1. Who we are

Sitescrow runs sitescrow.com and decides how the information described here is used. You can reach us about anything in this policy at support@sitescrow.com.

2. What you give us

• Your account: your name, a username, your email address, a password (stored only as a one-way hash we cannot read), your date of birth, your phone number, your country, and a profile photo if you add one.
• Listings: what you write about a business, its address, its figures, and the code you place on it to prove it is yours.
• Proof of your numbers: screenshots of analytics or payouts, if you send them.
• Messages, offers and deals: what you write to other members, the offers you make and accept, and the records of a deal and its handover.
• Reports: what you tell us when you report someone, and the reports others make about you.
• Contact: what you write to us through the contact form or by email.

3. What we collect automatically

• One cookie, to keep you signed in. Nothing to track you, nothing shared with advertisers.
• Security information: when you use the site, our servers and the companies that host and protect them see your IP address, your browser and the pages you ask for. We use this to keep the site running and to block attacks, for example to slow down someone guessing passwords. It is kept only for a short time. When someone signs in to an administrator account, we record the time, the IP address, its country and the device, to catch a stolen login.
• Preferences on your device: your browser keeps a few small choices, such as the language for speaking instead of typing. They stay on your device and never reach us.

4. What we get from others

• Google: if you sign in with Google, Google tells us your name, your email address, that the address is confirmed, and an identifier for your Google account. Nothing else.
• Public information about a listing: the picture a site publishes for sharing, when its domain was registered, whether it is online, its security settings, and the text on its front page, all things anyone can see.
• The visitor counter: a seller can put our counter on their own site. It sets no cookies and keeps nothing about the people visiting, only daily totals per site: how many visitors, which country they are in, and whether they came from a search engine, a social network, another website (just that site’s name, never the page or what was searched) or directly. A visit is told apart from another by a one-way code that changes every day and is thrown away at the end of it.

5. How we use it

• to run your account and the marketplace: show listings, deliver messages, record offers and deals;
• to keep people safe: prove who owns a listing, review listings and reports, spot scams, and put accounts on hold;
• to confirm you are old enough to use Sitescrow;
• to email you what you need: sign-in and password codes, a welcome, new messages (you can turn these off), and notices about your account;
• to send you at most one tip about using Sitescrow, once: how to list for free. Every tip has a link that stops them, and you can turn them off under Email notifications;
• to protect the site and our systems from attacks;
• to keep the records the law asks us to keep, and to answer the police or a court when the law requires it.

We do not use your information for advertising, and we do not build a profile of you to sell to anyone.

6. Decisions made automatically

Two things on Sitescrow decide on their own. The listing review reads a new listing once its owner has proven it, and either publishes it or holds it for us to look at. The report review reads the messages between two members when one reports the other, and puts an account on hold if they show a clear scam.

Every hold is reviewed. If a decision affects you, you can ask us to look at it again from your Sitescrow messages, or through the contact page if you cannot sign in.

7. Who can see what

• Everyone: your name, username, profile photo and country, beside what you publish, and your listings.
• The other side of a deal: your email and phone, once you are both in it, so you can finish the deal.
• The seller and the buyer who made it: an offer amount, and no one else.
• Only you and Sitescrow: the screenshots you send as proof, your date of birth.
• Members who are signed in: your profile page (your name, username, photo, bio, country, when you joined and your live listings), how many people follow you and how many you follow. Your email, phone and date of birth are never on it.
• Your messages, including direct messages: you and the person you are writing to. Sitescrow reads them only when one of you reports the other, when you ask us to, or when the law requires it.
• Direct messages: any member can start one with you, unless you turn that off in Profile, Direct messages; then only people you follow can. Members under 18 only hear from people they follow.
• Groups: everyone in a group sees what is written in it from the moment they join, and the names of the others in it. Only someone you follow, who follows you, or who you have talked with can add you, and the same rules as direct messages apply. You can leave any group.
• Blocking: someone you block cannot message you, find you, see your profile, add you to a group or write on your listings, and is not told. Clearing a chat removes it only from your screen: the other side keeps it, and a report can still read it.

8. Your protection is on Sitescrow

We can only see, record and protect what happens on Sitescrow. When a conversation moves to WhatsApp, Instagram, Telegram, email or the phone, it leaves our reach: we have no record of it, our review cannot read it when you report someone, and we cannot act on it. Keep your conversation here until the deal is done, and be wary of anyone who pushes you to move.

9. Who we share it with

• The companies that run the site for us (hosting, the database, email delivery and protection from attacks) only to provide their service, under their own security and privacy duties.
• Google, when you choose to sign in with it.
• Wikipedia and Wikidata (both run by the Wikimedia Foundation), when you ask iSite, our automatic assistant, a general question that is not about Sitescrow (for example "what is the capital of Japan?"): the words of that question are sent to them to look up the answer. Nothing that says who you are is sent with them.
• A breach check: when you choose a password, the first five characters of a one-way code made from it are checked against a public list of leaked passwords (Have I Been Pwned). The password itself never leaves our server.
• The police, a court or another authority, where the law requires it, or where it is needed to stop a fraud or protect someone.
• A company that takes over Sitescrow, if that happens, under this same policy.

We never sell your information, and we never give it to advertisers.

10. Where it is stored

Your information is stored on servers run by established providers, which may be outside your country, including in the United States. Wherever it is, it is protected as this policy describes.

11. How long we keep it

• Your account: for as long as it is open.
• When you delete it: your account, listings, offers and messages go, except a message the other side of a deal still needs, records of a deal, and reports.
• Reports and account holds: kept on the account’s record even after they are closed, so that a pattern can be seen.
• Proof screenshots: deleted with the listing.
• Security information: only for a short time, unless it is part of an investigation.
• Anything the law requires us to keep, for as long as it requires.

12. How we protect it

Your connection to Sitescrow is encrypted. Passwords are stored only as one-way hashes, and a password that has appeared in a known leak is refused. The site blocks known attacks, limits how often anything can be tried, and our own access to the database and the servers is protected by two-step verification.

No system is perfectly secure. If a breach puts you at risk, we will tell you, and the authorities where the law requires it.

13. Your rights

You can ask us to: show you the information we hold about you; correct it; give you a copy in a usable format; delete it; or stop using it for a particular purpose. You can also withdraw a choice you made, such as receiving message emails. Write to support@sitescrow.com. No form and no fee. We may need to confirm it is really you before we act.

If you are not happy with our answer, you can complain to the data protection authority where you live.

14. Children

Sitescrow is not for anyone under 16. We ask for a date of birth when an account is created, and we delete an account we learn belongs to someone younger.

15. Speaking instead of typing

The microphone button on a listing’s description uses your browser’s own speech service (Google’s in Chrome, Apple’s in Safari) to turn what you say into text. The sound goes to that service, not to us; we only receive the text that ends up in the box.

16. Two-step sign-in

If you turn on two-step sign-in, we keep the key it uses encrypted, and your backup codes only in a form that cannot be turned back into the codes. If you ask for it to be turned off without a code, we wait seven days and email you first, so that someone else with your password cannot do it quietly.

17. Taking a profile photo

If you take your profile photo with the camera, the camera is switched on only while that window is open on your screen, and off the moment you close it. The picture is cropped on your own device, and the only thing we receive is the photo you choose to save.

18. Changes to this policy

When this policy changes, the new version is published here with its date. When a change matters, we tell you before it applies.

19. Contact

Anything about your information: support@sitescrow.com, or the contact page.