — a Solana wallet address you control. Moving that USDC to or from X1 is a separate transaction that you sign through the X1 Warp bridge. Those Solana and X1 wallet addresses and transactions are public blockchain data in the sense of Section 3.
• Cross-chain bridge routes (Rango and MoonPay Trade). Where you use the optional cross-chain bridge, our server sends the Bridge Route Provider — Rango or MoonPay Trade (operated by Swaps XYZ Ltd, a MoonPay company) — your source and destination wallet addresses, the tokens, the amounts, and your slippage setting, and receives back quotes and an unsigned transaction. After you sign, the provider and the bridges and relayers it selects observe the on-chain transaction, and we may register your transaction hash with the provider to track delivery. A provider may screen wallet addresses and decline to quote. No identity data is involved; the provider's own privacy policy (for MoonPay Trade, MoonPay's) governs what it collects. The Interface keeps a record of an in-flight bridge transfer in your browser's local storage so that you can resume tracking it.
• Review each provider's privacy policy. Because your purchase, cash-out, or bridge data is handled by the provider, that provider's privacy policy governs how it is collected, used, retained, and shared. You should review it before using the feature. We are not responsible for any provider's privacy practices.

5. Sign-in and embedded wallets (Privy)

To let you connect and sign, FortiSwap uses wallet and authentication infrastructure provided by Privy (privy.io), operated by Privy. Privy powers a sign-in — by email one-time passcode, passkey, or a social provider (Google, X, Discord, GitHub, or Telegram) — and, for users who sign in that way without already having a wallet, the provisioning of a user-owned, non-custodial embedded wallet. You may instead connect an external browser-extension wallet directly, in which case the Privy sign-in is not used and no Privy sign-in data flow occurs. Signing in is optional for swaps and the cross-chain bridge, which work with a connected wallet alone, and required for the fiat on-ramp and off-ramp: every purchase or cash-out session (and the provider quotes shown for it) is minted only for a signed-in user and is keyed to the pseudonymous reference described in Section 4. Signing in does not create an account with us. The data consequences are:

• What Privy processes. If you sign in with email, Privy processes your email address to send and verify a one-time passcode. If you sign in with a social provider (Google, X, Discord, GitHub, or Telegram), Privy receives the basic profile information that provider returns for sign-in (such as an email address, username, or account identifier). If you sign in with a passkey, authentication is performed by your device's authenticator and no social-profile data is shared. This authentication data is collected and processed by Privy directly, under Privy's own privacy policy and terms. You should review Privy's privacy policy at privy.io/privacy-policy before signing in. We are not responsible for Privy's privacy practices.
• Embedded wallets are user-owned and non-custodial. Where Privy provisions an embedded wallet for you, that wallet is yours. Its private key is generated and held within Privy's secure key-management infrastructure (a trusted execution environment) under your control; FortiSwap never receives, holds, backs up, or has the technical ability to recover it. We do not configure session signers, delegated actions, or any app-controlled or custodial mode — the wallet signs only at your direction. Every transaction is constructed by FortiSwap as an unsigned transaction, signed by you (or by your embedded wallet at your instruction), and broadcast; FortiSwap remains a non-custodial interface and never takes custody of your keys or funds.
• What we receive. After you connect, FortiSwap sees only your public wallet address and the transactions you authorise — the same minimal footprint as any wallet connection (Section 3). We are not sent your Privy login credentials and we do not build a profile from your sign-in. For the on-ramp and off-ramp we derive a keyed-hash reference from your Privy user identifier (Section 4) and keep only that reference — not the identifier itself and not your email address.

6. What we (and our edge provider) do process

To serve the Interface and keep it available and secure, a limited amount of technical data is processed:

• Edge and server logs. The Interface is served behind Cloudflare, which terminates TLS and may process standard request metadata — including your IP address, an approximate country derived from it (the Cloudflare cf-ipcountry signal), user-agent, and timestamps — for content delivery, security, abuse mitigation, and to enforce the geographic restrictions described in our Terms of Service (Section 5). This processing is Cloudflare's as our infrastructure provider and is governed additionally by Cloudflare's own privacy terms. We use the country signal only to determine whether the Interface may be shown in your region; we do not use it to build a profile of you.
• Application request data. Our quoting, routing, and transaction-construction API routes receive the parameters needed to compute a Quote or assemble an unsigned transaction — for example, the token pair, the amount, and a wallet address for balance/route computation; for the cross-chain bridge, the source and destination wallet addresses and route parameters, which we forward to the Bridge Route Provider as described in Section 4. This data is used to fulfil the request. We minimise retention and do not use it to identify you as a natural person.
• Aggregate, non-identifying diagnostics. We may process aggregate technical metrics (for example, error rates or latency) to operate and improve the Interface. These are not used to identify individual users.

