Privacy Policy

Version dated [Month DD, YYYY]. Applies to the web version (PWA) and the Telegram Mini App.

This Privacy Policy explains what data the Marketplace service (the "Service", "we") collects when you use the platform for posting listings and advertising materials, how we use it, with whom we share it, and what rights you have. By using the Service, you agree to the terms of this Policy.

The Service is operated by [Company legal name], [Registered address] (the "Operator"). For any questions regarding data processing, contact us at support@example.com.

1. Data we collect

The data collected depends on your sign-in method and the features you use:

• Telegram data — Telegram ID, username, display name, and profile photo when signing in via Telegram (if this sign-in method is available).
• Email address — when signing in or linking your account by email, and to deliver service messages (verification codes, notifications).
• Profile — display name, "about" description, avatar, and referral code.
• User content — listings, uploaded images, reviews and replies, and advertising requests (including the contact email provided in a request).
• Messages — conversations in the in-app chat (in the web version and in the Telegram Mini App).
• Internal units — your balance of the Service's internal units and the history of operations with them (a technical record of access to features).
• Payment data — for cryptocurrency payments: the payer's wallet address, amount, currency and transaction hash; for payments through a payment provider, payment information is processed by the provider. We do not store bank card details.
• Wallets — addresses of cryptocurrency wallets you link to your account for Safe Deal. We do not request or store wallet keys or recovery phrases.
• Wallet check (AML) — before a cryptocurrency payment, the payer's wallet address is checked by an independent service. We keep only the result of the check (passed or not), its date and an irreversible fingerprint of the address — the address cannot be recovered from it, but a repeated check of the same wallet within a day does not require a new request to the service; the wallet address itself is deleted once the invoice or deal is closed.
• Safe Deal — terms, price, periods, the parties' wallet addresses and the course of the deal, as well as evidence the parties attach to a dispute (files, links, explanations).
• Technical data — IP address, device and browser type, session identifiers, local storage and cookie data required for the application to function.

2. How we use data

• authentication and maintaining your session;
• publishing and displaying listings and advertising materials, and letting you manage them in your account;
• operating the in-app chat and the review system;
• tracking access to features through internal units and processing top-ups;
• sending service emails (sign-in codes, service notifications);
• ensuring security, preventing abuse, and moderating content;
• running the referral program;
• accepting cryptocurrency payments and checking the payer's wallet (AML) to protect against funds of illegal origin;
• operating Safe Deal and dispute review by an arbiter;
• the public Safe Deal history of a seller.

3. Who we share data with

We do not sell your data. We share it only with processors that enable the Service to operate, and only to the extent necessary:

• Telegram — the platform through which the Mini App runs and sign-in is performed.
• Cloud infrastructure and database provider — storage of account data, listings, images, and messages, as well as server-side authorization.
• Email delivery provider — sending service emails and verification codes.
• Payment provider (if connected) — processing top-ups of access to features.
• Wallet check (AML) service — MistTrack (SlowMist): receives only the wallet address to be checked.
• Blockchain networks (TON, TRON and others) — cryptocurrency transfers and Safe Deal actions are recorded on a public blockchain. Wallets are connected via the TON Connect protocol, a TRON wallet (TronLink and compatible wallets) or WalletConnect; we have no access to your funds or keys. When WalletConnect is used, requests to the wallet pass through the WalletConnect (Reown) server.
• Cryptocurrency rate services — we request only exchange rates from them; your data is not shared with them.
• Network and hosting provider (CDN) — delivering the website and protecting against unwanted traffic. To protect our forms from automated requests (bots) we use the Cloudflare Turnstile service, which may process technical data from your browser. Use of this service is governed by Cloudflare's Turnstile Privacy Addendum.

We may also disclose data where required by law, in response to a lawful request from authorized bodies.

4. Data retention

We retain data for as long as your account exists and for as long as necessary for the purposes described above, or for the period required by applicable law. After an account is deleted, the associated data is deleted or anonymized within up to 7 business days of a deletion request, except for information we are legally required to keep.

Specific periods:

• Chat messages and files are kept for 30 days after they are sent and are then deleted automatically; the chats themselves remain.
• Safe Deal data — terms, events, evidence and wallet check information — is deleted within 24 hours after the deal is completed. For paid deals a public record remains: the sequential number of the deal with that seller, the month and the outcome (no amounts, terms, buyer or wallets).
• Payment records (amount, currency, transaction hash, wallet check result) are kept for accounting; the payer's wallet address is deleted once the invoice is closed.
• Blockchain records are public and cannot be deleted by us or by you.

5. Internal units of the Service

Internal units are a technical means of recording access to the platform's features. They are not money, cannot be withdrawn, and are used only within the Service as prepayment for posting listings and advertising. The platform does not transfer funds between users and is not a party to transactions between them; all prices and terms are set by sellers independently. In a Safe Deal the funds are held by a smart contract for the duration of the deal (Appendix 1 to the Public Offer).

6. Cookies and local storage

We use cookies and browser local storage solely to keep the application working: maintaining your sign-in session, saving settings, and ensuring the web application (PWA) operates correctly. We do not use them to track users for advertising across third-party websites.

7. Your rights

• Access and correction — you can view and edit your profile data in your account.
• Content deletion — you can delete your own listings yourself within the application.
• Account and data deletion — send a request to support@example.com, and we will delete your account and associated data, including the seller's public deal history, within up to 7 business days. Ongoing Safe Deals must be completed first; blockchain records cannot be deleted.
• Sign out — in the full web version you can sign out of your account at any time.

8. Security

The connection to the Service is encrypted (HTTPS). Access to data on the server is restricted and handled through a secured server-side gateway; sensitive operations are verified server-side. Despite the measures we take, no method of transmitting data over the internet is completely secure.

9. Age requirements

The Service is intended for users who are at least 16 years old. By using the Service, you confirm that you are 16 or older. Paid services are available only to users who are at least 18 years old. Certain categories contain content intended for adults only (18+); access to such categories requires explicit confirmation that you are at least 18 years old, and they are not available to users under 18. Where applicable law requires parental or guardian consent for users below a certain age, such consent must be obtained before using the Service. We do not knowingly collect data from children in violation of applicable law.

10. Changes to this Policy

We may update this Policy from time to time. The current version is always available on this page; the effective date is shown at the top of the document.

11. Governing law

This Policy is governed by [the laws of your country / state]. Where the data protection law of your country of residence grants you additional rights, those rights apply.

12. Contact

For any questions related to the processing of personal data: support@example.com.