Terms of Service

All services sold by xrpl.to are non-refundable, including Boosts, API subscriptions, token launches and any other paid feature.

Trades on the XRP Ledger DEX cannot be undone. No central authority can reverse, cancel or change a transaction.

xrpl.to is a trading interface and data aggregator for the XRP Ledger. Every trade happens directly on the XRP Ledger DEX; xrpl.to provides the interface and does not control the ledger. The web wallet is self-custody: xrpl.to never holds its funds or trades for you.

The Telegram bot’s wallet is self-custody: you can export its seed at any time, and the bot trades on your instructions. The wallets a token launch or presale creates do hold XRP, until that launch completes.

• You are responsible for your trading decisions and their outcomes.
• You are responsible for securing your wallet and seed.
• xrpl.to is not liable for losses from trades, market conditions or user error.
• A token being listed is not an endorsement. Do your own research.

Kobbi is xrpl.to’s self-custody wallet app for iPhone and Android, also at mobile.xrpl.to. Using it means you agree to these terms. Its keys stay on your phone: xrpl.to cannot move, freeze or recover your funds, and cannot reverse a transaction you signed.

Tokens and NFTs, their names, images and descriptions, and the memos on transactions are made by other people on the XRP Ledger. xrpl.to makes no representations about them. Check a token’s issuer before you trade: an issuer can freeze its token, and a token can be worthless.

• Do not use Kobbi to send spam or unwanted tokens or NFTs, to defraud or phish anyone, or to create or display illegal, hateful or self-harm content.
• Kobbi refuses to sign anything that involves an account on xrpl.to’s scam list, and hides memos from those accounts. Settings → Account settings can refuse NFT offers, checks, trust lines and payments from others.
• Report an account, token or NFT to hello@xrpl.to (in the app: Settings → Contact).
• Kobbi does not run on a rooted or jailbroken phone.

<a href="https://xrpl.to" target="_blank" rel="noopener">Data by xrpl.to</a>

• Redistribution needs permission. Storing our data and serving it again from your own API, dataset or public dashboard needs written permission first. Email us — the answer is usually yes.
• Indexers and aggregators: use the paginated list endpoints instead of fetching one item at a time, cache what you fetch, and honour Retry-After on a 429. A repeated 429 means back off, not retry. Get a key instead of running without one, so we can raise your limits instead of blocking you.
• Partner tier: 100 req/sec, 20M credits a month and direct support, free and by invitation, for integrations that credit us properly. Apply from the dashboard, email hello@xrpl.to or DM @xrplto.

We may suspend or revoke access to any service — API keys, platform features or accounts — if usage breaks these terms or puts the platform at risk. Questions? Email us or DM @xrplto.

Access to xrpl.to and its API is granted on the condition that you do none of the following. Doing any of them is unauthorised access: we will revoke keys, block traffic, and pursue it where the harm warrants it.

• Denial of service: flooding, deliberately exhausting rate limits or credits, or any traffic meant to degrade the platform for others.
• Exploiting a vulnerability: using something you found to reach, take or change data, accounts or funds that are not yours. Testing for one is welcome — see Reporting a vulnerability below. Found something? Report it, do not exploit it.
• Getting around controls: evading rate limits, authentication or the API key system; rotating IPs, keys or user agents to beat a limit; using a key issued to someone else.
• Creating accounts or keys automatically, or getting access under false pretences.
• Reselling or sublicensing API access without written permission.
• Interfering with other users: hijacking sessions or accounts, obtaining someone else's API key, or phishing wallet credentials through this site. Seeds are encrypted in each user's own browser and never reach our servers; trying to extract one from a user's device is prohibited all the same.

Pentesting is encouraged: probe, scan and test xrpl.to and its API as hard as you like. Tell us what you find privately at hello@xrpl.to before disclosing it anywhere else, and give us reasonable time to fix it. Good-faith research reported this way is welcome and we will not pursue it. Contact details: /.well-known/security.txt.