uSwap

Policy caveat (2026-08-12). Three of uSwap's public policy pages were updated in a single week (last observed 2026-08-09 via our weekly monitor). Each is worth naming for the reader, but on the counterfactual — *"would we have graded C day-one if these disclosures had been visible from the start?"* — the answer is yes; nothing here changes the base posture. The Grade C holds.

• /fees replaced the previous *"no hidden spread, all-inclusive 0%"* claim with *"0% platform fee on eligible standard routes"* plus a new itemized breakdown of provider spread + network cost + market drift. This is an honesty improvement — the earlier language was overselling the "0%" — and it puts uSwap's fee shape in line with every other instant-swap engine in the directory.
• /terms added *"as is / as available"* limitations and language that refunds are not guaranteed by accessible status pages. Standard crypto-ToS boilerplate; comparable to what most swap engines carry.
• /privacy introduced PostHog analytics with automatic interaction capture, persistent identifiers, and session-replay recording, plus weaker retention promises (no explicit deletion timeline). This is the one item that genuinely narrows the privacy story — PostHog session-replay records the user's on-page interactions. Worth being aware of; consider Tor Browser or a privacy-hardened profile if this matters to you.

Product — swap + spend, both real. Crypto→crypto swaps (dedicated `/swap/btc-to-xmr` route; XMR is called out as "the most-requested cross-chain pair by a wide margin" in the site's own docs). Spend surface (~400-brand catalog of gift cards, top-up for Telegram Premium / Discord Nitro / Mullvad VPN, prepaid Visa cards) — verified as real product pages, not marketing footnote.

Custodial routing during the swap window. The site uses "non-custodial" language in some marketing copy, but the actual mechanics are custodial: funds land at a deposit address controlled by the operator, are routed through providers, and the destination lands at the user wallet. Refund flow is refund-to-sender (three-button model: market-replace / hold / refund to originating address), plus sanctions-screening with refund on flag. Any service that holds your funds during the swap window is functionally custodial, whatever the marketing wording. This is the same shape as ChangeNOW / SimpleSwap and most instant swaps — not a red flag on its own, but worth reading honestly rather than through the marketing copy.

Legal surface. `/terms`, `/privacy` (dated 2026-06-14), `/contact` all HTTP 200. Support: `support@uswap.net`; Telegram `@slither` on `/contact`, but the homepage lists `t.me/maintenance` — handle inconsistency worth naming. Missing: `/faq`, `/about`, `/pricing`, `/affiliate`, `/canary`, `/pgp`. Neither Terms nor Privacy names a legal entity or jurisdiction.

Open source signal. GitHub org `uSwapExchange` exists with two repos (`zero` Go frontend, `browser-extension` TS; MIT-licensed; recent commits June-July 2026; 14 stars). Domain verifies to `uswap.net`. Small footprint but a real open-source surface.

Tenure — read carefully. The `uswap.net` domain was first registered ~2001, but the current uSwap-branded crypto-exchange product only appears in Wayback from 2026-04-10 (~3.5 months of visible current-brand history). Prior domain uses: unrelated content 2001–2017, dormant 2017–2021, STRATO parking 2021-12-29, GoDaddy / dan.com aftermarket listings 2024. This is a domain-aftermarket rebrand pattern. No aged-X-handle laundering is visible (X account age was rate-limited and could not be independently confirmed), so it is not in the same class as some known bad-actor patterns; but the effective product tenure is measured in months, not years. Blog first post May 2026.

Peer signal — mixed but no red flag. `kycnot.me` lists as Community Contributed (not team-reviewed) with 10/10 / privacy 98 / trust 91, "Guaranteed no KYC" — kycnot's own caveat that these are unverified. `monerica.com`: not listed. `orangefren.com`: not on their permanent-delist page. One Trustpilot review reports they *"followed all instructions, made no mistakes, never received my exchanged coin"*; operator responded claiming manual review of all deposits confirms delivery. One documented delivery-failure complaint, disputed.

Grade C — what it means here. Passes the auto-reject gauntlet (no peer-directory scam flags, kycnot neutral-positive, real first-class XMR, verified gift-card / Mullvad / Telegram Premium surfaces, real GitHub org). Doesn't lift because: (a) real product tenure ~3.5 months, (b) no operator identity / no jurisdiction / no PGP / no canary, (c) Telegram-handle inconsistency, (d) one disputed Trustpilot delivery-failure complaint. All C-appropriate caveats to name.

What would lift the grade. Six-to-twelve months of clean operating record; consistent operator response to any incident that surfaces on Trustpilot / OrangeFren / kycnot; a canary + PGP identity page; the Telegram-handle inconsistency resolved; an on-record post explaining the domain-aftermarket rebrand.

Useful when. You want a no-account swap with a broad coin bench and a genuinely interesting spend surface (gift cards, VPN top-ups, prepaid cards) at 0% platform fee. Do a small test swap first — standard hygiene for a Grade C exchange with unmeasurable operator identity.

Policy update (October 2026). uSwap's fees page no longer says you submit no ID to uSwap. It now says eligibility, verification requirements, limits and sanctions controls can vary by route, provider and destination, so some routes may ask for verification. uSwap has also added virtual cards through a third-party provider; money loaded onto a card can't be assumed to be withdrawable or convertible back to crypto.