Unguessable access keys
Each room issues two long random keys — one for the party who opened it, one single-use invite for the counterparty. Keys cannot be derived from the room address.
Security
Built so a room only ever holds three people
Access control, not obscurity. Every request for deal data is authorised on the server against a key that only you hold.
Three-person access ceiling
Once the invite has been used, the room is closed. A second attempt to join with the same link is refused; the room is permanently limited to buyer, seller and pokz.
Server-side authorisation
No browser can read deal data directly. Every read and write passes through server-side checks that validate the key before any record is returned.
Encrypted transport, minimal data
All traffic runs over HTTPS. pokz collects a display name and the transaction details you write — no accounts, no passwords, no unnecessary identifiers.
What is expected of you
- Treat your room link like a key: anyone holding it holds your side of the room.
- Send the invite link privately, and only to the person you intend to deal with.
- Never continue the deal in another channel — only what is in the room counts as agreed.
- Tell pokz immediately if you believe a link has been exposed so the room can be closed.
No online service can promise absolute security. pokz applies proportionate technical and organisational measures and describes data handling in full in the Privacy Policy.