TrustSwap

A brand-new no-account, no-KYC instant swap — domain registered 2026-06-07, only 9 days before this listing went up — with a privacy policy that's specific and well-written above the category bar (24-hour transaction-log auto-deletion, no IP collection, no device fingerprinting, no analytics cookies). Listed at Grade C because the directory's [[tenure-in-grading]] rule defaults new operators in high-loss-asymmetric categories to C regardless of publishable-surface quality, and TrustSwap clears the new-operator bar from the wrong side. The privacy posture keeps it from dropping below C; an anonymous operator, no jurisdiction disclosed, a brand-name collision with the well-known DeFi launchpad TrustSwap Inc., and zero Monero-community track record keep it from climbing toward B.

What it is. A privacy-positioned instant crypto swap supporting BTC, ETH, XMR, ZEC, SOL, LTC, USDT, XRP, and 2000+ other assets per the operator's homepage. Purchase flow is no-account, no-email — pick a pair, paste your destination address, send the deposit, receive the swap. Listed at Grade C because tenure is the primary signal we don't have: 9 days of operating history is not enough to know whether the service delivers consistently or vanishes.

Background. TrustSwap runs at `trustswap.io` as a conventional multi-page web app (not a JS SPA), with published `/about`, `/privacy-policy`, `/faq`, and `/support` pages. Operator's prior brand: the same project ran as `nokycswap.org` from 2026-05-14 until pivoting to `trustswap.io` on 2026-06-07 (24-day rebrand cycle). The original URL now 301-redirects to TrustSwap; the operator's X account `@TrustSwap_io` published its first posts on 2026-06-07 promoting NOKycSwap.org rather than the new name. Domain registration per `.io` RDAP: 2026-06-07, expiring 2027-06-07 (one-year registration, minimum tier — operators committing long-term typically register for two or more years). No founding date, founder identity, company entity, jurisdiction, or physical location appears anywhere on the site — the marketing surface is polished and multi-language but the operator stays fully behind it. External presence: support email, X account, Telegram channel (all on `/support`). Single peer-directory match on monerica.com — the listing surfaces via search, not as a dedicated card; possibly an operator self-listing given how new the service is. Not yet listed on kycnot. Zero Monero community footprint (no Reddit, Bitcointalk, monero.town, or Matrix threads discussing the service — including absence in the kind of "anyone tried this?" threads a real launch tends to produce). The brand name collides with TrustSwap Inc., an established DeFi launchpad project — searching the name returns results about the unrelated company rather than this exchange, which makes independent reputation-checking unusually hard.

What you trust.

• Privacy policy is specific, not generic. Names both what IS collected (transaction data — wallet addresses, amounts, blockchain identifiers — retained for 24 hours then auto-deleted) and what ISN'T (IP address, device type, browser info, no analytics, no tracking cookies, no third-party data sharing). That level of clarity is rare in this category and is the strongest single signal on the listing.
• No account, no email required for swaps. The standard swap path is anonymous end-to-end. An optional account is offered for users who want order history; nobody who just wants to swap touches it.
• Non-custodial by design — operator-published copy says "funds never sit on our platform; rates and fees are shown before you confirm." The instant-swap model means funds pass through during the swap rather than being held in a balance account.
• Auto-refund on failure. FAQ promises automatic return of funds to the sender's address if a swap can't complete — reduces support-channel dependency for the failure mode that bites users hardest.
• Broad coin coverage including XMR as a first-class pair. 2000+ assets is operator-claimed; XMR is in the headline list alongside BTC / ETH / SOL.
• SimpleX as a published contact channel — alongside email, X, and Telegram, TrustSwap publishes a SimpleX address (`smp12.simplex.im/a#…`) for private support. SimpleX is among the strongest privacy-respecting messaging protocols (no central identifiers, no phone number, ephemeral queue addresses). Offering it as a first-class support channel signals the team understands the privacy stack, not just the marketing copy. *Caveat:* this is a posture signal at launch, not a track-record signal — see Caveats.

Operational specs.

• Site. https://trustswap.io — multi-page web app; key pages render server-side and are readable without JavaScript.
• Domain. Registered 2026-06-07 (one-year registration via Identity Digital RDAP).
• Pricing. No standalone fee schedule. Homepage offers both float and fixed rate modes; the exact fee model (percentage / spread / hybrid) is discoverable at swap time, not in advance.
• Coin coverage. 2000+ assets claimed; headline pairs BTC, ETH, XMR, ZEC, SOL, LTC, USDT, XRP.
• Account model. No registration required for swaps. Optional account available with email if a user wants order history.
• Tor mirror. None advertised. No `Onion-Location` header.
• Privacy posture. 24-hour transaction-log auto-deletion. No IP, device, browser fingerprint, or analytics collection (operator-published).
• Channels. Service support `support@trustswap.io` + PR `pr@trustswap.io` (two distinct addresses), X `@TrustSwap_io`, Telegram `@TrustSwap_io` (channel + support flow), SimpleX `smp12.simplex.im/a#ePM9_NtG…` for private messaging. No Matrix, Signal, or published PGP key. 10-language site (en/ru/es/zh/vi/de/fr/pt/ko/ja).
• Jurisdiction. Not disclosed.
• External listings. monerica (via search). Not on kycnot, orangefren, or other tracked peer directories at last check.

