Information collected
When you use the opioid.wtf marketplace, we collect account registration details, profile information, and uploaded files; purchase, licence activation, referral, and wallet records; support requests and forum posts; and security details such as sign-in IP addresses, device and browser data, and hashed hardware identifiers. If you connect Discord, we keep the linked account ID and display name. Passwords and one-time email-verification tokens are kept as hashes.
How information is used
We use these details to operate accounts, provide purchases and support, maintain financial and transaction records, prevent fraud, and investigate potential abuse. Staff access is limited to information needed to perform their work. Profiles, reviews, and forum posts are public in the areas where they appear; support tickets and attachments are available only to the people involved and authorized staff. We do not sell personal information.
Security and encryption
The live website uses HTTPS. Account and order records stored by the application are encrypted at rest with AES-256-GCM; the encryption key is kept in server-side configuration, separate from the data files. Passwords are stored using salted scrypt hashes, and session and email-verification tokens are stored as hashes. The server decrypts records when it needs to process them, so these safeguards cannot protect information on a compromised running server or guarantee that an incident will never happen.
Email, payments, and cookies
Resend delivers account-verification emails. Forgotten-password requests are handled by support after account ownership is reviewed. Payments and checkout are processed through SellAuth. SellAuth may receive the information necessary to process and fulfill a transaction, including applicable payment, customer, and order information. Each service provider receives only the information needed to perform its services.
When you sign in, we store an essential, HttpOnly, SameSite session cookie in your browser for up to 30 days. You can end it by signing out; changing your password ends other active sessions.
Contact
Questions about this policy can be sent to opioidsupp@tutamail.com.