Privacy
Last updated 23 September 2026
DeFiLoops is a project, not yet a company. No legal entity has been incorporated to operate it. Where a policy would normally name a data controller, a registered address and a supervisory authority, there is nothing honest to put — so this page says what is actually true instead. When an entity exists this page will name it, and the date above will change.
That has a consequence worth stating plainly: until there is an entity, there is no company for you to bring a claim against, and no company that can sign a data processing agreement with you.
The short version
We are non-custodial. We never hold your funds, we never hold your keys, and the agent that plans your workflows cannot name a destination for your money. Nothing moves until you start it, and what moves is signed by you.
We do not sell your data, we do not run advertising, and we do not ask you for identity documents.
What we collect
If you only read the website
Google Analytics, for aggregate traffic: pages viewed, approximate region, referrer, and device type. It sets cookies. It does not tell us who you are. If you would rather it did not run at all, any tracker blocker or your browser's Do Not Track setting stops it, and nothing on this site breaks when it is blocked.
If you create an account
- How you sign in. A Google account, a passkey, or an email address and password. With Google we store the email address Google gives us and the identifier it uses for you — not your Google password, and nothing else from your Google account. With a password we store a hash of it (argon2id), never the password.
- Your wallet addresses. Public addresses you connect or that the product derives for you. A public address is not a name, but it is permanent and public — anyone can read its whole history on a block explorer, including us.
- What you asked the product to do. Workflows you author, plans you sign, orders you rest, and the runs that follow. This is the product; it cannot work without keeping it.
- Credits. A ledger of what your runs cost in gas and fees.
- A session cookie so you stay signed in. It is the only cookie we set ourselves.
Calls we make on your behalf, and what they leave behind
Running a workflow means asking other services questions — a blockchain node for the state of a pool, a pricing service for what a swap would fetch, a simulator for whether a transaction would revert. We keep a log of those calls, including the request and the response. It is how a run that went wrong can be explained afterwards, and it is the difference between "your transaction failed" and a reason.
Those records contain addresses and amounts. They do not contain your keys, because we never have them.
What we do not collect
- No identity documents. No passport, no proof of address, no selfie. We do not perform KYC. Where a workflow touches a real-world asset that requires an eligibility credential, that credential is issued by the asset's own issuer and checked on-chain — we read whether you hold it, and never see what you showed them to get it.
- No private keys, seed phrases or recovery phrases. Ever, for any reason.
- No advertising or cross-site tracking.
Who else sees it
The services that make the product work, and only what each needs: Google (sign-in), Google Analytics (website traffic), blockchain node providers, a transaction simulator, and a transaction broadcaster. Some are outside the UK and EEA, which means your data is transferred internationally when you use the product.
We do not sell data, and we do not share it for anyone else's marketing.
The public-blockchain problem
This one cannot be fixed by any policy, so it is better said than buried. Every transaction you sign is written to a public blockchain, permanently, by design. We cannot delete it, and neither can anyone else. Deleting your account here removes our records — it does not and cannot remove the chain's.
How long we keep it
- Your account — until you delete it.
- Runs and plans — while the account exists, because they are its history.
- Service-call logs — they are trimmed on a rolling basis; they exist to explain a recent run, not to build a profile.
- Analytics — per Google Analytics' own retention, which is currently 14 months.
Your rights
If you are in the UK or the EEA, the UK GDPR and the GDPR give you the right to ask for a copy of your data, to have it corrected, to have it deleted, to object to processing, and to complain to your data protection authority. If you are in California, the CCPA gives you the right to know what is collected, to have it deleted, and not to be discriminated against for asking. We will honour any of these from anyone, wherever you are, because drawing a map of who deserves which right is not a thing we want to spend our time on.
Ask by email. You can delete your account yourself from the app; email us if you want everything else gone with it.
Security
Passwords are hashed with argon2id. Sessions are cookies scoped to the host and not readable by scripts. Secrets are held in a secrets manager rather than in configuration files. None of that is a guarantee — anyone claiming a guarantee is selling something — but the design goal throughout is that a breach of us should not be able to move your money, because moving your money requires a key we do not have.
Children
This is not for under-18s, and we do not knowingly keep data from one.
Changes
When this changes, the date at the top changes. If a change is material we will say so on the site rather than relying on you to diff a page.