Privacy policy

This page explains what this store keeps about you, why it keeps it and for how long. We keep as little as the store needs to work and to stay secure, and nothing for advertising.

1. What we store

Account data. Your email address, your username, your password (stored only as a one-way hash, never in plain text) and, if you turn it on, the secret of your two-factor authenticator. Your preferred language and theme.

Security data. When you log in, register or reset a password we record the time, your IP address and a short description of your browser and device. We use it to recognise the browsers you have used before, to challenge new ones and to limit repeated attempts. We do not build a profile from it.

Ledger data. Every top-up, every order and every refund is a row in a double-entry ledger. It records the amount in USDT, the time and the order or deposit it belongs to. For a top-up it also records the coin, the network, the address we gave you and the transaction we were paid with. The ledger is what your balance is calculated from, so it cannot be edited or deleted while your account exists.

Orders. The listing you bought, the quantity, the price and which accounts were assigned to the order. The credentials of those accounts are encrypted at rest and are decrypted only when you reveal them; each reveal is logged with its time.

Support. If you contact us, we keep the messages exchanged for as long as the issue is open and for a short period afterwards.

2. What we do not do

We do not run third-party analytics or advertising scripts. There are no tracking pixels and no social buttons on this site. We do not sell, rent or share your data with anyone for marketing.

We use cookies only for your session, your language and your theme, and for a small token that remembers a browser you asked us to remember.

3. Payment providers

Top-ups are processed by cryptocurrency payment providers. Depending on the coin you choose, the invoice is created with Atlos or NOWPayments. The provider sees the payment address, the amount and the transaction on the blockchain; it does not receive your email address or your username from us. Their own privacy policies apply to what they process.

4. How long we keep it

• Account data: for as long as your account exists.
• Security log entries: 12 months, then deleted.
• Ledger, orders and reveal log: for as long as your account exists, and afterwards for as long as we are required to keep financial records.
• Support messages: 6 months after the issue is closed.

When an account is closed, the account data is deleted or anonymised once the retention periods above have run out.

5. Your choices

You can change your email address, your password, your language and your two-factor settings yourself in your account. You can ask us to close your account and to tell you what we hold about you through the support contact. We answer within a reasonable time and may ask you to confirm that you are the account owner first.

6. Where the data lives

The store runs on servers we rent from a hosting provider. Data is encrypted in transit and the credential vault is encrypted at rest. Only the operators of the store have access to the administration panel, and every access to a customer's credentials is recorded.

7. Changes

If we change this policy, the date at the top of this page changes with it. Substantial changes are also announced on the announcements page.

8. Contact

For any question about your data, use the Telegram contact shown in your account settings and in the footer of every page.