Privacy notice

1. What is stored

• Account: username, your Telegram user id and the chat used for notifications, or an email address and a password hash (argon2id — the password itself is never stored); role, rank, number of completed trades, warnings and account status. A Telegram sign-in request records the browser and an approximate location, shown to you in the chat.
• Wallet: the address of the QTC wallet created for you and its recovery phrase, encrypted under a key the platform holds. The platform can decrypt it: that is what custody means. Also the Arbitrum address you enter, and a copy of both addresses on every trade you take part in.
• Sessions: a hash of each session token with its creation and expiry dates. Sessions expire after 30 days without activity and can be revoked in Settings.
• Security: your two-factor secret (encrypted), hashes of your recovery codes, and a log of withdrawals — destination, amount, time — and of recovery phrase exports.
• Trading records: offers, trades, their event log, transaction hashes you submit, and the reason, evidence and resolution of disputes.
• Technical logs: request logs with a request id, kept for operations and abuse prevention. Their retention period will be fixed during the legal review.

2. What is public

Open public offers appear in the order book without your email or addresses. Completed trades from public offers are listed on the Settlements page with amounts, price, time and transaction hashes, without usernames. Trades from private offers are not listed.

Blockchains are public and permanent. Your wallet address, your deposits and withdrawals, the escrow wallet, the USDC payment and the release are visible to anyone on Quantus and Arbitrum, and nobody — including the platform — can erase them.

3. Cookies and local storage

• The trading app sets qotc_session (httpOnly, keeps you signed in) and qotc_csrf (protects forms against cross-site requests). Both are strictly necessary.
• Your browser keeps the theme choice under qotc-theme in local storage. It is not a tracker.
• This marketing site sets no cookies and loads no analytics or third-party scripts.

4. Sharing

The draft intends no sale or sharing of personal data for advertising. Sign-in codes and notifications travel through Telegram, which processes them under its own terms; notifications carry amounts and deadlines, never a recovery phrase. Email delivery and hosting providers will be listed here once chosen. Disclosure required by law, and any identity data that custody of crypto-assets may oblige the operator to collect, are under legal review.

5. Your rights

Access, correction and deletion of account data, within the limits of what must be kept for open trades, disputes and legal obligations. The procedure, the data controller’s identity and the retention periods will be added by counsel before this notice takes effect. Until then, use the contact page.