We do not sell your data, do not run third-party advertising trackers on the Interface, and do not monetise your activity.

7. Cookies and local storage

The Interface uses only the storage necessary for it to function — for example, remembering your connected-wallet preference or interface settings in your browser's local storage. We do not use advertising or cross-site tracking cookies. Cloudflare may set cookies strictly necessary for security and delivery. A Fiat Provider's widget or checkout (Stripe, Coinbase, Transak, or MoonPay) may set its own storage and cookies under that provider's control when you use it. The Interface also keeps a record of a pending purchase, cash-out, or bridge transfer in your browser's local storage so that you can return to it. Where you use the Privy sign-in, Privy may set storage and cookies under Privy's control to establish and maintain your authenticated session.

8. Third parties

The Interface relies on independent third parties that operate under their own terms and privacy practices, which we do not control:

• Cloudflare — edge delivery, TLS, security, and the geographic signal described in Section 6.
• Privy — where you sign in (optional for swaps and the bridge; required for the on-ramp and off-ramp), Privy processes your email, passkey, or basic social-profile data (from Google, X, Discord, GitHub, or Telegram) to authenticate you and, where applicable, provisions a user-owned, non-custodial embedded wallet, under Privy's own privacy policy, as described in Section 5.
• X1 RPC providers — read on-chain state and broadcast the transactions you sign.
• Third-party liquidity protocols (including XDEX and Degen) and the FortiBlox Guard program — your Swap executes on-chain against these protocols; your interaction with them is public and direct.
• Fiat Providers — Stripe (Crypto Onramp), Coinbase, Transak, and MoonPay — where you buy or sell USDC through the on-ramp or off-ramp, the Fiat Provider (or its regulated partner) collects and processes your payment, payout, and identity data directly, under its own privacy policy, as described in Section 4. MoonPay additionally receives a keyed hash of your IP address when its widget is opened (Section 4).
• Bridge Route Providers — Rango and MoonPay Trade (Swaps XYZ Ltd, a MoonPay company) — where you use the cross-chain bridge, the provider receives your wallet addresses and route parameters and returns quotes and transactions, as described in Section 4. The Solana ↔ X1 leg settles through the X1 Warp bridge, an on-chain program.
• Your wallet provider / browser-extension wallet — holds your keys and signs your transactions.

We are not responsible for the privacy practices of these third parties. Your on-chain interactions with them are public blockchain events outside our control, and your data relationship with a Fiat Provider for the on-ramp or off-ramp, with a Bridge Route Provider for the cross-chain bridge, and with Privy for the sign-in, is directly with each of them.

9. Retention

Because we do not maintain accounts or collect personal identifiers, there is very little to retain. Edge/security logs are retained only for as long as needed for delivery, security, and abuse mitigation, and then age out under our infrastructure provider's standard practices. Public on-chain data persists on X1 permanently and is outside our control. Data you provide to a Fiat Provider is retained by that provider under its own retention schedule, not ours; the pseudonymous transaction-status records described in Section 4 are retained only as long as needed to show you the status of a purchase, cash-out, or bridge transfer and to reconcile it with the provider; likewise, the sign-in data you provide to Privy is retained by Privy under Privy's own retention schedule, not ours.

10. Your choices and rights

You are always in control of the two things that matter most: your keys (which never leave your wallet) and whether you transact (nothing happens until you sign). You may stop using the Interface at any time; there is no account to close.

Depending on your jurisdiction, you may have rights to access, correct, or erase personal data an organisation holds about you. Because we hold no account, no contact details, and no identity data tied to you — the transaction-status reference described in Section 4 is a keyed hash we cannot reverse to your identity — in most cases there is no personal record for us to produce or erase. Edge/security logs handled by our infrastructure provider are transient and not indexed to your identity. If you believe we hold personal data about you and wish to exercise a right, contact [email protected] and we will respond as required by applicable law. To exercise rights over the data a Fiat Provider collected for a purchase or cash-out, contact that provider (Stripe, Coinbase, Transak, or MoonPay), which is the controller of that data; to exercise rights over the data a Bridge Route Provider holds, contact Rango or MoonPay (for MoonPay Trade) respectively; to exercise rights over the sign-in data Privy holds, contact Privy, which is the controller of that data. We cannot alter or erase anything recorded on the public X1 blockchain, which is not within our control.

11. Children

The Interface is not directed at, and must not be used by, persons under eighteen (18) years of age. We do not knowingly collect data from children.

12. Changes to this Policy

We may update this Policy to reflect changes in the Interface or in applicable law. Material changes will be posted at app.fortiblox.com/privacy with a revised effective date and a change-log entry. Your continued use of the Interface after the effective date constitutes acceptance of the updated Policy.

13. Contact

Questions about this Policy may be sent to [email protected]. For security-vulnerability disclosures, please use [email protected].

Change log

Last updated: 2026-08-22 </content>