What Data a Non-Custodial P2P Platform Keeps — and for How Long

By Inveil Research · Updated June 3, 2026

The honest answer to "what does this platform know about me?" should be short, and on a non-custodial P2P protocol it is. Inveil keeps three things: encrypted trade artifacts that are deleted shortly after the trade ends, an on-chain order record that contains amounts and pseudonymous addresses but no personal identity, and an aggregate reputation score with no name attached. There's no KYC file, no plaintext chat archive, and no central database of who traded what. This article walks through exactly what's stored, where, and for how long — because data minimization is only credible if you can see the boundaries.

The three buckets of trade data

Every P2P trade generates data that falls into one of three categories, and a privacy-first design treats each differently:

Data	Where it lives	How long it's kept	Who can read it
Evidence, payment proofs, address, chat	Encrypted blob, off chain	Deleted after trade (see below)	Trade participants only
Order record (amounts, status, addresses)	On chain (Arbitrum)	Permanent, public	Anyone — but it's identity-free
Reputation (aggregate stats)	On chain	Permanent, public	Anyone — but no name attached

The design goal across all three: the operator should be able to run the marketplace while knowing as little as structurally possible. Let's take them in turn.

Sensitive artifacts: encrypted, then deleted

The genuinely sensitive material in a trade — your payment screenshot, a delivery address, the chat, dispute evidence — is end-to-end encrypted in your browser before it's stored, so the operator only ever handles ciphertext it can't open. But encryption isn't the end of the story; retention is. Sealed blobs don't sit around forever:

• When a trade completes or is cancelled, the encrypted evidence and notes for that order are deleted immediately — the platform enumerates everything tied to the order and removes it.
• When a trade goes through a dispute and is finalized, deletion is scheduled after a short grace window (24 hours), so an arbitrator can revisit the case if needed before the evidence is purged. After the window, it's deleted automatically and unattended.

The practical effect: the encrypted record exists for as long as the trade needs it and not meaningfully longer. There's no growing archive of old trade artifacts to breach, subpoena, or mine — even in encrypted form. The data minimization is enforced by code on a schedule, not by an operator's promise to "delete it eventually."

The order record: permanent, but identity-free

The on-chain order is the part that is permanent — it lives in a smart contract on Arbitrum, and like everything on a public chain, it can't be deleted. But look at what it actually contains: the buyer and seller addresses (pseudonymous, not names), the amounts (stake, payment, trade value), timestamps, the trade status, and — crucially — only pointers and hashes for the sensitive parts. The delivery address, payment proof, and rules are stored on chain as a content address plus a fingerprint, never as readable content.

So "permanent on-chain order" doesn't mean "permanent exposure of your personal details." It means a durable, tamper-evident record of a transaction between two pseudonymous accounts, with the private content sealed off chain and deleted on schedule. Your Telegram handle, if you connect one for notifications, lives off chain in the operator's notifier component, not in the order. The chain proves a trade happened; it doesn't reveal who you are. This is the privacy posture a public chain actually enables when the design keeps identity off it.

The only lasting profile: identity-free reputation

The one thing Inveil keeps about you long-term is reputation — and it's deliberately thin. The on-chain reputation record is a handful of aggregate numbers: how many trades you completed successfully, how many disputes you were in and how many you won, your total settled volume, your average release time, and when you first traded. That's it. No name, no email, no documents, no contact details. It exists so counterparties can size you up, which is how reputation substitutes for KYC — and it does so without storing a single piece of personal identity.

What's deliberately not stored anywhere

It's as important to name the absences:

• No KYC. No identity verification, so there's no passport scan or address proof to keep in the first place — and no identity database to leak.
• No sign-up record. Accounts are passkeys, not email-and-password rows in a users table.
• No plaintext chat or evidence on the operator's servers. Only ciphertext the operator can't read, deleted after the trade.
• No per-trade operator state. The platform doesn't maintain a private ledger of your activity beyond what the chain already shows publicly.

Why this matters

Custodial platforms accumulate data as a side effect of how they work — KYC files, server-side chat logs, internal trade databases — and every byte is a liability that can be breached, sold, or demanded. Inveil's design inverts that: it stores the minimum to run a trade, encrypts what's sensitive, deletes it on a schedule, and keeps only an identity-free record on chain. If you want to verify any of this rather than take it on faith, the protocol is open source and the claims are auditable. You can also just try a trade and watch how little you're ever asked to provide.

FAQ

Does Inveil delete my trade evidence after the trade?

Yes. Encrypted evidence and notes are deleted immediately when a trade completes or is cancelled, and after a 24-hour grace window once a disputed trade is finalized (so an arbitrator can revisit if needed). The sensitive material isn't retained as a long-term archive.

Is my order stored on the blockchain forever?

The order record is permanent on Arbitrum, but it's identity-free: it holds pseudonymous addresses, amounts, timestamps, and status, plus only pointers and hashes for sensitive content — never your name or readable personal details. The private parts are encrypted off chain and deleted on schedule.

What's the only thing the platform keeps about me long-term?

An aggregate reputation record on chain: successful trades, dispute counts and wins, total volume, average release time, and first-active date. It contains no name, email, or documents — just trade-outcome statistics tied to a pseudonymous account.

Does the operator keep a private database of my activity?

No. There's no KYC file, no server-side plaintext chat, and no per-trade operator ledger beyond what the public chain already records. Sensitive artifacts are encrypted so the operator can't read them and deleted after the trade, and accounts are passkeys rather than email-and-password records.