Start a deal

Privacy

Yescrow keeps as little as it can. Most of a deal lives in a public record; the few things we keep ourselves are listed here.

Who we are

Yescrow is run by Eastern Vikings OÜ, registry code 14194338, Uus tn 14, 10111 Tallinn, Estonia (about us). Write to teo@yescrow.xyz to see or delete what we hold about you.

In the public record: not ours to delete

A deal's terms (the domain, the price, both wallet addresses, the registrar) and every step of it are recorded on Arbitrum, a public blockchain that the escrow runs on. Anyone can read them, and nobody, including us, can change or delete them. Evidence files you add in a dispute are published on IPFS, a public file network, for the dispute court's jurors, through Pinata, and stay public too.

Alerts by email

  • What we keep: the email address you give for one deal, when you propose or accept it, which deal, and whether you are its buyer or seller. Nobody else can set or change it.
  • Why: only to send that deal's alerts. Each alert has a link that stops them at once.
  • Who sends them: Resend sends the emails for us from its servers in Ireland. Resend is a US company and keeps its records of each email, including your address, in the United States, under the EU's standard contractual clauses.
  • For how long: until the deal closes and its last alert is sent, or until you unsubscribe with the link in any alert. Then we delete the address. If a deal is never proposed, we delete it after 30 days.
  • A seller's address for all its deals: a seller who makes a buy link can give one address for every deal a buyer starts with the seller's wallet, so the seller hears when a buyer pays. Only that wallet can set it, with a signature. We keep it until the seller stops it, with the link in any of those emails or on the buy link page, and delete it by itself a year after it was given or last used for a deal.

Alerts in your browser

If you turn on browser alerts, we keep the push address your browser gives us, which points to its own push service (Google, Apple or Mozilla, depending on the browser). That service learns that a message arrived for your browser; the message itself is encrypted. We delete the push address when the deal closes, or when your browser stops accepting it.

Connecting a wallet app on your phone

If you connect the wallet app on your phone through WalletConnect, WalletConnect's relay, run by Reown, passes the messages between this page and your wallet app. They are end-to-end encrypted, so Reown sees your IP address and when the two talk, but not what they say. Reown's Verify service also confirms to your wallet app which website a request comes from. WalletConnect's code loads, and contacts Reown, only if you choose it, and its usage reports are switched off. The connection's keys stay in your browser's storage until you disconnect.

If you open a page in a wallet app from the connect dialog, the link goes through that wallet's own link service (MetaMask, Trust Wallet, Coinbase, OKX, Bitget, Rainbow or Rabby), which sees the page's address, such as a deal's ID, and your IP address. Nothing reaches a wallet's servers unless you tap its link.

Our servers

The Yescrow service logs each request it answers, with its IP address, to limit abuse. The logs stay on our server and are replaced when the service is redeployed.

In your browser only

A half-finished deal, reminders you set, and choices such as hiding a card are saved in your own browser's storage. They never reach us. There are no cookies, no analytics and no tracking.