Skip to main content

Privacy

This page explains what Broker as a Service (BaaS) collects when you use chainflip-broker.io, its API, its MCP server, the partner dashboard and this documentation site, and what happens to it. Questions or requests: info@chainflip-broker.io.

Your partner account​

When you register as a broker we store:

  • the partner name you register under,
  • your email address, if you give one,
  • your commission and the Ethereum address your commissions are paid to,
  • the API key and admin key we issue to you, and the broker addresses we create for you on the Chainflip network.

Dashboard users are stored with their email address, role and a password hash; we never store passwords themselves. We use your email address to send account emails: your keys at registration, sign-in codes, invitations, password resets, sign-in alerts, team changes and commission payouts.

Swaps​

To quote, start and track a swap we store the assets, amounts, deposit and destination addresses and transaction hashes involved. All of these are public on the blockchains concerned anyway; a swap cannot be made private by us or anyone else.

Completed swaps may be announced in our public Discord and Telegram channels with the assets, amounts and their USD value, a link to the block explorer, and a partner label (your partner name, or a shortened broker address). Announcements never include wallet addresses, transaction hashes or email addresses.

Logs and security​

Requests to the API, the website and this documentation site pass through a real-time log we use for debugging. For each request it records the IP address, browser user agent and full URL, including the query string. We use it to investigate problems you report and to spot abuse as it happens. This log is kept for 24 hours and then deleted; it is never stored permanently.

Dashboard sign-ins and account changes are recorded separately, with the IP address and browser they came from, and are shown to you in your account's audit log.

Addresses that probe for well-known vulnerabilities are blocked for one hour. That block list is kept in memory only.

Our staff can open a partner's dashboard in read-only mode to help with a support request. Each such view lasts at most one hour and is recorded in our internal audit log.

Tor​

Over our Tor onion services no IP address is recorded anywhere, in request logs, sign-ins or the audit log, and no third-party bot check is loaded. Tor hides who is calling the API, not the swap itself.

Cookies​

The dashboard uses one session cookie to keep you signed in (one day, or 30 days if you choose to stay signed in) and a security cookie on forms. Neither is used for tracking. The website and this documentation site use no analytics or advertising trackers.

Service providers​

  • Cloudflare Turnstile checks for bots on the sign-up, sign-in and password pages of the clearnet website. Cloudflare receives your IP address and browser information when it runs.
  • Discord and Telegram carry the public swap announcements described above.

Questions and requests​

To ask what we hold about you, or to have it corrected or deleted, write to info@chainflip-broker.io from the email address on your account. Swap data recorded on a blockchain cannot be deleted by anyone. See Contact Us for other ways to reach us.