Privacy Policy

Who We Are

Vurto runs the websites and services on vurto.cc and its subdomains: the Swap and Vurto Payments (swap.vurto.cc), Vurto Dead Alive (the Dead Alive tab on swap.vurto.cc and alive.vurto.cc), the Vurto Profile, the documentation (docs.vurto.cc) and this home page. This policy explains what we collect, why, who else sees it, how long we keep it, and what you can ask us to do with it.

The Short Version

• Vurto is non custodial. We never ask for your seed phrase or private key, and we never hold your funds. Your wallet signs every transaction.
• You sign in by signing a free message with your wallet. That proves the wallet is yours. It does not move tokens or grant approvals.
• We do not sell your data, and we do not use advertising trackers.
• Transactions on public blockchains are public by design. Nobody, including us, can delete them.

What We Collect

Wallet Sign In

When you sign in, we store your wallet address and a session. Your browser keeps a random session token in an HttpOnly, Secure cookie; our database keeps only a hash of that token, the wallet and the expiry. Swap and Vurto Profile sessions last 24 hours. Dead Alive sessions last 7 days. Expired sessions are deleted automatically.

Swaps And Payments

To quote, build and track what you ask for, we process your wallet address, the tokens, amounts and networks, the transactions you send and their status. This is also your history inside the app.

An invoice stores its network, token, amount, receiving wallet and the note you add. Anyone with the invoice link can see the amount, token, network, the note and the receiving wallet. For an invoice paid through the Vurto Private Contract, the receiving wallet is not shown. When you pay an @handle, Vurto picks one of the wallets that person marked to receive; in a regular payment your wallet still shows that address, because the payment goes straight to it.

Vurto Profile

Your profile keeps your @handle and the wallets you link to it, with the settings you choose for each one, such as which wallets can receive regular or private transfers. The full address of each linked wallet is encrypted before it is stored, with a key for each row derived from a master key that only our server holds. To find a wallet, we use a keyed index instead of the address, and we keep only the last characters of the address in clear to show it to you. When you remove a wallet, its encrypted address is deleted.

Vurto Dead Alive

For streamers we keep the display name, the @handle, the receiving wallets and the channel settings. For each donation we keep the name and message the donor typed, the amount, the network and the token. The donor name and message are shown on the streamer's live alert and in the streamer's donation list, so do not write anything you would not want shown on a live stream. Names and messages go through a filter for offensive words.

Dead Alive never stores your IP address. Where it needs to limit abuse, it uses a keyed hash of part of the IP address instead.

Support Messages

When you send a report or a support message, we keep what you wrote, the wallet if you were signed in, the app version, your browser's user agent and your IP address. The message and the wallet are sent to our team on Telegram so someone reads it. Reports are deleted after 90 days.

IP Addresses

Our servers see the IP address of every request. On the Swap and Vurto Payments, we use it to limit abuse, in counters that are deleted after about an hour. We also keep it with support reports (90 days), with API credentials when they are issued, and inside the encrypted record of wallet analyses described below.

Browser Storage

The apps keep preferences in your own browser: language, theme, slippage, the last network, tokens you imported and some reminders. They stay on your device until you clear them.

Identity Verification (KYC)

Some features, such as the Vurto Private Contract, require identity verification, done by our partner Didit. Didit collects your document and a selfie directly from you.

• Didit checks your identity. When a paid wallet analysis runs, Didit receives only that wallet's address, never who it belongs to.
• Your identity data never reaches the website. Our server encrypts it before storing it, and the key that opens it is not on our servers. Even if someone broke into them, they would find only unreadable data.
• Your identity is linked to your wallet only to answer a legal request. If you've done nothing illegal, there's nothing to worry about.

The identity verification itself does not send your wallet to Didit. On our side, the wallet is stored only as a keyed hash. Verifications that were declined or expired are deleted after 30 days, except one that must stay so that an older approval does not come back.

Wallet Analyses

To keep sanctioned and stolen funds out, we screen wallets before we prepare certain payments. The free screening checks the OFAC sanctions list, which we keep on our own servers, and public blockchain data.

