SWAP.SAMSAM
samsam.lol
← back to swap

what this desk does with data

Privacy

What swap.samsam.lol sends, to whom, how long it keeps it, and what stays on your device.

§ 1 — scope

This page covers swap.samsam.lol — the swap desk, its FAQ, terms, legal notice and this page. The biosite at samsam.lol is a separate thing with separate data flows and its own privacy policy. Nothing here describes that site, and nothing there describes this one.

This desk sets no cookies of its own and runs no analytics. Nothing about you stays on a server here for longer than an hour, with one exception: if you ask for order updates by email, the address you type in is kept for 30 days, and clicking "never email me again" leaves a hash of it behind for a year. § 6 is entirely about that exception. What the desk sends is otherwise what a swap physically requires — the pair, the amount, and, once you commit to an order, your receiving address. The sections below say where each of those goes.

§ 2 — controller

The controller under Article 4(7) GDPR is the operator of samsam.lol, a private individual in Germany. Contact: sam@samsam.lol. Full details are in the legal notice. There is no data protection officer; Article 37 GDPR requires one for large-scale systematic monitoring, and this is one person running a comparison page.

§ 3 — hosting

The site is served by Cloudflare Pages and its backend runs as Cloudflare Pages Functions. Requesting any page means Cloudflare processes your IP address, the time, the URL, your user agent, the headers your browser sends, and security signals used to tell you apart from a botnet. Every website does this; one that did less would not load. Legal basis: Article 6(1)(f) GDPR, legitimate interest in running a site that works and isn't trivially abused. Cloudflare's infrastructure logs are governed by Cloudflare's own terms and retention. The operator neither receives nor keeps them.

Cloudflare's security layer may set a strictly necessary cookie of its own while it is actively challenging a suspicious request. That is Cloudflare's, not this site's, it carries no tracking, and § 25(2) TDDDG exempts it from consent.

§ 4 — quotes

When you ask for offers, your browser POSTs to /api/swap/estimate: the coin you are sending, the coin you want, both networks, and the amount. That goes on to the quote aggregator CypherGoat, which is where this desk's offers come from, because a rate cannot be computed out of nothing. No address is involved at this stage, because you have not chosen an offer yet. Legal basis: Article 6(1)(b) GDPR, steps taken at your request before a contract.

§ 5 — orders and tracking

Creating an order sends more, and this is the one flow on this desk where your IP address is genuinely part of a payload rather than just a header. /api/swap/create forwards to the aggregator and, through it, to the provider you picked:

  • the route — both coins, both networks, the amount;
  • the provider you selected;
  • your receiving wallet address, which is the whole point of the order;
  • your IP address, your user agent (truncated to 300 characters) and your Accept-Language header (truncated to 120), which the provider requires for its own sanctions, fraud and compliance checks before it will accept a swap.

Tracking sends the order ID and nothing else. The optional email field sitting in the same dialog is no part of this — it is a separate request to a separate endpoint, it reaches neither the aggregator nor the provider, and § 6 explains it. Legal bases for the order itself: Article 6(1)(b) GDPR for performing the service you asked for, and Article 6(1)(f) for the provider's abuse and compliance controls. Once your order reaches the provider, the provider is its own controller and its privacy terms apply — worth reading if the amount is large enough that you'd read anything.

§ 6 — status updates by email

Two places on this desk ask for an email address, both optional and both doing the same thing: a field in the order dialog, and a field on the tracking card once you are watching an order. Leave them empty and none of this section happens to you. Type an address in and your browser POSTs it, with the order ID, to /api/swap/subscribe. That endpoint is the only thing on this desk that stores an email address anywhere.

What gets stored is one record in Cloudflare KV, per address, per order. The key isswap:sub:<order id>:<hash>, where the hash is the first 24 hex characters of the SHA-256 of your address in lowercase. The record itself holds the address in plain text next to that order ID, because mail cannot be delivered to a hash. It expires 30 days after it is written, on its own, whether the order finished or not. Legal basis: Article 6(1)(b) GDPR — this is the service you asked for by typing the address in.

