Privacy Policy

Who we are

Routed.wtf is operated by Thalos Labs, Inc. This policy covers the Routed.wtf website and merchant tools.

What we collect

• Session details: the product and provider you choose, assets, amounts, the US state you select, the provider’s order reference and status, and what the provider reports about your transaction, which can include the wallet address it delivered to and transaction hashes.
• Your IP address, used for security, rate limiting and fraud prevention. Our records keep only a hashed form of it.
• An email address, only if you give one: for status updates, for support, or when a merchant’s payment link asks for it. An address you give on a purchase, sale or swap status page is kept encrypted only until its one email is sent, then deleted (at most 30 days).
• For merchant payments through BVNK: your name, date of birth and country, which BVNK requires. We pass them to BVNK and do not store them.
• For wallet-connected swaps: your wallet address, which we send to the provider to build the route and keep, encrypted, with the swap’s record so we can show its status and support can find it.
• For sales you send from a browser wallet on Routed.wtf: the deposit address and amount MoonPay gives for the sale, and the transaction hash your wallet reports. A transaction hash is public on the network and shows the wallet that sent it.
• Coarse, non-identifying product analytics (for example, which step was reached or which asset pair was chosen). Analytics never include wallet addresses, emails, names or transaction hashes.
• For merchant accounts: business contact details, team members, settings, and the credentials of any provider account a merchant connects, which are encrypted.

What providers collect

Providers collect what they need in their own checkout, such as identity documents, payment details and your wallet address, under their own privacy policies. We do not receive your identity documents or card details.

How we protect it

Sensitive fields such as wallet addresses and emails are encrypted at rest and masked in internal tools. Access to unmasked values is limited to authorized staff and is audited.

Sharing

We share only what a provider needs to run your transaction:

• Ramp Network: the assets and amount you chose, and a reference to your session.
• MoonPay: the asset, the amount and a reference to your session; for purchases also a keyed hash of your IP address, so MoonPay can check the purchase comes from your device.
• BVNK (merchant payments): the amount, your name, date of birth, country and IP address.
• MoonPay Trade (operated by Swaps XYZ) or the Coinbase Trade API (wallet-connected swaps): your wallet address, the tokens and the amount.
• For merchant payments, the merchant that requested the payment sees its details and status.

We do not sell personal data.

Cookies and storage on your device

This site sets no cookies and uses no third-party trackers or advertising scripts. Your browser keeps a few items locally, which never leave your device unless you send them:

• Your most recent orders and provider sessions, up to ten of each (their IDs and a short label such as “Buy USDC for $50”), so you can find their status pages again.
• Your last selected swap assets.
• The US state you last selected.
• Whether you have already seen the introduction animation.

You can clear these at any time from your browser’s site data settings.

Retention and your rights

Transaction records are retained as required for accounting, fraud prevention and legal obligations. Contact support to request access or deletion where applicable.