Privacy Policy

• Account data — email, name, username, hashed password, avatar.
• Transaction data — wallet balances, deposits, withdrawals, escrows, and their timestamps.
• Listing & messaging content — what you post and send on the platform (auto-moderated for scams).
• Technical data — IP address (rate limiting, fraud prevention), session tokens, browser type.

• We don't sell your data to anyone — ever.
• We don't store plaintext passwords (bcrypt) or plaintext escrow credentials (AES-256-GCM encrypted).
• We don't read your DMs except via automated scam-pattern moderation or during dispute review.
• We don't use third-party advertising or tracking pixels.

We share the minimum data necessary with these processors:

• NOWPayments — Crypto payment processing (wallet addresses, transaction amounts).
• Cloudinary — Image hosting (uploaded listing images only).
• SMTP provider — Email delivery (email addresses for transactional emails).
• Google OAuth — Authentication (email and profile name for login).

Each processor receives only the minimum data needed for its function. We do not share browsing behavior, messages, or financial history with any third party.

• Passwords are hashed with bcrypt (cost factor 12).
• Escrow credentials are encrypted with AES-256-GCM at rest.
• All connections use HTTPS/TLS.
• Session tokens are HttpOnly, Secure, and SameSite.
• Rate limiting and automated fraud detection on all sensitive endpoints.

• Financial records are retained as required by law for accounting and fraud prevention (minimum 5 years).
• You may request full account deletion at any time.
• Upon deletion, non-financial personal data is removed or anonymized within 30 days.
• Messages in completed disputes may be retained for legal compliance.

Depending on your jurisdiction, you may have the right to:

• Access — Request a copy of all personal data we hold about you.
• Rectification — Correct inaccurate personal data.
• Erasure — Request deletion of your account and associated data.
• Portability — Receive your data in a machine-readable format.
• Objection — Object to processing for specific purposes.

For privacy questions, data requests, or concerns:

• Email: [email protected]
• Use the contact form on our website

We respond to all data subject requests within 30 days.