There is no confirmation mail. Updates start with the next status poll, which also means an address typed here begins receiving mail whether or not it belongs to the person typing it. What balances that is the last line of every message: a"never email me again" link. It is signed, and the address sits inside the signature rather than only in the URL, so a doctored link cannot unsubscribe somebody else or get them blocklisted. Each link works for 30 days from the mail that carried it.

One click does two things. It deletes this order's subscription, and it writesswap:block:<hash> — the same 24 characters of SHA-256, a timestamp for a value, and the address itself nowhere in it. That entry lives one year and is read twice: before any mail goes out, and before any new subscription is stored. So if a later order types the same address in, the endpoint answers as though all is well and quietly keeps nothing. Legal basis: Article 6(1)(f) GDPR. A stop that is written down nowhere is not a stop, and the only way to recognise the address next time is to keep something derived from it. This is deliberately not called Article 6(1)(c): none of these mails are marketing, so no statutory suppression duty is being discharged. The list exists to keep a promise, and the interest in keeping it is at least as much yours as the operator's.

Mail goes out only when the order's status group changes — waiting, running, done, problem, refunded. The group last mailed about is kept as a single word underswap:notified:<order id> for 30 days, so an order polled two hundred times while nothing moves produces no mail at all. Each message carries the amounts, the coins, the provider, the order ID and a link to the provider's own order page — the same things already on your screen. While an order is still waiting to be funded the message also carries the deposit address, the memo where the chain needs one, and a scan code of that address. That address is the exchange’s, not yours — your own receiving address is never in a mail. There is no tracking pixel. There is one image, the scan code, and it loads from this site when the message is opened, so a request carrying your IP reaches Cloudflare at that moment: an ordinary web request whose URL names the order and nothing about you. Most mail clients now fetch images through their own proxy and do it on your behalf instead. An order that needs a tag as well as an address gets no code at all, because a code carrying half of what you must send is worse than none.

Delivery runs through Resend (resend.com), which is a processor and therefore receives the recipient address and the contents of the message. It gets nothing else about your order. It is listed with the other recipients in § 11, and where it sits geographically is in § 12. The whole feature is switched off unless both the Resend key and the sender address are configured on the server; while they are not, the field still takes your address and the endpoint still answers with a success, but nothing is stored and nothing is sent.

The address is not written to your device, it is not part of the order list described in § 7, and it never reaches the aggregator or the swap provider, who have no use for it. To drop a subscription without waiting for a mail to click the link in, write to sam@samsam.lol with the order ID; § 14 covers the rest of what you can ask for.

There is one more way a subscription ends early. "Forget this order" on the tracking card posts the order ID on its own to /api/swap/forget, which deletes every swap:sub: record filed under that order. No address is sent, nothing is read back, and the answer is the same whether anything was there or not, so the endpoint cannot be used to ask whether some address is subscribed to some order. It never writesswap:block: blocking an address for good still needs the signed link in a mail. The button is a local one — it clears the order out of your browser, and there is nothing it can do at the exchange, because the swap API behind this desk has no cancel.

§ 7 — storage on your device, and the choice you get over it

This desk sets no cookies of its own. Not one — the two that can appear belong to Cloudflare and Kraken and are described in § 3 and § 8. What this desk itself puts on your device is browser storage, and this is the complete list of it:

  • Your last ten orders — order IDs, the deposit address the provider gave you, the receiving address you entered, the provider name, amounts, networks, status, and the moment your browser wrote the order down. That last one is the only creation time that exists anywhere: the provider's API reports none, so it is what the thirty-minute clock on the tracking card counts from. This exists for one reason: so you can find your own order again after closing the tab. It is written and read only by your browser. It is never sent to this site's server, and the server cannot read it.
  • Your last pair and amount — one localStorage entry, capped at 200 characters, holding the two coins you last chose and the number you last typed, so the form comes back the way you left it. It follows the same consent gate as the order list.
  • Your answer to the banner — one localStorage entry holding one word, "yes" or "no". It is not an identifier, it is not sent anywhere, and its only job is to stop the site asking you the same question on every visit.
  • A dismissal flag, if you close the banner without answering — one sessionStorage entry holding the digit 1, so the banner does not pop back up while you are still on the page. It holds no identifier and it dies when you close the tab, which is why the question comes back next time.

