Privacy Policy

1. Introduction

At iKash, privacy and security are foundational to our architecture. This Privacy Policy details the strict data minimization practices we employ to protect your information. As a non-custodial peer-to-peer (P2P) platform operating on the Stellar network, our system is designed to facilitate trustless transactions without requiring us to hold unnecessary sensitive personal data.

2. Information We Explicitly Do Not Collect

Due to our zero-trust and decentralized architecture, there are critical pieces of information we categorically refuse to process or store:

• Private Keys: We never request, generate, receive, or store your blockchain private keys. All cryptographic signing occurs locally on your device.
• Raw Biometric Data: We do not store biometric scans, facial recognition data, or raw passport/ID document images. Identity verification is entirely delegated to our specialized partner, Didit.

3. Information We Collect and Store

To operate the P2P marketplace and ensure a secure trading environment, our backend relational database (PostgreSQL) collects and stores the following strictly necessary data:

• Blockchain Identifiers: Your Stellar public key (wallet address), which acts as your primary identifier.
• KYC Status: An anonymized Didit session identifier and your binary verification status (e.g., "Approved" or "Declined").
• Payment Methods: Fiat payment details you register (e.g., bank account numbers, beneficiary names, national ID numbers) required for counterparties to send you funds.
• Transactional Data: Offers created, order matching history, and escrow state metadata (e.g., contract IDs, transaction hashes).
• Communication & Evidence: Encrypted chat message logs tied to active orders, and URLs linking to payment evidence (receipts/screenshots) securely stored in Google Cloud Storage.

4. How We Share Your Information

We do not sell or indiscriminately share your data. Sharing is strictly limited to the functional requirements of the P2P protocol:

• Counterparty Exposure: When you enter into an active order, your registered fiat payment method details are exclusively revealed to your specific counterparty. This is unavoidable and necessary for the fiat settlement phase to occur. This data is not public or accessible outside the context of an active trade.
• Infrastructure Providers: We utilize Google Cloud Platform (Cloud Run, Cloud Storage) and Supabase (managed PostgreSQL) to host our infrastructure securely.
• Escrow Providers: We share necessary order parameters with Trustless Work to deploy smart contracts on the Stellar network.

5. Data Retention Policy

To prevent the accumulation of historical transactional data, iKash enforces a strict two-year retention window for audit and transactional records. After this period, active relational data and associated evidence files are removed from our active databases and moved to a frozen, inaccessible archive, except where prolonged retention is required by applicable laws. Note that on-chain transactions submitted to the Stellar network are public, immutable, and beyond our control to modify or delete.

6. Your Rights and Consents

By connecting your wallet and interacting with the iKash platform, you explicitly consent to the localized sharing of your payment method details with your trading counterparties. Because your account is bound to your self-custodied wallet, you retain sovereign control over your blockchain identity.