What we keep, and what we never ask for.
Here is what happens to your information, where it goes, and what someone would find if they broke in.
We never ask who you are
Most of what leaks in a crypto breach is identity: passport scans, selfies, home addresses, dates of birth. Companies collect that pile to satisfy a check, then keep it forever. We never ask for any of it, so there is no pile to lose.
There is no admin screen where your ID appears, because nothing in the system ever writes one.
We never hold your coins
Coins go from our reserve straight to the address you gave us. There is no balance with your name on it and no wallet holding customer funds, so there is nothing here for anyone to drain.
Card numbers never reach us
You type your card into a field our payment partner serves, and the number goes to them. We see the brand, the last four digits, the expiry, and whether the payment went through.
What we do keep
An email address, your order history, and the addresses you have sent coins to. If someone got into our database, that is what they would take.
- Passwords are hashed with a memory-hard algorithm and never stored in a readable form
- Sessions are HTTP-only, Secure cookies, not tokens sitting in browser storage
- API keys are stored as hashes; the secret is shown once and never again
- Everything travels over TLS, with no plaintext fallback
What is on you
The destination address, every time. Sending to the right address on the wrong network is the most common way people lose crypto, and nobody can reverse it, so the confirmation screen names the network in full.
Use a wallet you hold the keys to. If a wallet will not show you a recovery phrase, you do not control it.
Reporting a vulnerability
Email security@phantomramp.com with enough detail to reproduce it. We will confirm we got it, tell you when it is fixed, and we will not come after anyone who reports something in good faith.
See also the privacy policy for what we keep and for how long, and the disclosures for the risks we cannot remove.