The Service currently runs on the Sepolia test network: its tokens have no real value and everything here is for testing only.
Privacy Policy
1. Who is responsible
Aurus Exchange (the “Operator”) runs Aurus Exchange and decides why and how your personal data is processed. Contact for privacy questions and requests: the contact details published by the operator.
2. What data we process
- Account. Telegram ID, Telegram username and language (if you use Telegram); email address and a hash of your password (if you register on the website); the language you choose; the date you registered; your personal deposit address.
- Security. Login sessions (a hash of the session token, dates and the browser description); if you enable two-factor authentication, the secret in encrypted form and hashes of recovery codes; the date and version of the documents you accepted.
- Exchange activity. Balances, orders, trades, deposits, withdrawals (including the destination address and transaction hash), checks you create or claim (including your comment), and a ledger of every balance change.
- Technical data. Your IP address and browser description reach our servers and the web server logs with every request; the IP address is also used for abuse protection (limits on login attempts). We do not use advertising or analytics trackers.
- Messages. Notifications the bot sends you, and the statements (PDF/CSV) you request.
We do not ask for identity documents. If we have to introduce identity checks by law, we will update this Policy first.
3. Why we use it
- To provide the Service: create your account, credit deposits, match orders, process withdrawals and checks (performance of the contract).
- To protect the Service and its users: prevent fraud, abuse and attacks, limit login attempts, investigate incidents (legitimate interest).
- To keep financial records and meet legal obligations (legal obligation).
- To send you service messages: confirmations, security alerts, deposit and withdrawal status (performance of the contract).
We do not sell your data and do not use it for advertising or profiling.
4. Who receives it
- Telegram delivers the mini app, sign-in confirmations and bot messages, and sees what you do inside Telegram under its own policy. The interface also loads a script from telegram.org, which therefore receives your IP address.
- Cloudflare proxies traffic to the website and sees requests to it (including your IP address).
- Hosting and infrastructure providers run our servers and database.
- Blockchain node provider receives our queries about deposit addresses and transactions. Blockchain data is public: deposit and withdrawal transactions are visible to everyone.
- Google Fonts delivers the font used by the interface, so your browser requests it from Google, which receives your IP address.
- Authorities or other parties, where the law obliges us to disclose data.
Some of these providers are outside your country, including outside the European Economic Area. We use them only as needed to run the Service.
5. How long we keep it
- Account data: while your account exists.
- Login sessions: until they expire or you sign out.
- Financial records (orders, trades, deposits, withdrawals, ledger): as long as required for accounting, dispute resolution and legal obligations, even after the account is closed.
- Server logs: for a limited time needed for security and troubleshooting.
- Blockchain transactions cannot be erased by anyone.
6. How we protect it
Passwords are stored only as a strong hash (Argon2id); session tokens only as hashes; two-factor secrets are encrypted; our servers hold no private keys of deposit addresses; connections are encrypted (HTTPS). No system is perfectly secure, and we cannot guarantee absolute security.
7. Cookies and local storage
We do not use cookies. The website stores in your browser only what it needs to work: your sign-in session, the chosen language and theme. The installed web app (PWA) stores static files to start faster; it never stores prices or balances offline.
8. Your rights
Depending on where you live, you can ask us to give you access to your data, correct it, delete it, restrict or stop its processing, or give it to you in a portable form (you can already export your trade history as PDF or CSV in the app). You can also complain to your data protection authority. To use these rights, write to the contact details published by the operator. We may need to confirm that the request comes from you, and we may keep the data we are required to keep by law. An account with a balance can be deleted after the balance is withdrawn.
9. Children
The Service is not for people under 18, and we do not knowingly process their data.
10. Changes
We may update this Policy. The date of the current version is at the top of the page; for material changes we will ask you to review and accept the new version.