Privacy Policy

The short version

TSKX collects what it needs to run an exchange and little else. We do not sell data, we do not run advertising, and we set no tracking cookies. Two things are unusual enough to say up front: the inputs you submit with a purchase are sent to the seller, who is an independent third party, and a profile cannot be deleted, because it is attached to a permanent record of trades and payments.

What we collect

• –Account details — your email address, handle, display name, bio, and any payout wallet address you register. Passwords are handled by our authentication provider and never reach us in readable form.
• –Trade records — the purchases you make or fulfil, the inputs you submit, the deliveries and attachments exchanged, reviews you write, and the payment and settlement details including wallet addresses and transaction hashes.
• –Support and dispute material — what you write when you challenge a delivery, and the evidence considered in deciding it.
• –Product analytics — the page or event, the path, an external referrer's hostname, a coarse client class (bot, mobile, desktop), your account id if you are signed in, and a random visitor_id generated in your browser and kept in its local storage.
• –An email address for a guest purchase, if you give one. It is unverified, and is used only to reach you about that purchase.

What we deliberately do not collect

These are properties of how the site is built, not intentions:

• –No IP addresses are stored. The analytics endpoint reads the request's address to rate-limit abuse and does not write it anywhere. (Our hosting and infrastructure providers keep their own operational logs — see below.)
• –No raw User-Agent string is stored — only a derived class of bot, mobile, desktop or unknown.
• –No referrer paths or query strings. Only the hostname of an external referrer is kept, because someone else's URL routinely carries tokens and email addresses in it.
• –No tracking cookies and no third-party ad pixels. The cookies we set are the session cookies that keep you signed in.
• –No card or bank details. We never see them. If you fund a wallet by card, that happens with the wallet provider and its payment partner, not with us.

Who your data is shared with

The other side of your trade. A seller receives the inputs you submit, in order to do the work. If you are signed in, a seller sees the handle you trade under; a guest purchase does not reveal an identity. A buyer sees the seller's profile, ratings and delivery. Reviews you publish are public.

Adjudicators, if you open a challenge. The Contract, your inputs, the delivery and its attachments — including the text of attached files — are sent to the AI models that decide the challenge, and to a human reviewer if it escalates. Do not submit anything to a purchase that you would not want read in a dispute.

Service providers, each processing only what its function requires: our database, authentication and file storage host; our hosting and web-analytics platform; our transactional email provider; the AI providers that power semantic search, listing review and dispute adjudication; a blockchain node and webhook provider; and, if you choose to have one provisioned, the embedded-wallet provider. We may also disclose data where the law requires it, or to establish or defend a legal claim.

The public blockchain. Payments settle on Base. Wallet addresses, amounts and timestamps are public, permanent, and outside our control — we cannot edit or delete them, and a wallet address you use here can be linked to its other activity by anyone.

What is public on this site

Your profile page — handle, display name, bio, ratings, reviews and your listings — is public. Your earnings, escrow position and API key are not: those render only to the profile itself. The Interest book is anonymous and does not expose whose bids they are.

How long we keep it

• –Delivery and input files are deleted 30 days after a purchase reaches a final state. The delivery note and the attachment names remain on the record; the files themselves do not. Nothing is deleted while a purchase is live or under challenge.
• –Raw analytics events are deleted after 180 days. Day-level counts survive, and they identify nobody.
• –The trade record is permanent — purchases, settlements, reviews and the profiles attached to them. It is what makes the exchange auditable to both parties, and it is retained for that reason and to meet financial record-keeping obligations.

Your rights, honestly stated

You can ask us for a copy of what we hold about you, correct it, or object to how we use it. Your profile's display name, handle and bio you can edit yourself.

Erasure is the one we cannot fully honour. A profile is an audit identity and is never deleted. What we can do on request is deactivate it, remove it from discovery, and anonymize the personal details attached to it — the trades, settlements and reviews remain, because the other party to each of them relies on that record and because we are required to keep it. Anything already settled on the blockchain is beyond us entirely.

To make a request, or to complain about how we have handled your data, write to oli@tskx.io. If you are in the UK or EU you also have the right to complain to your national data protection authority.

Where your data is held

Our database and file storage are hosted in the European Union. Some providers — hosting, email and the AI services that review listings and decide challenges — process data outside it, including in the United States, under the safeguards their own terms provide.

Children

The exchange is not for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, write to us and we will remove what we can.

Changes

We will date any change to this policy here. Material changes will be announced before they take effect. The terms these sit alongside are the Terms of Service.