Your wallet.
Your choices.

This policy covers Kurama Swap, a Solana token-swap interface, and its privacy controls. The operator responsible for this interface can be contacted at the email in the contact section below. Kurama Swap does not ask you to create an account, provide a name, or enter a payment-card number.

Your wallet keeps control of signing. The interface does not request or store your private key or recovery phrase. A public wallet address can still be linked to a person and should not be treated as anonymous.

When you connect a wallet, we process the public address and wallet connection state. Balance checks, quotes, simulations, and transaction checks use the address, token mint addresses, amounts, slippage limits, fee details, transaction signatures, and transaction status. Signed transactions are submitted only through the wallet approval flow when live execution is enabled.

The server sends quote inputs to Jupiter and blockchain requests to the configured Solana RPC service, which may be Helius or a public Solana endpoint. Token searches pass your search term or mint address through our server to DexScreener. If the server reports a network or TLS connection failure, your browser may retry DexScreener directly, exposing your IP address and ordinary browser headers to that service. GeckoTerminal supplies trending-token data. These requests support the feature you are using, independently of your analytics choice.

Browser local storage remembers the wallet provider you selected, up to five recent token selections with their search terms and timestamps, and the theme you explicitly choose. The theme preference is specific to Kurama Swap. The transaction archive contains wallet addresses, token pairs, amounts, timestamps, outcomes, and transaction signatures; it is limited to 100 entries overall and 50 per wallet.

A separate safety journal keeps swap operation details and signed quote envelopes so an interrupted operation can be checked before another attempt. It retains active operations and a bounded set of completed operations, rather than expiring on a fixed schedule. Local records remain until replaced by their limits or removed through browser site-data controls. Avoid clearing them while a swap is unresolved.

On deployments that need a browser security identifier, the HttpOnly swap-client cookie supports authenticated API access and rate limiting for up to 24 hours. On Vercel, the server can use the network IP address for that protection instead. Your privacy choice is stored separately for Kurama Swap for 180 days. These storage items are for security and the features you request, rather than advertising.

Vercel Web Analytics is disabled until you accept analytics. If enabled, it reports visits to known public pages, referrers, approximate geography, visit times, and browser, operating-system, and device details. Our event filter removes URL query strings and fragments and does not send wallet or swap events. Vercel describes this product as cookieless and uses a temporary request-derived visitor hash; its visitor session is discarded after 24 hours, which is not a promise that all aggregate reports expire then.

Reject optional leaves the swap tools available. Cookie settings in the footer lets you withdraw permission, stopping future analytics events. Withdrawal does not delete reports already received. The application does not include advertising pixels or a feature for selling wallet histories.

Hosting and infrastructure providers receive network requests, including IP addresses, request headers, and operational diagnostics. Market-data, routing, and RPC providers receive the inputs needed for their respective services. Remote token-image hosts receive your IP address and ordinary browser request information when their images are loaded. Opening a Solscan transaction link or another external link takes you to a service with its own privacy practices.

If the operator configures Telegram notifications, a verified, confirmed live swap sends the app name, source page URL, public wallet address, token mints, amounts, minimum received, and transaction signature to the operator’s configured Telegram chat. This operational notification is separate from optional visit analytics. An in-memory delivery record suppresses successful repeat notifications for 24 hours; that limit does not delete messages in Telegram.

Submitted Solana transactions become public blockchain records. Neither clearing this browser nor asking the interface operator for deletion removes an onchain transaction. Service providers may process information outside your country; their own terms and applicable transfer arrangements govern their processing.

We process requested wallet and swap operations to provide the service, security identifiers to protect API availability and prevent abuse, and optional analytics on the basis of your permission. Where data-protection law applies, the relevant grounds may include performing the service you request, legitimate interests in service security, and consent for optional analytics.

Search results are cached in server memory for 30 seconds for reuse; an expired entry may stay in the bounded cache until replaced or the process ends. Rate-limit counters use temporary in-memory windows. Host logs, analytics reports, and Telegram messages follow the operator’s and providers’ configured retention settings rather than the browser-history limits above. Access tokens and signed quote bindings protect API operations, but no internet service can guarantee absolute security.

Disconnect your wallet to end its connection and remove its saved provider preference. Use your browser’s site-data settings to erase local records and the saved analytics choice; this does not erase blockchain records or provider-held information. When variants share one origin, their wallet and swap storage is shared, while each brand has a separate analytics choice. Separate domains have separate browser storage.

Depending on the law that applies to you, you may request access, correction, erasure, restriction, portability, or object to certain processing. You may also complain to the relevant data-protection authority. Contact us to make a request; we may need proportionate verification and cannot delete public Solana records. We update the date above when this notice changes and request a fresh analytics choice when the consent version changes.