Limitations

This marketplace is built to give strong guarantees about payment custody and message content, and weak ones about metadata. Those are different properties; this page never blurs them.

What this system does protect

• Funds never pass through the marketplace. Buyers pay sellers directly, wallet to wallet. A compromised server cannot steal money it never holds.
• Message content. Messages are encrypted on your device; the database holds ciphertext only. There is no plaintext, no shipping details, and no wallet keys or seeds stored here — ever.
• Payment addresses. Sellers pre-sign their payment addresses with their own wallet. Your wallet can verify the signature before you pay, so a compromised server cannot silently swap in its own address — if you verify.
• Accounts. Passphrases are hashed with Argon2id; sessions rotate; every form carries a CSRF token.

What it does not protect against

• A seller who takes payment and does not deliver. There is no escrow, so every order carries this risk. Reputation and disputes inform you; they cannot make you whole.
• Compromised devices. If your computer or wallet is compromised, nothing here helps.
• Traffic correlation and metadata. The operator always knows which accounts interact, which listings they order, and when. Timing and sizes are visible to network observers; use Tor.
• A malicious server on your first visit, before you have pinned anyone's key. Verify fingerprints against copies obtained elsewhere.
• Review farming. Weighted reputation raises the cost of sock-puppet farming; it does not prevent it. The raw facts are shown so you can judge for yourself.
• Skipped verification. The verification steps only protect people who do them.

Payments are attested, not verified

This instance does not verify payments on-chain and runs no wallet. An order shows "seller confirmed payment" because the seller said so after seeing funds in their own wallet. Nothing on this site can prove a payment happened.

This instance

• Deployment profile: demo
• Monero network: stagenet
• Marketplace ID: vespiary-market
• Software version: 0.1.0
• Registration: open
• Payment module: direct payments (signed subaddress pool + seller attestation). No escrow, no on-chain proof checking.
• Reputation model: configured by the operator; raw trade facts are always shown next to any score.

How long data is kept (this instance's actual values)

• Read inbox notifications: deleted 30 days after being read. Unread notifications are kept.
• Sessions: deleted 7 days after they expire.
• Security events: deleted after 30 days.
• Dispute disclosures: deleted 180 days after the dispute is resolved.
• Orders, invoices, and terms: kept while the accounts exist. Automatic purging of old orders is not yet implemented on this software — the operator can delete data manually, and account closure ends an identity without erasing counterparty history.

See also payment risks, the security guide, and this instance's policy.