A directory only matters if its judgement matters. This page documents how we grade, tag, accept, reject, and remove listings. It's terse on purpose so it stays honest.
| Grade | What it means | Examples |
|---|---|---|
| A | Strong privacy posture. Anonymous signup or audited no-logs. Operator track record. Active maintenance. | Mullvad · Proton Mail · Njalla |
| B | Good privacy posture with one trade-off — light email at signup, smaller server fleet, less-audited claims. | IVPN · Wasabi · Tutanota |
| C | Usable but compromised — KYC at the payment edge, fork that hasn't stabilized, narrow feature set. | Windscribe |
| D | Listed for completeness or comparison only. Heavy KYC, weak privacy claims, or unproven operator. | (rarely listed) |
| F | Reserved for providers we have evidence have stolen funds, leaked customer data, or knowingly cooperated with mass deanonymization. Listed only as warnings. | (currently empty) |
Free-combine labels that describe properties of the service. Used for the click-to-filter chips on category pages.
xmr.club
open_source · non_custodial · self_hosted · cli_supportedtor_mirror · i2p_mirror · xmr_native · lightning_nativeatomic_swap · audited · port_forwarding · ram_only_serverstransparent_fees · hidden_feesWe grade on transparency of fees, not on the absolute fee level. A 5% exchange that names the 5% upfront beats a 3% exchange that surfaces 1% in marketing and pockets the other 2% as silent spread.
transparent_fees — the quote shown before deposit equals what the user receives (minus destination-network fees, surfaced separately). No silent spread, no post-deposit slippage adjustment.hidden_fees — the visible quote understates what the provider keeps. Typical patterns: spread baked into the rate, withdrawal markup beyond actual network cost, partner slippage absorbed and not refunded. Fails the transparent_fees test and auto-caps grade at C.When a routing-style swap operator goes rogue, direct legal recourse is often impossible. Some operators post a guarantee with a peer directory (e.g. OrangeFren) — a pool of funds that pays users out if the operator misbehaves, up to a published amount.
data.guarantees.<peer>.{amount_usd, source_url}; available programmatically via /api/v1/guarantees.Casinos and prediction markets carry risks the rest of the directory doesn't: house-edge games can be rigged, and prediction-market resolutions can be disputed. We hold them to additional checks on top of the standard rubric.
/wagering/casinos)/wagering/prediction-markets)⚠ Gambling is restricted in some jurisdictions. Listing does not imply endorsement; verify your local law before participating.
last_verified. We re-test the signup + checkout flow on each entry at minimum once per year. Live status: /freshness.operating_since — the year the current operator has been continuously serving users. Operators with 5+ years (a full crypto cycle) get an implicit trust bump; fresh launches under 2 years are listed with extra caveats. Full ranking: /tenure.How an operator handles a bad day is a grade multiplier, not a tie-breaker. Custody-adjacent services (exchanges, mixers, wagering, prediction markets) sit on top of an implicit trust track that outlives any single incident, and readers extend or withdraw future benefit-of-the-doubt based on the shape of the last response, not the last uptime number. Two operator-behaviour axes carry material weight when the curator sets and moves grades.
The practical consequence: a service can hold a "flawed but honest" grade indefinitely if the response pattern is right, and a service with intact architecture can slide below its structural grade if the pattern is wrong. Grade lifts after an incident require both (a) the operational cause to be resolved AND (b) the operator response to have followed the transparency-plus-rapid-response shape. Neither alone is sufficient.
Reader-submitted reports of scam, denial-of-payout, or operator misconduct are a legitimate signal — some of the earliest exit scams get flagged by users hours before any structural evidence surfaces. But an unmoderated "anonymous report → automatic downgrade" pipeline is also an attack surface: a competitor can drop a $0 submission form and cost an operator a grade tier. This directory grades on evidence, not accusations. Four tiers govern how a report moves the grade.
The reader-facing consequence: a listing at Grade A can carry a Tier-1 note on its /audit page without the grade moving. Readers who want the raw signal see it; the grade doesn't get slot-machined by anyone with $0 and a spare minute. The trade-off is honest: we won't be the fastest to react to reader accusations, and we will occasionally be later than someone screenshot-quoting an anon complaint. That is the cost of a grade you can trust.
Spot a mistake? File via /submit or DM @xmrclub_bot. Every accepted correction lands in the public audit log with the reason. Disputes about grade or removal are documented; we don't quietly delete inconvenient context.
CURATOR-BUILT chip so the relationship is explicit. Same rubric applies — see /transparency./go/<slug>. They do not change a listing's grade or position.