Their sdk seems to make swaps through a REST client, indicating that there's a server component to this. That's also what I understood from the docs.

So what one ideally would need is the server code, to self-host, so that there won't be a thirdparty to subpoena for access logs. Otherwise you'd be sending JSON about your transactions (or, best case, timing-correlatable inquiries) to a potentially coercible entity.