Paid analyses run only when they are part of what you chose or paid for, such as an invoice with analysis, a private transfer, a Dead Alive donation or a withdrawal that needs one. They send the wallet address to outside providers:

• Scorechain receives the wallet address.
• Merkle Science, through Didit, receives the wallet address and the network, and nothing about whose wallet it is.
• To recognize a brand new wallet, we ask public block explorer APIs (Etherscan and Blockscout) whether the address has any history.

We keep a record of analyses for 10 years to meet our legal obligations. A summary (the invoice, the network, the paying and receiving wallets, the transactions and the result of each test) is kept in our database. The full log, including the IP address our servers saw, is compressed and encrypted so that only a key kept offline can open it, and is stored where it cannot be changed or deleted before the 10 years end. If encryption is ever unavailable, the log is kept without the IP address and without the identity link.

The Vurto Private Contract

When you pay or receive through the Vurto Private Contract, the network does not link the paying wallet to the receiving wallet. Deposits and withdrawals are still public transactions. Our own records of the invoice, the analyses and the identity verification still exist and are protected as described in this policy.

Google, YouTube, Twitch And Kick

A Dead Alive streamer can verify that a channel is theirs by signing in with YouTube (Google), Twitch or Kick. When you do:

• We ask for read only access: the youtube.readonly scope on Google, user:read on Kick, and no extra scope on Twitch.
• We read your channel or account once, to get its ID and name.
• Right after reading it, we ask the platform to revoke the access token. We never store the token.
• We store the platform, the channel ID, the channel name and the date, only to show the verified badge on your donation page.
• We do not use this data for advertising, we do not sell it, and we do not share it with anyone else.
• You can remove the verification at any time in the Dead Alive tab, which deletes what we stored.

Vurto's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Our YouTube verification uses YouTube API Services. By using it you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can also revoke Vurto's access from your Google account permissions page.

Who Else Sees Your Data

• Cloudflare hosts our websites and databases, so every request passes through it. Some pages may use Cloudflare Web Analytics, which counts visits without cookies.
• Quote and liquidity providers (Velora, KyberSwap, 1inch, CoW Protocol, Jupiter, Raydium and Orca) receive the tokens and amounts needed to price a swap and, when they build the transaction, your wallet address. CoW Protocol orders are public.
• Blockchain nodes receive the addresses and transactions we read or send for you.
• Didit, Scorechain and Merkle Science, as described above.
• Reown (WalletConnect), when you connect a wallet through WalletConnect.
• Telegram carries support messages and operational alerts to our team.
• Google Fonts serves a font on vurto.cc, so Google sees the request for it.
• Google, Twitch and Kick, only when a streamer chooses to verify a channel.
• ElevenLabs turns a donation's name, amount and message into the spoken alert, only for channels where voice alerts are turned on. While voice alerts are off, nothing is sent to ElevenLabs.

We also disclose data when the law requires it, for example to answer a valid legal request.

How Long We Keep It

• Sessions: until they expire (24 hours, or 7 days in Dead Alive).
• Abuse counters with IP addresses: about an hour.
• Support reports: 90 days.
• Declined or expired identity verifications: 30 days, with the exception above.
• Record of wallet analyses: 10 years.
• Profile, Dead Alive channel, invoices and history: while you use the service, until you ask us to delete them, unless the law requires us to keep them.
• Anything on a public blockchain: forever, outside our control.

Your Choices And Requests

You can sign out at any time, remove wallets from your profile, and remove a channel verification. To ask for a copy of your data, a correction or its deletion, contact us. We will answer and delete what we are allowed to delete. We cannot delete the record of wallet analyses before its legal period ends, or anything on a public blockchain.

Security

Session tokens are stored only as hashes, linked wallet addresses and identity data are encrypted before storage, and the keys that open identity data and analysis logs are kept offline. No system is perfectly secure. If you find a vulnerability, please write to security@vurto.cc.

Children

Vurto is not meant for anyone under 18.

Changes

When this policy changes, we update the date at the top of this page.

Contact

Write to security@vurto.cc, or use the support chat in the Swap.