Privacy

We store a username, password hash, recovery-code hashes, session cookies, task and chat content, ledger entries, and deposit/withdrawal addresses. There is no email on the account. At signup we store a salted hash of the IP address: it only shows that two accounts came from the same place, and the address itself is not kept.

The session and language cookies keep the site working. Two more carry the campaign tag of the link you arrived from and a random browser id used to count visits; neither is tied to an account and no list of visitors is kept. Cloudflare Turnstile may process your IP to check that a request comes from a person.

Deal history, reviews and public reclaim marks are visible to other participants. Chat is visible to the client and the people on the task.

If you are banned, sessions are revoked. Attachment files may live on local disk or an object store you configure. Ask the operator for deletion where the law requires it.

P2P ads store the payment details you type (account numbers, phone numbers, handles). Counterparties see them after they take the ad. We keep them on the order after a cancel so support can reconstruct a dispute.

Administrators may enable a time-based one-time password (TOTP). The secret is stored encrypted. Recovery codes are hashed. There is no email on the account.

If Sentry or an operations webhook is configured, the worker may send error reports (stack traces, request paths). They are not used for advertising.