Privacy policy

Store visitor analytics

We use a first-party, HTTPOnly visitor cookie lasting up to one year to estimate unique browsers and recent activity. Analytics stores a hashed browser identifier, first/last activity times, daily page-view counts and generalized page categories. It does not store order tokens, query strings, customer names or IP addresses in visitor records. Multiple tabs share the same identifier.

Activity signals are sent every 30 seconds while the page is visible. We respect Do Not Track and Global Privacy Control signals. Clearing the visitor cookie resets the browser identifier. Visitor statistics are available only to authorized administrators.

1. Data Stored (Persisted for Authentication)

A. Hashed Access Token — To secure your order, we store a hashed (one-way encrypted) version of your access token. This hash cannot be reversed to reveal the original token. It is used solely to authenticate your access to the order page.

B. Hashed Key Fingerprints — Delivered keys are stored encrypted at rest using AES-256-GCM. A SHA-256 fingerprint of each key is stored separately to prevent duplicate imports. Neither the fingerprint nor the encrypted key can be reversed to reveal the plaintext key without the server encryption secret.

C. Roblox User ID & Username — Your Roblox user ID and username are stored with your order to perform inventory verification checks. These are public Roblox profile identifiers.

D. Email Address (Optional) — If provided, your email is stored to deliver order confirmation and key delivery notifications. It is never shared with third parties beyond the email delivery provider.

2. Data Processed (Transient / Temporary)

A. Server Verification — During each ownership check, your client sends your order ID to our server for Roblox inventory validation. If validation fails, the request data is processed and discarded. Only the verification result is persisted in the verification attempt log.

B. Rate Limit Records — IP-based rate limit counters are maintained temporarily to prevent abuse. These records expire automatically and are not used for tracking or identification beyond rate enforcement.

3. Data We Do NOT Collect

We do not collect, store, or process: Roblox passwords, payment card information, device hardware identifiers, browsing history, cookies beyond the single HTTP-only order authentication cookie, or any data from your Roblox account beyond public profile and inventory information.

4. Private Order Access

A. An HTTP-only order cookie can authorize access in the current browser. The storefront keeps the access token in session storage when available.

B. Tokens are never added to URLs, never logged in plaintext, and never transmitted to third parties. A manually entered token is kept in page memory only.

C. All sensitive data in transit is protected by TLS encryption. All keys at rest are encrypted with AES-256-GCM.

5. Privacy Requests

Contact support for questions about your information, access, correction, or deletion. Some transaction records may need to be retained to meet legal obligations or resolve disputes. Do not send private tokens in support messages.