The order history and the remembered pair are optional, and off until you say otherwise. § 25(1) TDDDG says storing things on your device needs your consent unless they are strictly necessary, and while a saved order list is genuinely useful, the desk works completely without it — so both are treated as consent-based, not necessary.

  • Accept and each new order is added to the list on this device, and the pair you last used is remembered. Legal basis: your consent, § 25(1) TDDDG and Article 6(1)(a) GDPR.
  • Decline and nothing new is written, and the saved order list is deleted on the spot. A pair-and-amount entry written before you declined is not swept up with it; clearing site data removes that one. Every other part of the desk keeps working — quotes, orders, tracking, the converter. You just have to keep your own order ID.
  • Ignore or dismiss it and you have decided nothing, so nothing new is written. Orders already saved from before stay visible until you decline.

The record of that answer, and the dismissal flag, are themselves strictly necessary under § 25(2) TDDDG — a consent decision you cannot store is a banner that reappears forever, which is the problem it exists to solve. You can change your mind at any time with the "storage choice" link in the swap desk's footer, or by clearing site data in your browser, which wipes every entry listed above and puts you back to undecided. Withdrawing consent is exactly as easy as giving it and costs you nothing else.

§ 8 — prices and charts

Three separate price feeds run on the swap page, and they differ in whether anyone outside Cloudflare sees your IP:

  • CoinGecko is fetched by your browser directly, for the USD and EUR values next to amounts. CoinGecko therefore receives your IP address and standard request headers, like any site you load an image from.
  • The live ticker opens a WebSocket from your browser directly to Kraken (ws.kraken.com) for streaming spot prices. Kraken sees your IP for the life of that connection, and its Cloudflare layer sets two of its own cookies on kraken.com while it is up — a bot-management one that expires in about half an hour and a session-scoped one for rate limiting. They are Kraken's, not this site's, they carry no tracking, and blocking third-party cookies stops them at the price of the live ticker.
  • Chart history is different: /api/market/ohlc fetches it from Kraken server-side, so for that request Kraken sees Cloudflare, not you.

None of these carry anything about your swap — no addresses, no amounts, no order IDs, just "what does BTC cost". Legal basis: Article 6(1)(f) GDPR, legitimate interest in showing prices that are true.

§ 9 — rate limiting

To keep the desk from being drained by scripts, each backend endpoint counts requests. It does this without storing who you are: your IP address and the name of the counter are joined and run through SHA-256, and only the first 28 characters of that digest become the key. The raw IP is used in the computation and discarded. The digest cannot be turned back into your IP and identifies you to nobody.

  • quotes: 30 requests, counter expires after 10 minutes;
  • chart history: 60 requests, counter expires after 10 minutes;
  • order creation: 6 requests, counter expires after 1 hour;
  • email updates: 6 requests, counter expires after 1 hour;
  • order tracking: 300 requests, counter expires after 1 hour.

Legal basis: Article 6(1)(f) GDPR, legitimate interest in abuse prevention.

§ 10 — what this desk does not do

  • no analytics, no page-view tracking, no session recording, no heatmaps, no scroll events;
  • no advertising, no advertising identifiers, no retargeting pixels;
  • no profiling and no automated decision-making with legal effect under Article 22 GDPR — whether a provider asks you for ID is the provider's decision, made on its systems, not here;
  • no accounts, no logins, no newsletter and no marketing mail. The only email address this desk ever stores is one you typed in yourself for updates on one order, and it is used for that order and nothing else (§ 6);
  • no fonts or icons loaded from a CDN. The type is your own system's monospace and serif — no webfont is downloaded at all — and the coin and flag icons ship with the site, so nothing goes to Google Fonts or anywhere like it. The scan code on the tracking card is the same story: your browser draws it, from the deposit address already on the page, so no request goes out to make it and that address never leaves the page to become one;
  • no selling of anything to anyone. There is nothing here to sell.

§ 11 — recipients

Data leaves this desk only as described above, to:

  • Cloudflare — hosting, backend functions, and the KV store that holds the rate-limit counters, the email subscriptions and the unsubscribe blocklist;
  • CypherGoat, the quote aggregator — routes and amounts for quotes; for orders, additionally the provider, your receiving address, IP, user agent and language;
  • the swap provider you choose — the same order data, because it is the party actually executing the swap;
  • CoinGecko and Kraken — request data only, from price lookups;
  • Resend — the mail processor, and only if you asked for status updates: your address and the text of each update, which for an order still waiting to be funded includes the exchange’s deposit address. It never gets a wallet of yours, and nothing about anyone who did not ask for mail.

