but that exposes to more rug pulling risk when you have to wait longer.

also, if i understand it correctly, they can log the ip for the token they give you and they can log the ip whom the person who redeems the tokens to lightning.  so they dont know the amount but who transferred it to whom, correct?