Privacy Policy

SWIRL is a pooled mixing layer for Lightning payments, used through the web console at swirl.cash. The same site runs the Genesis campaign, which uses X sign-in. This policy covers both — and the short version is unchanged: the system is built so there is very little to hold.

Pool state: while deposits and payouts are in flight, the pool holds their parameters in memory. This state is never written to a database and dies with the process.

Job records: settled jobs persist for a configurable retention window (default 24 hours) so settlements can be audited, then are purged automatically.

Receipts: your receipt credential is encrypted on your own device under a vault key phrase we never see. Only ciphertext is ever backed up — blobs we cannot read.

X sign-in: when you authorize X, we receive your X user ID, handle, display name, and avatar — nothing else. Access is read-only: we never post, follow, like, or message on your behalf. Task links open in your own browser; the post is always yours.

Campaign ledger: your invite code, referral chain, task completions, vSWIRL points, and the Lightning address (npub…) you save for allocation.

Review submissions: the tweet links you paste for manual review of featured-post and OG applications.

Sessions: one cookie keeps you signed in. Clear it and you are signed out; nothing else about the session is stored.

No analytics, no advertising trackers, no device fingerprinting, no telemetry anywhere on this site. We never ask for your name, email, or phone number on swirl.cash itself. OG applications are collected through a Google Form — that page is operated by Google under its own privacy policy.

This is architectural, not a promise. Receiving uses BOLT12 offers negotiated over onion-routed messages — no web server sees payer metadata. Pool channels are unannounced — the public graph does not map them. Payouts are cut into uniform denominations and released through a randomized delay queue — the public transcript does not reconstruct the flow. A system that never holds data cannot leak it, sell it, or surrender it.

Exactly two third parties touch campaign data: X, for sign-in and verification of public posts, and Google, for the OG application form. We do not sell, rent, or share data with anyone else — and there is very little data to share in the first place, by design.

Note the boundary of the protocol: Lightning routing and Bitcoin settlement are public networks. The protocol minimizes what those networks reveal, but your own endpoint hygiene — IP addresses, wallet fingerprints, infrastructure reuse — remains your responsibility. Running over Tor is the documented posture.

Funds in flight sit inside the pool under its settlement constructions; the only claim on an exit is the receipt credential, encrypted client-side. The campaign database holds only what is listed above — no keys, no seed phrases, no identity documents, ever.

Material changes to this policy are posted on this page with an updated date and announced on @swirlbtc.