Privacy and fees

Real swaps temporarily put funds in Zornado's custody. Ordinary route quotes compare eligible providers after the service fee. Payout and refund addresses go to Zornado and may go to the providers being compared before acceptance. Unless the payout is ZEC, the selected provider handles both external legs and receives both addresses; the shielded ZEC step does not hide their link from that provider. Providers apply their own policies.

When offered, fixed-lot groups pay equal ETH amounts from Zornado's reserve after verified shielded intake. Their fixed price includes costs. Zornado knows each order's endpoints; public timing, address history and other participants can still expose links. Each customer's records follow the retention rules below.

ZEC notes

Your recovery phrase is created and used in your browser; it is not sent to the service. The service receives a shielded viewing key and can see this note's activity. Its watch-only history stays in memory; the session is discarded after 15 minutes without a request, at the next 30-second cleanup.

Signed withdrawals stay in your tab's session storage and in any updated note file you save. Keep that file private. The note flow charges the network fee shown before you sign; public conversions and reused addresses can still reveal links.

Fees

The service fee on the ZEC leg is 1% up to US$1,000, rising to 10% at US$100,000 and above. If the input's USD value is unavailable, the fee is 5%. Provider pricing and network costs also affect the payout. Review the signed quote's fee and minimum payout before accepting.

Privacy

We hold funds only until payout or refund.
We keep no access logs.
No sign-up, no cookies, no third-party scripts.
We purge addresses and transaction IDs 72 hours after verified settlement.
Order amounts and times remain and can permit correlation.
Provider records and public blockchains stay outside the purge.

Retention

Optional referrals associate the public code with an order until that order is purged. Referral accounts keep aggregate ZEC credits, a keyed recovery-key verifier and opaque replay checks without an expiry. They keep no order history. A separate encrypted snapshot holds these aggregates; the retention job clears interrupted snapshot writes. The browser keeps the recovery key in the open page only. Save your private backup; we cannot recover a lost key. Credits are reserved, and withdrawal requests require operator approval before payment. Withdrawal addresses and transaction evidence follow the same 72-hour retention window after a confirmed payment or cancellation. Unresolved withdrawals are held for review. Aggregate paid and reserved balances and replay guards remain.

We keep no access logs. We purge addresses, transaction IDs, provider IDs and memos from managed order records 72 hours after completion or refund with verified settlement, at the next hourly cleanup. Expired orders with no deposit ever detected are purged after 30 days from expiry or the provider deposit deadline, whichever is later.

Open obligations, unresolved sends, manual review, reconciliation, HOLD, other unfinished states and unverified settlement prevent purge until resolved. Invalid journals or send records block the affected orders and are reported by the cleanup job.

Exact per-order amounts, fees, outcomes, route IDs, hour-rounded event times, precise lock timestamps and process IDs remain and can permit correlation. A permanent keyed replay filter remains. Status and receipts are unavailable after purge (410).

The shielded wallet keeps its own ZEC transaction history, including transaction IDs, values and provider deposit addresses. Ordinary two-leg swaps reach that wallet without user payout and refund addresses; a shielded ZEC payout or a direct ZEC compensation keeps its recipient there. Wallet history can still permit correlation with the retained order amounts and times. The wallet database, synchronization archives (archive-*-epochs), provider records and public blockchains remain outside this purge.