What we store
| Data | When | Why |
|---|---|---|
| Minecraft username (and the public UUID Mojang returns for it) | Orders, spins, giveaway entries, reviews, referrals | To deliver to the right account and to tie coupons, credit and rewards to you |
| Order details: items, prices, status, timeline, payment method, the payment reference you submit (transaction id or PayPal e-mail), your optional order note | Every order | To fulfil the order, confirm payment and handle disputes |
| E-mail address | Only if you enter one at checkout | To contact you about that order. Shown masked on the public order page |
| Hashed IP address (one-way hash with a secret salt β we cannot reverse it) | Orders, spins, giveaway entries, rate-limited requests | Spin cooldowns, one-entry-per-person giveaways, and stopping abuse of the API |
| Random device id (a random string stored in your browser) | Spins and giveaway entries | Spin cooldowns per browser; it identifies the browser, not you |
| Review text and rating | If you leave a review | Shown publicly with your username after approval |
| Discord account: id, username, avatar, and β if we check it β whether you are a member of our Discord server | Only if you log in with Discord (optional) | To recognise you, apply the daily-spin rules to your account and show you your own orders. We never see your Discord password or e-mail. |
We do not store payment card numbers, PayPal passwords, wallet keys or your Minecraft password β we never ask for them. We do not run analytics trackers or advertising pixels on this site.
Why we store it
To fulfil your order and keep a record of it (contract), to prevent fraud and abuse of free promotions (legitimate interest), to show reviews you chose to publish (consent), to keep you logged in when you chose to log in with Discord (contract). That is the complete list of purposes. We do not build profiles, we do not sell or rent data, and we do not send marketing e-mails. The controller is the operator named in the legal notice.
Third parties that see some of it
- Netlify hosts the site, the API and the database (Netlify Blobs). Their servers process requests, including your IP address, under their own privacy policy.
- Discord. New orders, payment reports and spin wins trigger a notification to our private staff channel via a webhook. It contains the order id, username, items and total β not your e-mail or IP.
- Payment providers. PayPal, Stripe, NOWPayments or the crypto network you use see the payment itself under their own policies. Where a provider is integrated we pass them the order id and amount; we receive back a payment status and reference.
- Mojang API. We look up usernames to validate them; the request contains only the name.
- mc-heads.net. Review cards and some pages load avatar images for usernames from this service; your browser requests the image directly.
- Discord (login). If you use βLogin with Discordβ, Discord asks you to approve sharing your account id, username and avatar (and your server list if we check membership). The login happens on Discord's site under Discord's privacy policy; you can revoke it any time in Discord β Settings β Authorized Apps.
- Google Fonts. Fonts are loaded from Google's servers, which see your IP address when the page loads.
Cookies and local storage
We set no tracking cookies. Two technical cookies exist only if you log in with Discord: dc_session (your signed login, HttpOnly, 30 days or until you log out) and dc_oauth_state (10 minutes, protects the login against forgery). The site keeps a few things in your browser's local storage so it works smoothly: your cart, your chosen currency, a referral or discount code you entered, the random device id mentioned above, your cookie-notice choice, and β only if you are staff β an admin session token. You can clear all of it through your browser settings at any time; the only effect is an empty cart, a new device id and being logged out.
Retention
Orders are kept for as long as we need them to handle disputes and chargebacks, typically 12 months after delivery, then reduced to anonymous totals. Spin and giveaway records are kept for the duration of the cooldown or giveaway plus a short buffer. Reviews stay published until you ask us to remove them.
Your rights
You can ask us what we store about a username or Discord account, ask for it to be corrected or deleted, withdraw consent for a published review, and have your Discord login data removed (log out, revoke the app in Discord and tell us). We will do it unless we are legally required to keep a record (for example an order under an open payment dispute or a tax record). Depending on where you live you may also have the right to complain to a data-protection authority β in the EU that is the authority of your country of residence.
Contact
Privacy requests go to our Discord. Please include the username or order id the request is about.
See also: Terms of Service Β· Refund Policy
