Privacy Policy
Last updated: 5 August 2026
1. Data We Collect
When you sign in with Discord or Google, we collect your display name, email address (if provided by the provider), and profile image. We also collect purchase history and account balance associated with your account.
Our servers record technical data needed to run and protect the service: your IP address and browser user agent are used for security checks, abuse prevention and rate limiting, and we log which parts of the site you interact with.
When you buy a code we record, and keep for as long as the transaction can still be disputed, the fact that you confirmed at checkout that you wanted immediate delivery and understood this ends your 14-day withdrawal right, together with the exact wording you were shown, the time, your IP address and your browser user agent. We are required to be able to prove this and cannot delete it on request while it is still relevant.
If — and only if — you accept analytics cookies, we additionally collect the usage data described in section 5.
1a. If You Bought From Us on eBay
We also sell through eBay. When you buy there, eBay passes us your eBay username, the delivery details attached to the order and, where eBay provides one, your email address. We did not receive this from you directly, so this section is your notice under Article 14 GDPR.
We use it to fulfil the order, to send you your codes through eBay's messaging system, to build the order page holding your codes, and to keep the records tax law requires. We create a lightweight account in your name so the same codes stay reachable from your order page. The legal basis is performance of the contract and our legitimate interest in keeping delivery records. Your order details are also forwarded to our own Telegram admin channel so a human can intervene when fulfilment fails (see section 4).
You have the same rights over this data as any other customer — see section 7.
1b. If You Checked Out As a Guest (No Account)
You can buy without signing in: give us an e-mail address, pay, and we send your codes to that address instead of a dashboard. Doing this creates the same kind of lightweight account described in section 1a — no password, no sign-in — so the codes stay reachable from your order page and so we can keep the records tax law requires. The legal basis is performance of the contract.
We also let you send yourself a test e-mail before paying, to check the address is typed correctly. That message contains no order data and is not itself a record of anything.
You have the same rights over this data as any other customer — see section 7.
2. How We Use Your Data
Your data is used to operate your account, process purchases, provide customer support, keep the service secure, and — with your consent — to understand how the site is used. We do not sell your personal data to third parties.
3. Legal Bases (GDPR)
- Contract — account data, purchases, code delivery and support.
- Legitimate interests — security, fraud and abuse prevention, rate limiting.
- Consent — analytics and session recording (section 5). You may withdraw it at any time and the service keeps working normally without it.
- Legal obligation — retaining transaction records where tax or accounting law requires it.
4. Who Else Sees Your Data
We do not sell your personal data. These are every party that receives any of it, and why:
| Recipient | What they receive | Why |
|---|---|---|
| Discord, Google | The sign-in data you authorise | Authentication (OAuth 2.0). We only receive what you grant. |
| Stripe, PayPal | Payment amount and the identifiers they need | Taking payment. We never see or store your card details. |
| Telegram | Order notifications: your display name, account id, items and, for eBay orders, the name, address and phone number eBay supplies | Alerting the shop operator so orders and failures are handled by a human. Telegram is outside the EU/EEA. |
| eBay | Order and message data for eBay purchases | Selling and delivering through the eBay marketplace. |
| Cloudflare | Your IP address and request metadata | Serving the site and blocking attacks. Acts as our processor. |
| Google Analytics, Microsoft Clarity | The usage data in section 5 | Only if you accept analytics cookies. |
| Google (Firebase), Apple, Mozilla push services | A push subscription identifier, for creators who enable notifications | Delivering the browser notifications you asked for. |
| Twitch, YouTube | Nothing about you. We only read public channel data for creator profiles. | Displaying creator profiles and live status. |
| Cloudinary, Cloudflare R2 | Images you upload (product and overlay assets) | Media hosting. |
Twitch sign-in was removed. If you linked a Twitch account before that, we still hold the identifiers needed to show your creator profile; ask us and we will delete them.
5. Analytics and Session Recording
These tools load only after you accept analytics cookies. Until then no analytics request is sent and no analytics cookie is set.
- Google Analytics 4 (Google Ireland Ltd.) — pages visited, approximate location derived from IP, device and browser type, and referring site.
- Microsoft Clarity (Microsoft Ireland Operations Ltd.) — records your session: mouse movement, clicks, scrolling and the page content you saw, aggregated into heatmaps. Clarity masks text input fields by default, so what you type into forms is not captured.
Both providers act as processors and may transfer data outside the EU/EEA under the EU–US Data Privacy Framework and standard contractual clauses. You can withdraw consent whenever you like from our Cookie Policy.
6. Data Retention
These periods are enforced by an automated daily job, not by hand:
| Data | Kept for |
|---|---|
| Account details | As long as the account exists, then erased on request |
| Interaction logs (which parts of the site you used) | 90 days |
| Rate-limit records | 30 days |
| Anti-abuse counters (failed lookups, temporary IP blocks) | 1 hour to 24 hours, then they expire on their own |
| Server request logs | Rotated automatically; roughly the last 50 MB of activity |
| Order pages holding your codes | Indefinitely — so you never lose access to codes you paid for |
| Purchase and payment records, ledger entries | As long as tax and accounting law requires |
| Your checkout confirmation about immediate delivery | As long as the purchase can still be disputed |
| Database backups | The 7 most recent daily copies |
| Google Analytics | Up to 14 months, held by Google |
| Microsoft Clarity recordings | Up to 30 days, held by Microsoft |
7. Your Rights (GDPR)
If you are in the EU/EEA, you have the right to access, correct, delete, or receive a portable copy of your personal data. You may also object to or restrict processing, withdraw consent at any time, and lodge a complaint with your national data protection authority.
E-mail [email protected] from the address on your account and we will answer within one month. Access and portability requests are answered with a machine-readable export of everything we hold on you.
Two limits apply to erasure, and we would rather state them than surprise you with them. Your purchase and ledger records are kept because tax law requires it, and the confirmation you gave at checkout about immediate delivery is kept because we may need it to defend a refund claim. Everything else is deleted and your account is stripped of anything that identifies you, so the remaining rows no longer point to a person.
8. Cookies
See our Cookie Policy for details on how we use cookies and local storage.
9. Contact and Data Controller
The controller responsible for the processing described above is:
Potenza Patrik
Via Mombasiglio 60, 10136 Torino, Italy
E-mail: [email protected]
VAT: Not VAT registered — no VAT is charged on these sales
Register: Not registered — sole trader (private individual)
We answer e-mail within 2 working days. For faster informal help, our Discord is also open — but e-mail is the channel of record for complaints, withdrawal notices and data protection requests.