What the app never collects
There is no account, so there is no email, phone number, name, address or document to hand over — not at signup, because there is no signup. The swap interface does not take custody, so it does not need an identity to give you a balance back. Your wallet address is what the app talks to, and it is a pseudonymous string, not a person.
That is the whole claim, and it is deliberately narrow. It means: this service cannot leak an identity record it never had, and cannot hand one to anyone who asks for it.
What the chain still shows
Everything. Every balance, every transfer, every swap — permanently, publicly, to anyone with the address. A blockchain is an append-only public ledger; “non-custodial” and “no account” change nothing about that.
Worse, it is correlatable. Send funds from an address that was funded by a KYC exchange and the link exists on-chain forever, whether or not any single service knows your name. Analysis firms build exactly this graph, and it only gets easier to build over time.
What leaks outside the chain
The endpoint that answers your requests sees your IP address. Public RPC nodes are run by someone; a wallet connection can reveal an address to the site you connect to. Both are metadata, both are outside the ledger, and both are often enough to connect an address to a network location.
The practical consequence: privacy here is about what you decide to link together, not about a checkbox. Using a wallet that has never touched a KYC’d exchange, connected from a connection you are comfortable with, is a different posture from reusing your main address — and no interface can make that decision for you.
What “no KYC” does not mean
It does not mean sanctions or embargo rules stop applying to you, and it is not a promise that a transaction will be accepted by any particular counterparty. A decentralised pool does not ask who you are, but the chain, the token issuer, and any centralised party you later interact with still have their own rules — and a permissioned token can block a transfer regardless of who is signing.
It also does not mean the app is anonymous software. The company behind it is named in the footer of every page, and the transaction hashes are on public explorers. The claim is narrow because a wide claim would be false.
Practical hygiene, in order of effect
Use an address that has never been funded from a KYC’d venue. Keep a separate address for anything you would not want linked to the rest. Check what you are approving before you sign, since an unlimited approval is a bigger privacy and security event than any of the above. And prefer your own RPC endpoint when you have one — it is the single largest metadata improvement available to you.
None of this makes you invisible. It makes you harder to casually correlate, which is the realistic goal.