Privacy policy

Pes Escrow WORKS-LLC, operating PESescrow.com from Dubai, United Arab Emirates. Contact us at contact@pesescrow.com about anything on this page.

• Your account: email address, display name, and a hashed password. We never store your password itself — only a bcrypt hash, which cannot be reversed back into it.
• Deals: what was traded, the agreed price, who the parties are, timestamps, and every state change.
• Game account credentials: the login the seller deposits, encrypted (see below).
• Payment references: the transaction hash or reference you give us so we can match a payment. We do not collect or store card numbers — no card details ever pass through this service.
• Messages and reviews you write on deals.

Credentials deposited for a deal are encrypted with AES-256-GCM before they are written to the database, using a key held outside it. They are decrypted in exactly two situations: for the administrator to verify the account works before releasing it, and for the buyer after that release is approved.

They are never included in a page unless specifically requested by someone entitled to see them, never written to logs, and never sent to any third party. Database query logging is deliberately disabled so credentials cannot leak into log files.

Reviews are public, along with the display names of the people involved and the rating. This is the point of them: it is how someone decides whether to trade with a stranger.

Public pages never include email addresses, deal references, what was traded, or amounts. Choose a display name you are comfortable being seen — you are not required to use your real name.

We do not sell your data and we do not use it for advertising. It is shared only with the services needed to run this one: our database host, and — if you use an automatic payment method — the payment provider, which receives the amount and a deal reference. We share data with law enforcement only where legally required.

The other party to your deal sees your display name, your messages, and your reviews.

• Deal records are kept while the deal is open and afterwards as a record of the transaction, including for resolving later disputes.
• Credentials are kept for the deal they belong to. Once a deal is complete and the 48-hour window has passed, you should have changed them anyway — change the email and password on any account you buy, immediately.
• Messages and reviews are kept as part of the deal record.
• If you close your account, we remove your personal details but keep the minimum needed to show that past deals happened and were settled.

Depending on where you live, you may have the right to see the data we hold about you, correct it, ask us to delete it, or object to how we use it. Ask us and we will do it, subject to keeping what we genuinely need for deals that have happened and for legal obligations.

One thing we cannot do is delete a review purely because it is unflattering. Removing bad reviews on request would make every good review worthless.

Two, and neither is used to identify you across the web. One holds your sign-in session so you stay signed in between pages; signing out clears it. The other remembers whether you chose the light or dark theme, and is set only if you press that button.

There is no advertising cookie and no third-party tracker on this site.

We count page views and measure how quickly pages load, through Vercel Analytics and Speed Insights. This records the page visited, the referring site, and coarse details like country, browser and device type.

It sets no cookie, assigns you no identifier, and cannot follow you to other websites, so there is nothing here to ask your consent for. We use it to see which pages people actually read and which ones are slow — not to build a picture of you. If that ever changes, this page changes with it, and you will be asked first.

The visit count shown on the home page is our own, and it is a counter rather than a log: one number per calendar month, incremented when the page loads. No row is written for your visit, and no address, browser or identifier is stored alongside it. That is also why it counts visits and not visitors — telling two people apart would mean marking you, which is the thing being avoided.

Passwords are hashed, credentials are encrypted, and every action that moves money or releases an account is checked against who you are on the server rather than trusted from the browser. No system is perfect. If you find a problem, please tell us rather than exploiting it — we would rather hear it from you.