Privacy Policy

• Account information: name, email address, profile picture, username, and authentication credentials.
• Profile and listing data: product or service descriptions, prices, images, location, shipping or delivery details, and other content you publish to the marketplace.
• Transaction data: records of orders, listings purchased or sold, dispute history, and refund or cancellation actions.
• Payment-related information: Bitcoin wallet addresses, Lightning Network identifiers, payment metadata, and any payout details you provide. We may use third-party payment processors; sensitive payment information may be handled directly by those processors.
• Communications: messages between buyers and sellers within the Service, support requests, and feedback you send to us.

• Usage data: pages viewed, listings viewed, search queries, features used, time of access, actions taken in the Service.
• Device and connection data: IP address, browser type, operating system, device identifiers, referrer URLs.
• Cookies and similar technologies: session cookies, authentication tokens, preference cookies (see "Cookies and tracking" below).

• OAuth providers: when you sign in with a third-party identity provider, we receive the identity information that provider shares.
• Payment processors and blockchain networks: transaction status, on-chain confirmations, payout history. Bitcoin transactions are by nature public on the blockchain.
• Identity verification (if used): when required for high-value transactions, regulatory compliance, or trust and safety, we may collect government-issued identification or use third-party KYC providers.

We use the information we collect to:

• Provide, maintain, and improve the marketplace Service
• Facilitate transactions between buyers and sellers
• Authenticate users and prevent fraud, abuse, or illegal activity
• Resolve disputes and enforce our Terms of Service
• Comply with legal obligations, including anti-money-laundering (AML) and sanctions screening where applicable
• Communicate with you about your account, transactions, and the Service
• Provide trust and safety features (reviews, reputation, listing moderation)

We do not sell your personal information. We do not use your content to train third-party AI models without your explicit consent.

OrangeCat enables payments using Bitcoin and Lightning Network. You understand and acknowledge:

• Public ledger: on-chain Bitcoin transactions are recorded on a public, immutable ledger. Wallet addresses, transaction amounts, and timestamps may be visible to anyone. We cannot remove or alter blockchain records.
• Pseudonymity is not anonymity: while wallet addresses do not directly identify you, they may be linked to your identity through on-chain analysis or off-chain data we hold.
• Lightning Network: off-chain Lightning payments are not publicly visible in the same way as on-chain transactions, but routing nodes may observe payment hashes and amounts.
• Custody: OrangeCat is non-custodial — payments flow directly between buyer and seller wallets. If an escrow feature is ever offered, its custody terms will be disclosed before you use it.

We share information only as described below:

• Other marketplace participants: sellers see buyer information necessary to fulfill an order (e.g., shipping address); buyers see seller information necessary to assess a listing (e.g., shop name, reviews, public profile).
• Service providers acting on our behalf: hosting and infrastructure, AI inference, authentication, email delivery, error monitoring, analytics, fraud detection, identity verification, payment routing. Each is bound by contractual or legal data-protection obligations.
• Legal requirements: when required by law, court order, subpoena, or other legal process; or when necessary to protect the rights, property, or safety of our users, ourselves, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, your information may be transferred. We will notify users of any such transfer that materially affects their rights.

We do not share information with advertisers or data brokers.

• Account data: retained for as long as your account is active and for a reasonable period thereafter for legal, audit, AML, tax, and business continuity purposes.
• Transaction data: retained for the period required by applicable financial and tax law (typically 7–10 years).
• Listing data: retained as long as the listing is active, plus a reasonable period after delisting.
• Communications: retained for dispute resolution and audit purposes, typically 2 years.
• Logs and telemetry: typically 90 days, with security-related logs retained longer where required.
• Backups: may persist for up to 30 days after deletion.

You may request earlier deletion under "Your rights" below, subject to legal retention obligations.

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete data
• Delete your personal information ("right to erasure"). Deletion does not affect data we are legally required to retain (transaction, tax, AML records) or data already published to public blockchain networks.
• Export your data in a portable, machine-readable format
• Restrict or object to certain processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with your supervisory authority (Swiss FDPIC, EU Data Protection Authority, etc.)

To exercise these rights, contact us at the address in the "Contact" section. We will respond within 30 days.

The Service is operated from Switzerland and uses providers located in the United States, the European Union, and other jurisdictions. Where data is transferred outside your jurisdiction, we rely on appropriate legal mechanisms (Standard Contractual Clauses, adequacy decisions, or your explicit consent).

We use:

• Strictly necessary cookies — for authentication, security, and transaction integrity. These cannot be disabled without breaking the Service.
• Functional cookies — to remember preferences (currency display, language, theme).
• Analytics cookies (if any are deployed) — to understand marketplace usage patterns. We will list them here when active.

We do not use third-party advertising cookies.

We implement reasonable technical and organizational measures to protect your data, including encryption in transit (TLS), encrypted storage, access controls, audit logging, two-factor authentication for sensitive actions, and routine security reviews. However, no system is perfectly secure; we cannot guarantee absolute security.

If we discover a data breach materially affecting you, we will notify you and the relevant supervisory authorities as required by law.

Wallet security is your responsibility. We never request your private keys, seed phrases, or wallet recovery information. We will never ask you to send funds to "verify" your account.

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it.

Mao Nakamoto (Data Controller, pending incorporation of a successor corporate entity) — mao@orangecat.ch

We may update this Policy from time to time. Material changes will be notified by email or in-product notice at least 30 days before they take effect. The "Last updated" date at the top of this document indicates the latest revision.