kashilo

Swiss-based private marketplace — 'Kaufen. Verkaufen. Vergessen.' (Buy. Sell. Forget.) — a JavaScript SPA with accessible /about, /privacy (Datenschutz), /terms (AGB), and /imprint pages that all Listed at Grade B- because Switzerland is a strong privacy jurisdiction, the Tor mirror has a working Onion-Location header, monerica confirms the listing, and the homepage publishes explicit no-KYC/no-account/no-tracking claims — but every legal and operational page is gated behind JS rendering, and the site has accumulated zero user reviews.

What it is. Swiss-based private marketplace — end-to-end encrypted, no tracking, no KYC, no account required per the operator's monerica description. Listed at Grade B- because the privacy posture (Switzerland + Tor + no-KYC) is stronger than most B-grade marketplaces, but the JavaScript-only.SPA leaves the operator's published policy text inside a JavaScript-only client. Background. Founded 2026-02-10 and listed on monerica.com on 2026-03-19 (monerica.com/site/kashilo). The site is a JavaScript single-page application branded in German with a Swiss jurisdiction claim: 'Made in Switzerland · v0.9.66' (operator-published, homepage footer). The tagline 'Kaufen. Verkaufen. Vergessen.' (Buy. Sell. Forget.) positions the service as a private exchange marketplace. Navigation links include /about (Über uns), /help (Hilfe), /imprint (Impressum), /privacy (Datenschutz), and /terms (AGB) — all require JavaScript and require JavaScript to render. A Monero price ticker ('1 XMR ≈...') is visible on the homepage (operator-published), suggesting XMR is a primary or listed asset. No operator identity, team, or contact channels were. What you trust. No-KYC stance: monerica.com tags the service as 'No KYC' and 'Account Not Required' (monerica listing). The operator-published description: 'Your private marketplace. No tracking, end-to-end encrypted.' The actual Datenschutz (privacy policy) and AGB (terms) pages exist at /privacy and /terms but require JavaScript to render. Jurisdiction: Switzerland (operator-published, homepage footer: 'Made in Switzerland' with 🇨🇭 flag; confirmed by monerica.com location). Switzerland is not an EU member and has strong banking-privacy traditions and data-protection laws independent of GDPR. The presence of an /imprint (Impressum) page linked from the footer is a German-language legal requirement that implies real-registration compliance — Swiss GmbH/AG entities must publish an Impressum with company name, address, and registration number. End-to-end encryption: Operator-published description on monerica: 'end-to-end encrypted.' No technical details (algorithm, key exchange, protocol) are published on the homepage or discoverable publicly. The claim is published but unverifiable without JS access to the privacy/about pages. Tor mirror: Advertised at `http://lowqj5zmuyq3wvpzwoyxbfocqjywxgfubpx2fzijccriguyqjk2cciad.onion/`. The clearnet `Onion-Location` header is correctly set, so the Tor mirror auto-discovers from the clearnet page. No user accounts: monerica.com tags the service as 'Account Not Required.' The homepage title and tagline do not reference registration. The JS shell shows no login/signup CTAs (The publicly-observable footprint: directory sweep found /login, /signup, /register all 404). Impressum (legal disclosure): The presence of /imprint linked from the footer (operator-published, homepage navigation) is a strong jurisdiction-compliance signal: Swiss and German law require websites offering commercial services to publish operator identity and contact information in an Impressum. If the Impressum contains a real company name and Swiss address, this would be a verifiable trust signal — but the page required JS and is not visible without rendering. Operational specs. Architecture: JavaScript SPA (operator-published, homepage: 'Diese App benötigt JavaScript.'). The homepage renders at 15KB as the main shell. All navigation pages (/about, /privacy, /terms, /help, /imprint) are client-side routes that require JavaScript to render. Monero support: A Monero price ticker ('1 XMR ≈...') is visible on the homepage (operator-published). Specific coin/token support beyond XMR is not published on the homepage and Pricing / fees: no operator-published fee schedule surfaced. The /terms (AGB) page likely contains fee information but is not visible without rendering. Contact channels: None discovered publicly — email, Twitter, Telegram, Matrix, SimpleX all return null. The /imprint page (not rendered) would be the expected location for operator contact information under Swiss/German legal norms. Tor mirror: Onion at `http://lowqj5zmuyq3wvpzwoyxbfocqjywxgfubpx2fzijccriguyqjk2cciad.onion/` with correct `Onion-Location` header. The mirror resolves to the same JS SPA. Location / jurisdiction: Switzerland (operator-published, homepage footer; confirmed by monerica.com). v0.9.66 version string suggests pre-1.0 release. Founded 2026-02-10 — approximately 4 months old at listing time. No peer reviews: Zero reviews on monerica.com. Not listed on kycnot.me. Single-source trust signal (1 peer-directory match only).

Operator philosophy. The operator's branding is minimalist and privacy-forward: 'Kaufen. Verkaufen. Vergessen.' (Buy. Sell. Forget.) — three verbs that promise transactional privacy with no residue. The choice of Switzerland as jurisdiction, German as the primary language, and the inclusion of an Impressum (a German-language legal-compliance norm) all suggest a real operator establishing a legally compliant Swiss entity rather than a jurisdiction-shopping anonymous shell. The v0.9.66 version number and Feb 2026 founding date place this firmly in early-release territory — a product being actively built, not a mature marketplace.

Grade rationale. Listed at Grade B- because: (1) Switzerland is one of the strongest privacy jurisdictions globally for a crypto marketplace; (2) the Tor mirror has a correctly configured `Onion-Location` header for auto-discovery; (3) monerica.com confirms the listing with No KYC and Account Not Required tags; (4) the operator publishes explicit privacy claims (no tracking, end-to-end encrypted) and a jurisdiction-framed Impressum page that implies legal registration. Grade A is withheld because: (a) only one peer-directory match (monerica only — kycnot doesn't list); (b) the JavaScript-only.SPA left every legal page (privacy, terms, about, Impressum) is gated behind JavaScript rendering, which excludes privacy-conscious readers on Tor Browser Safer/Safest, NoScript, or JS-disabled hardened browsers — a meaningful accessibility weakness for a privacy marketplace specifically; (c) zero user reviews on any platform; (d) no operator identity or contact channel is surfaced outside the Impressum. Among marketplaces at this tier, rendering the legal pages server-side for audit access, accumulating a review history, and getting a second peer-directory listing would justify A.

Tenure. Publicly verified on xmr.club since 2026-06-07 — 27 days as of this note. Grade B− reflects short tenure alongside otherwise-clean structural signals — the minus is anchored to that short window, not to any specific operational concern. Tenure counts against grade lift on exchange-class listings; a 90-day re-check is scheduled for 2026-09-05 to reassess.

Caveats. onion does not appear in clearnet Onion-Location header — drift caveat'. The actual pages (/about, /privacy, /terms, /help, /imprint) exist and are linked from the homepage navigation, but their content is gated behind JS. This is a probe limitation, not a site gap — the render the site in a real browser.Whether a marketplace is custodial or non-custodial depends on the settlement model (escrow vs direct wallet-to-wallet), which is unreadable without JS. verify and override the tag before publishing. The German-language-only interface limits accessibility for non-German-speaking users but is a credible jurisdiction signal — it suggests the operator is building for a Swiss/German/DACH-region user base rather than a generic international audience.