Privacy Policy

What we collect

• Account: email, public handle, password (stored only as a hash) and 2FA settings.
• Identity check: photos of your ID (front and back) and a selfie holding it, your legal name and date of birth. Stored encrypted (AES-256) and opened only through short-lived, logged links.
• Money: balances, deposits, withdrawals, saved withdrawal addresses, the payment methods you add, orders, ads and fees.
• Orders and disputes: order chat, payment proofs, dispute evidence and decisions.
• Devices: IP address, country, browser and device details, and sign-in history.
• Website use: pages visited and actions taken, and which ad, campaign or site brought you to P2PLY. Analytics and marketing cookies are on by default and can be switched off in Cookie Preferences; visitors in the EEA, the UK and Switzerland are asked first. Sessions on the website are recorded to find and fix problems, except the identity capture and 2FA setup screens, which are never recorded. Error reports include the part of the session that led to the error.

Why we use it

To run your account and orders, verify identity, prevent fraud and money laundering, decide disputes, keep the platform secure, answer support requests and improve the product. We do not use your identity documents or selfie for marketing.

Who sees what

We never sell or rent your personal data.

• The other side of an order sees your handle, your trade stats, the payment details you choose to show and, if you are the buyer, your verified legal name, so the seller can refuse a payment from someone else.
• Dispute evidence is seen by the person who uploaded it and the moderator. A buyer's payment proof is also shown to the seller.
• Contact details are removed from the other side's chat and dispute text. UPI transaction numbers (UTR) stay visible because they prove a payment.
• Companies that run parts of P2PLY for us, under our instructions: hosting (Vercel, Railway), file storage (Cloudflare R2), email (Resend), analytics and session recording (PostHog, Google Analytics), cookieless traffic statistics (Cloudflare, Ahrefs), error reports (Sentry) and bot protection (Arcjet).
• Advertising partners (Google, Meta, Snapchat, X), unless you switch Marketing off: that you signed up, verified, deposited or traded, with your email or phone number only as a one-way hash, so they can tell us which ads work. They never receive your identity documents, balances or payment details.
• Authorities, when the law requires it.

How long we keep it

Trade, payment, anti-money-laundering and identity records, including ID photos, balances, deposits, withdrawals, payment methods and the audit log, are kept permanently, including after an account is deleted.

When you delete your account it is frozen at once. Signing in during the next 30 days cancels the deletion. On day 30 your email, phone and handle are released, and on day 44 the rest of your personal data (notifications, sign-in data, 2FA material, security settings and onboarding answers) is erased.

Your choices

• Switch analytics or marketing off in Cookie Preferences (website footer). When you are signed in, this also stops our servers sharing your activity with analytics and advertising partners.
• Turn trade and product emails off in Settings, Notifications. Security emails always reach you.
• Ask support for a copy of your data or to correct it.
• Delete your account from Settings once your balance is zero and no order or withdrawal is open.

Security

Identity files are encrypted at rest, signing keys are kept away from internet-facing servers, staff sign in with 2FA, and every staff action is written to an append-only audit log.

Contact

Reach us at @p2plyadmin on Telegram or Discord, or through the form at p2ply.org/support. Registered address: 36 Robinson Rd, City House, Singapore 068877.