Privacy Policy

1. Non-Custodial by Design

Trustfy is non-custodial. We do not hold your cryptocurrency, your private keys, or your fiat payments. Your USDT is locked in smart contracts on BNB Smart Chain that only you can authorize. We cannot access, freeze, or transfer your funds. This privacy policy describes the minimal data we do process to operate the Service.

2. Data We Collect

We collect only what is necessary to operate the marketplace:

• Wallet address: Your public EVM address when you connect a wallet and sign in with Ethereum (SIWE).
• Display name: An optional username you choose during onboarding.
• Trade data: Offer details, trade statuses, and dispute evidence you submit.
• Telegram username: Optional, if you link your Telegram account.
• Usage analytics: Aggregated, anonymized metrics to improve the Service.

We do not collect personal identity information (legal name, government ID, physical address) unless required by applicable law or an optional compliance service you choose to use. Your wallet address functions as your identity on Trustfy.

3. What We Do Not Collect

We do not collect or store your private keys, seed phrases, or wallet passwords. We do not require KYC documentation for basic trading. We do not access your banking information — fiat payments are sent directly between traders outside our platform. We do not sell your data to third parties.

4. On-Chain Data

All smart-contract transactions on BNB Smart Chain are public and immutable. Trade details, escrow locks, releases, and dispute rulings are recorded on-chain and visible to anyone. This is a feature of decentralized trading, not a privacy breach. We cannot delete or modify on-chain data.

5. SIWE Authentication

We use Sign-In with Ethereum (SIWE) for authentication. When you sign in, you sign a gas-free message with your wallet. We verify the signature using ecrecover and issue a 24-hour session token (an HMAC-SHA256 of your address). The session token is stored in your browser's localStorage and sent in a header on subsequent API calls. We never see your private key.

6. Data Retention

We retain off-chain data (display names, dispute evidence, notifications) for as long as your account is active. You may request deletion of your off-chain data at any time — run /deletedata in our Telegram bot and confirm, and we delete your saved profile info, payment methods, notifications, evidence, and chat messages right away. Evidence or chat tied to a dispute that's still open is kept until that dispute resolves, so it isn't lost mid-review — simply run the command again afterward to finish. Your wallet address and trade history are retained separately, since counterparties rely on an accurate shared record of who they traded with. On-chain data is permanent and cannot be deleted by anyone, including us.

7. Data Security

We use industry-standard security measures: HTTPS encryption in transit, HMAC-signed session tokens, timing-safe nonce comparison, and rate limiting. Smart-contract escrow ensures funds are protected by code, not by trust in us. We have undergone internal security review of the escrow contract.

8. Your Rights

You have the right to know what data we hold about you, request a copy, request correction, or request deletion of off-chain data. Run /deletedata in our Telegram bot to request deletion, or message us there for anything else. Note that on-chain data cannot be modified or deleted.

9. Children's Privacy

Trustfy is not available to individuals under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has used the Service, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in the app and via Telegram. Continued use of the Service after changes constitutes acceptance of the updated policy.