Privacy policy

Data is processed by ТОО «KORE FINANCE», Astana, Kazakhstan.

What we store

• exchange data: assets and networks, amounts, the payout address, the refund address if you gave one, the memo, status and timestamps;
• your email - only if you created an account;
• saved addresses - only the ones you chose to keep in your account: the name, coin, network, address and memo. Delete them in your account under "Addresses";
• support conversations: the subject and the message text;
• the provider's responses about your exchange - encrypted;
• your IP address - to rate-limit requests and keep bots out. For that it is kept as a request counter and is not tied to your exchange;
• the IP address and browser User-Agent an exchange was created from, and your acceptance of the exchange rules and the AML, KYC and KYT policy with their versions. They are recorded with the exchange to show on what terms and from where it was created. Only the service can read them; they are not shown in your account or in the operator console.

Cookies

Without asking, only the ones the site cannot work without. There is no analytics or advertising cookie.

Language (core_locale) - one year. Sign-in session - until you sign out.

Theme (core_theme) - one year, only if you picked the light or dark theme yourself. It holds only that choice; without it the site follows your device setting.

Time zone (core_tz) - one year. Your browser sets it, not the server: some executors require a time zone alongside the request, and without this cookie they simply do not take part in the comparison. The zone travels nowhere except that request.

Account recovery (core_recovery_grant) - 15 minutes, and only while you are following a recovery link from an email. It proves the email was opened by you, and expires on its own.

Partner tag (core_ref) - 30 days, only if you arrived through a partner link and agreed to it. If you arrived from the BestChange exchange monitor, it has no end date: the tag is set for 400 days, the longest browsers keep one, and set again on every visit. It holds the partner's code so the exchange can be credited to them, is unreadable to page scripts, and contains nothing about you. Without consent the tag is not stored: an exchange started from the same link during this visit is still credited to the partner, a later one is not.

Your choice (core_consent) - six months. It holds only the answer about the partner tag, no identifier. Change or withdraw consent under "Cookie settings" in the site footer: withdrawing deletes the tag, exchanges already created are not changed.

Addresses saved "only on this device" are not cookies: they sit in your browser's storage and are not stored on our server. Delete them in your account or by clearing site data.

Any of them can be deleted in your browser: the site keeps working, it will just detect your language and zone again, and the partner tag will be gone.

What we do not do

• we run no analytics and no trackers: there is no Google Analytics, no Metrika, no pixels, nothing of the kind on this site;
• we do not verify identity (KYC) and do not ask you for documents;
• we do not sell or share your data for advertising.

Who we share with, and why

• the exchange provider - what it needs to execute: the pair, the amount, the payout and refund addresses. Some providers also receive the IP address, User-Agent and time zone the exchange is created from, where their terms require it;
• the contractors that keep the service running: hosting, the database and account sign-in, email delivery, bot protection on forms. They process data only on our instructions and only for those tasks;
• the messenger our operator receives service alerts in: exchange and ticket identifiers only, never your messages, amounts or addresses;
• government authorities - only where the law or an official request requires it; we do not disclose data on our own initiative.

An account is optional

Exchanging works without registration. Without an account we do not have your email, and the exchange's own link is the only access to it - keep it and do not pass it to anyone.

Protection

Provider secrets and raw provider responses are stored encrypted. Exchange data is not readable directly by anonymous or ordinary signed-in users; access belongs to the service and the operator.

We never ask for a seed phrase or a private key. Neither we nor the provider needs them.

Retention

We keep exchange data, including the IP address and User-Agent it was created from, for at least five years after the exchange is completed: the rules of exchange monitors and record-keeping require it. Accounts and conversations are kept while the account exists.

Your rights

You can ask what data we hold about you and ask us to correct or delete it, where that does not conflict with our record-keeping duties. Write to business@co-re.kz - you do not need an exchange for this.