Operator philosophy. The marketing copy positions TrustSwap as a privacy-first instant exchange: *"our mission is to make anonymous crypto exchange practical, secure, and accessible — tools that put privacy and control back in your hands."* The privacy policy itself reads as the strongest evidence the team understands the threat model — the document names specific data it doesn't collect (a posture that's harder to fake than a generic "we respect your privacy" statement). The gap between that documentation and the rest of the surface — 9-day-old domain, anonymous team, one-year-minimum registration, no Tor mirror, no audited reserves, no engagement with the Monero community despite supporting XMR — is what holds the grade at C. A polished privacy policy at launch is necessary but not sufficient for the directory's B tier; tenure has to accumulate before the policy means anything operationally.

Grade rationale. Listed at Grade C primarily because operator tenure is 9 days. The directory's tenure-in-grading rule defaults exchanges in high-loss-asymmetric categories to C regardless of how clean the publishable surface looks; TrustSwap is a textbook example of why that rule exists — the privacy policy quality is genuinely above average for the category, but a 9-day-old swap service hasn't had time to demonstrate any of the things that distinguish a C from a B: consistent delivery under load, response to disputes, behaviour during a chain reorg, response to a regulatory inquiry. C is what we list new operators at; the privacy policy keeps it from dropping below. Other factors holding it at C even after tenure accumulates: (1) operator is fully anonymous with no entity, founder, or jurisdiction; (2) only one peer-directory match (monerica via search — possibly an operator self-listing); (3) brand-name collision with TrustSwap Inc. (DeFi launchpad) makes independent sentiment-checking nearly impossible; (4) zero Monero community footprint despite advertising XMR pairs; (5) no Tor mirror. Path to B: accumulate 12+ months of clean operating history, complete an in-house test swap on an XMR pair, get listed on kycnot (or another second peer directory) as a dedicated card, accumulate at least one organic Monero-community thread, and either publish operator identity / jurisdiction or ship a Tor mirror.

Useful when.

• You want a no-account, no-KYC swap with XMR support and you're comfortable being an early customer of a brand-new operator.
• You're comparing swap services on policy specificity. TrustSwap names specific non-collected data (device, browser, IP) rather than handwaving — useful as a privacy-policy benchmark even if you don't transact with them.
• You want auto-refund on swap failure rather than support-dependent recovery.
• You're swapping at sizes where new-operator risk is acceptable and the privacy posture matters more than track record.

Caveats.

• Extreme newcomer — domain registered 2026-06-07 (9 days before this listing). No operating history to evaluate. The directory's tenure rule defaults new operators in this category to Grade C regardless of how good the documentation looks; TrustSwap clears that bar from the wrong side.
• Renamed from `nokycswap.org` to `trustswap.io` on 2026-06-07 (24 days after original launch). A descriptive name like "nokycswap" creates real operational drag — registrar takedown risk, payment-processor refusals, search-engine flagging — so a rename to a cleaner TLD inside the first month reads as pragmatic operational hardening, not brand instability. The original URL still 301-redirects to the new one and the operator's X account openly posted under both names, both signs that they're not trying to obscure the history. Noted here for transparency rather than as a red flag; downstream caveats below apply to the operator regardless of which name they fly under.
• The astroturf-pattern cryptwerk reviews predate the `trustswap.io` domain by 17 days. All three reviews are dated 2026-05-21 — at a point when only `nokycswap.org` existed (registered 2026-05-14; `trustswap.io` not until 2026-06-07). The reviews were therefore written about the operator's prior brand and migrated to the TrustSwap cryptwerk listing post-rebrand. Combined with the same-day posting pattern, this is the second reason to treat the cryptwerk score as a marketing artefact rather than an organic signal.
• Privacy policy timestamp predates the domain registration. The policy claims "last updated 2026-06-02" but the domain was registered 2026-06-07 — five days later. Either the policy was lifted from somewhere pre-existing (borrowed boilerplate from another service) or the timestamp is backdated. Either way the document's origin is ambiguous and worth verifying before relying on its claims.
• Domain registered for one year minimum. Operators planning a long-term run typically register for two or more years up front. A one-year registration on a new service is a short-runway signal.
• Anonymous operator, no jurisdiction. Polished site, well-written policy, but no entity, founder, team, or physical location published. If a swap goes wrong, recourse is the support channels only — no named party to escalate to.
• Brand-name collision with TrustSwap Inc. (DeFi launchpad). Searching the name returns results about the unrelated DeFi project; you can't independently verify reviews or complaints via the usual web search.
• No track record in the Monero community. No Reddit, Bitcointalk, monero.town, or Matrix discussion — the operator advertises XMR support but hasn't engaged with the community that would normally test, audit, and amplify a privacy-focused swap.
• FAQ is incomplete. Several FAQ questions render with empty answer fields. Skeleton-stage documentation.
• No published fee schedule. Rates are quoted at swap time; the actual fee model isn't documented in advance.
• No Tor mirror. Clearnet-only.
• Single peer-directory match — possibly self-listed. Only one external listing (monerica via search). For a 9-day-old service, that's thin triangulation and may reflect the operator's own outreach rather than community discovery.
• Tawk.to live-chat widget loads from `embed.tawk.to`. Third-party customer-support widget present on `/support` (and likely site-wide). Tawk.to sets cookies and runs a JS payload from `embed.tawk.to` — a third-party domain. The privacy policy claims "no analytics, no tracking cookies, no third-party data sharing" — the Tawk integration is in tension with that posture. Either the policy needs to acknowledge the widget, or the widget should be removed or replaced with a self-hosted chat tool. Worth raising with the operator before relying on the policy at face value.
• No proof-of-reserves or audit. Not unusual for instant-swap services but worth surfacing — the non-custodial claim is structural rather than externally verified.