That is the complete list. No recipient gets anything for advertising. There are no processors beyond these and no onward sharing.

§ 12 — transfers outside the EU

Cloudflare, CoinGecko, Kraken, Resend and most swap providers are outside the EU or route traffic through it. Those transfers rest on the safeguards each provider publishes — EU standard contractual clauses under Article 46 GDPR and, where the company is certified, the EU-US Data Privacy Framework under Article 45. The operator has no way to make a swap provider in another jurisdiction stop being in another jurisdiction; if that matters to you, the pairs and providers are visible before you commit to anything.

Resend is worth one extra line, because it is the only one of these that handles something as identifying as an email address. It is a US company. Where your address and the text of an update physically sit, and how long its logs and bounce records hold them, is Resend's infrastructure and Resend's policy; this page is not going to make promises on its behalf. If that is a problem for you, do not leave an address — the desk tracks orders perfectly well without one.

§ 13 — retention

  • rate-limit digests: 10 minutes for quotes and chart history, 1 hour for orders, email updates and tracking, then they expire on their own;
  • quote requests: not stored at all, only passed through. The ID of a quote you turned into an order is kept for 10 minutes so the same quote cannot be spent twice — it is a random token, attached to nothing about you;
  • email subscriptions: 30 days from the moment you leave the address, then the record expires by itself. The link in any update deletes it sooner, and so does "Forget this order" on the tracking card;
  • the last status mailed for an order: one word under the order ID, 30 days. It is what stops the same update being sent twice;
  • the unsubscribe blocklist: one year per address, and what is stored is the 24-character hash, not the address;
  • order data at the provider: kept by the provider under its own policy and, where it does KYC, under its own legal retention duties. This site cannot delete it for you;
  • your order history: on your device, so its retention policy is you — ten entries, oldest dropped, gone when you clear it or decline;
  • your last pair and amount: also on your device, until you clear site data;
  • your answer to the banner: on your device until you change it or clear site data. The dismissal flag dies with the tab;
  • server-side, there is still no order database. The list above is the whole of it — the counters, the used-quote marker, the status marker, a hash on the blocklist, and an address if you asked for one to be used. No route, no amount and no wallet address is kept here at all. The one thread that does run between you and an order is the order ID stored beside an address you left for updates, and it expires with that record.

§ 14 — your rights

Under Articles 15 to 21 GDPR you can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Under Article 7(3) you can withdraw consent at any time, which for this desk means the "storage choice" button in the footer of the swap desk itself — it is not on this page, because the thing it controls is not either. Email updates run on Article 6(1)(b) rather than consent, so that button has nothing to do with them; their off switch is the link in § 6. All of it goes to sam@samsam.lol.

Be aware of what an access request here can actually return: no order database exists on this side, so for most visitors the honest answer is an expired hash and nothing else. If you left an email address there is something real to hand over — the subscription record for that order, for up to 30 days — and deleting it is one mail to the address above, or one click on the link in any update, which is faster. The blocklist is the awkward one. It holds a hash because you asked never to be mailed again, and emptying it would undo exactly that, so it stays until it expires. Ask for it to be lifted and it will be, which puts you back to being someone the desk is willing to mail. For the order itself, the provider holds the record, and its own process is where a deletion request has to go. You can also complain to a supervisory authority — any EU data protection authority will take it, including the German one for the operator's state.

§ 15 — children

This desk is not directed at children and no service here is offered to them. Under Article 8 GDPR consent given by a child under 16 needs a guardian's authorisation; the consent asked for on this desk covers a list of your own orders and the pair you last picked, both on your own device, which is about the smallest thing consent has ever been asked for, but the rule applies anyway.

§ 16 — changes

This page changes when the code changes, because it is written from the code. Changes are not announced by mail. There are addresses on file — for 30 days, one order each — and they are only ever used for that order's status, which a policy update is not, so nothing about this page will land in anyone's inbox. If a change widens what is stored on your device, you will be asked again rather than quietly opted in.