Trade Router (`traderouter.ai`, `api.traderouter.ai`, the `@traderouter/trade-router-mcp` MCP server, and the `traderouter-mcp` PyPI package). Plain English, no tricks.
Effective date: 2026-04-25 · Last updated: 2026-04-25
The short version: We never see your private key. Trade Router is non-custodial — your key is read once from TRADEROUTER_PRIVATE_KEY by the MCP server, used for local signing, and never transmitted to us. We do see your wallet's public address (because that's how we route swaps for you), the token mints you trade, and the standard server logs that any HTTP API generates. That's it.
What we collect
From every API call
Your wallet's public address. Required to build swap transactions, look up holdings, and route orders. This is on-chain data — anyone with a Solana RPC can already see it.
Token mint addresses. The tokens you're swapping or querying.
Swap parameters. Amount, slippage, action (buy/sell), trigger type and value (for limit/trailing/TWAP/combo orders).
Standard HTTP request metadata. Source IP, user-agent, timestamp, request path. Generated automatically by our edge proxy and kept in operational logs.
From the WebSocket
Order state and lifecycle events. Required to orchestrate limit / trailing / TWAP / combo orders server-side. Stored as long as the order is active, plus a 30-day window after fill or cancellation for support and dispute resolution.
From the website (`traderouter.ai`)
Standard server access logs. IP, user-agent, page requested, timestamp.
No cookies set by us. No analytics fingerprinting. Cloudflare may set a security cookie (`__cf_bm`) for bot mitigation; that's their cookie, not ours.
What we deliberately don't collect
Private keys. Ever. The MCP server reads TRADEROUTER_PRIVATE_KEY once from the agent's environment, uses it for local signing, and never transmits it. Same for the PyPI version.
Names, emails of end-users. The API has no concept of accounts. Your wallet address is the only identity. The only email we have is whatever you choose to send to hello@traderouter.ai or security@traderouter.ai, and we treat that as a normal email thread, not a database entry.
Mnemonics, seed phrases, passwords. The MCP server never asks for them. If a website pretending to be us ever does, that's not us.
Browser-side fingerprinting, ad-tech identifiers, tracking pixels. None on traderouter.ai.
Cross-site behavioral data. We don't have any.
Third parties we share data with (and why)
To execute swaps and orders we have to talk to the chain and to MEV-protected relay infrastructure. Specifically:
Jito Labs. Every swap goes through Jito bundles via POST /protect for MEV protection. Jito sees the signed transaction (which includes your wallet address as a signer). They do not see your private key — the transaction was already signed locally before it reaches them.
Solana RPC providers. For balance reads and transaction confirmation, we relay calls to public Solana RPC endpoints. By default that's api.mainnet-beta.solana.com; you can override it with SOLANA_RPC_URL.
The DEXes we route through. Raydium, PumpSwap, Orca, Meteora. Routing decisions are made server-side; the on-chain swap interaction with each DEX is what shows up in your wallet's transaction history.
Cloudflare. Edge / CDN provider for traderouter.ai. Sees standard request metadata for the marketing site and docs. Does not proxy `api.traderouter.ai` calls in the same way.
We do not sell, rent, or otherwise share your data with marketing partners, ad networks, or data brokers. We have not sold any data to any third party at any time.
How long we keep things
Operational HTTP logs: 30 days, then deleted.
WebSocket order lifecycle data: while the order is active + 30 days after the order completes or expires, then deleted.
Email correspondence: kept until the thread is resolved + a reasonable archival window (typically 12 months) for follow-up.
Aggregated, non-identifying analytics (e.g., total swap volume by DEX): kept indefinitely.
How we secure what we do collect
TLS everywhere. All traffic to api.traderouter.ai and traderouter.ai is HTTPS.
Server-message Ed25519 verification. The MCP server verifies every order_filled / order_created / twap_execution message against a baked-in trust anchor. So even if our server is compromised, an attacker cannot inject false fills into your agent without breaking the cryptographic signature.
Detailed threat model. Published openly at SECURITY.md with our data-flow diagram, permissions manifest, and explicit "what we don't validate" notes.
Source code is open. The MCP server is a single ~85 KB .mjs file you can read end-to-end: trade-router-mcp.mjs. Review it before trusting it.
Because the API is non-custodial and identity-less (wallet address is the identity), most "right to access / right to delete / right to portability" requests apply to a single object: the operational logs tied to your wallet address.
Right to know. Email hello@traderouter.ai from any address with your wallet address and we'll tell you what we have on it.
Right to delete. Same email. We'll wipe operational logs tied to that wallet address within 30 days, subject to retention requirements for active orders.
Right to opt out of automated processing. Stop using the API. There is no account to delete and no recurring processing once you stop calling us.
We do not sell personal data, so there's nothing to opt out of on the sale-of-data side.
Children
Trade Router is a developer infrastructure product. It is not intended for use by anyone under 18, and we do not knowingly collect data from children. If you believe a minor has used the service, contact hello@traderouter.ai and we'll investigate and delete as appropriate.
Changes to this policy
If we change this policy in a way that materially expands what we collect or who we share it with, we'll update the "Last updated" date at the top, and the change will be visible in the public git history of traderouter.ai's repo. We'll also post a note on @trade_router on X for any expansion.