Privacy policy

This is the formal version of what the transparency page describes in plain terms. Where the two could be read differently, read them together — they describe one system, and neither is allowed to promise something the code does not do.

What we collect

Only what running a reputation platform actually requires.

• Account. Your email, display name, a bcrypt hash of your password, when you verified your email, and your 21+ attestation. Never your password itself.
• The member who vouched you in. Invites are the membership model, so that link is part of the record.
• Shop and listings. Whatever you chose to publish: name, region, bio, policies, accepted payment methods, photos.
• Off-site contact channels. Held so we can reveal them to a counterparty when you accept a deal, and for no other purpose.
• Deal records. Who opened a deal with whom, when, about which listing, and its status. The contents are encrypted; the fact of the deal is not.
• Reputation. Confirmations, ratings, review text, disputes.
• Security settings. Your public key, and — if you turn on two-factor — your TOTP secret and hashed recovery codes. The TOTP secret is stored unencrypted, because the server has to be able to check your codes. Treat it the way we do: something a database breach would expose, which is why it is a second factor and not a substitute for a strong password.
• Waitlist. If you asked for an invite without having one, the email address and note you sent.

What we cannot read

• Deal messages. Encrypted in your browser with a key derived between you and the other party. We store ciphertext.
• Tracking numbers. Same encryption. We keep the carrier, the last four characters and a timestamp — enough to prove a shipment happened, not enough to resolve a name or address.
• Your private key. It stays in your browser. We hold no copy and cannot recover it, which is the trade-off that makes the two lines above true. Export it under a passphrase from your security settings if you want it to survive a lost device.
• Camera metadata on your photos. Every upload is re-encoded and stripped of EXIF before it is stored, so the GPS coordinates a phone buries in a seed photo never reach us. An upload we cannot re-encode is rejected rather than stored as it arrived.

What we do not do

• Sell, rent or share your personal data with third parties.
• Run advertising, analytics or third-party trackers.
• Log your IP address ourselves. Rate limiting runs in our own database, keyed to your account rather than your network, so no outside service receives a record of what you browsed.
• Touch payments. We never see a card, a Cash App tag or a wallet address for a member-to-member deal, because those deals happen entirely off-platform.
• Publish your contact channels, or reveal them to anyone before you accept a deal.

Who else touches your data

These vendors run the infrastructure and keep their own logs, which we do not control:

• Vercel hosts the site and records request logs, including IP addresses, for a limited retention period.
• Neon hosts the database in the United States.
• Resend sends verification and invite emails, and logs delivery status against your email address.

If your threat model includes your own network operator, use Tor or a VPN. We do not block either.

How long we keep it

Plainly: there is no automatic expiry yet. Deal records, messages and reputation stay until you delete your account or ask us to remove something. Scheduled purging of old deal records is a change we intend to make and have not made, and this page will say so on the day it ships rather than before.

What deleting your account actually does

Deletion is self-service from your security settings and takes your password plus a typed confirmation. It is immediate and irreversible.

• Removed: your account, shop, listings, contact channels, branding, vault and wanted entries, every message and shipping record in any deal you were part of, your unused invite codes, and your waitlist entry.
• Kept, with you stripped out: ratings you left, with your name and your written review removed. A breeder's average must not move because someone else closed their account.
• Kept, anonymously: the bare record that a deal happened — its listing, timing and outcome — where the other party is still here, with your name detached from it. The reasoning is the same: their verified-deal count is something they earned, and the other side leaving cannot erase it. The contents are gone; only the fact remains, and it no longer points at you.

What you control

• See exactly who has viewed your contact details, how many times and when, from your shop settings.
• Turn on two-factor authentication with single-use recovery codes.
• Export and re-import your encryption key under a passphrase.
• Edit or remove any listing, photo or shop detail at any time.
• Delete the whole account, on the terms above.

For anything not covered by those, or to ask what we hold about you, write to privacy@phenotrade.com.

The honest caveat

PhenoTrade is in beta and this policy has not been through counsel. It describes the system as built today, accurately, and it will be reviewed before general launch. If you find a line here that the software does not actually do, that is a bug in one of the two, and we want to hear about it.

See also the transparency report and canary, terms, and listing policy.