You’re viewing the Polyculture Markets stagenet demo through a clearnet gateway — a shop window, not a trading path. Never sign in, message, or trade here. Real address, for Tor Browser: j5mf3wrbhb5jec6qwtywltua3qcjrxzlpdb46dylkqqf7njhvqutbqqd.onion
My Websitestagenet

Security guide

The threat model in one paragraph

This marketplace is designed so that a stolen database reveals no plaintext messages, no shipping details, no wallet keys, and no raw session tokens — and so that a compromised server cannot steal funds, because funds never pass through it. It is not designed to hide metadata: the operator knows which accounts interact and when, and network observers can correlate timing and sizes. Use Tor, use a dedicated identity key, and verify everything the server shows you against something it does not control.

Your identity key

  1. Create a dedicated OpenPGP key for this marketplace — not a key you use elsewhere. Keep the private key on your own device; the server only ever holds the public certificate.
  2. Register the certificate on your account security page. Your fingerprint is your durable identity: account names can be imitated, fingerprints cannot.
  3. Pin other people's keys locally. When you fetch a seller's key from their profile, verify the fingerprint against a copy you trust (their other channels, a previous order) and save it in your own keyring. The fingerprint printed on a page served by this server is a convenience, not a proof.
  4. If you rotate your key, sign the rotation with the old key whenever you can. An unsigned ("uncertified") rotation shows a warning on your profile for 90 days, because the server cannot tell it apart from a takeover.

Messages: sign, then encrypt, locally

  1. Compose on your own device. There is deliberately no plaintext composer here.
  2. Sign with your key first, then encrypt to both the recipient's key and your own (so you can read your sent copy).
  3. Paste or upload the armored ciphertext. The server checks the envelope's shape — recipients, size, packet structure — and rejects anything malformed. It cannot read the content.
  4. Only signed messages count as evidence in a dispute. An unsigned claim is labelled an unverified claim, however true it may be.

Verify a payment before you send it

  1. Open the order's payment page. Check the amount, and that the network named in the signed message matches the network you intend to pay on.
  2. Copy the signed message and signature exactly and verify them with your wallet's verify feature, against the seller's primary address.
  3. Check that the subaddress at the end of the signed message is exactly the subaddress you are about to pay, and that the primary address matches a copy you pinned earlier.
  4. Only then pay — the exact amount, in one transaction. The full walkthrough is on every payment page, next to the address.

Disputes and disclosure

If a trade goes wrong you may voluntarily disclose specific messages to moderators: decrypt locally and paste the plaintext with its detached signature. The marketplace checks the signature against the other party's pinned key; only a verifying signature is labelled evidence. Disclosed content is stored encrypted and deleted a fixed period after the dispute resolves — the dispute page states the exact number of days before you submit anything.

What never to do