Privacy Policy

This policy covers the LootBuy storefront: browsing the catalogue, buying an account, signing in to see your purchases, and talking to support. It describes what actually happens on this site today, and it says explicitly where something is not switched on yet.

When you browse

Nothing that identifies you. The catalogue is a public page and does not require an account. Your basket is stored in your own browser, not on our servers.

When you buy

• Your email address, which is how an order is identified and how you get back to it.
• The order itself: which accounts, the prices at the time, the currency, the language you bought in, and the order's status history.
• A record of each payment attempt on the order, and of any promotion code applied to it.

When you sign in

• Your email address, and the fact that it has been verified.
• If you use Continue with Google, the identifier Google gives us for your account and the email address on it. We never receive your Google password.
• A session record, which includes the IP address and browser user agent the session was created from. That is a security record: it is what makes an unexpected sign-in visible.

When you contact support

• The messages you send, and any images you attach to them.
• Which order the conversation belongs to.

On our servers

Ordinary technical logs of requests to the site, which are used to keep it running and to investigate abuse.

• To sell you an account and deliver it — this is the contract between us, and none of it is optional.
• To let you back into your own purchases — the sign-in link, the session, and the list of what you bought.
• To answer you — support conversations exist to resolve your order.
• To keep the shop safe — session records, rate limits and technical logs exist to detect abuse and to protect accounts.
• To meet legal obligations — where the law requires us to keep a record of a sale.

This site uses a small number of browser storage entries. There is no separate cookie policy: this section is it.

Essential — always available

• A consent cookie recording the choice you made about the optional categories below, so we do not ask you again.
• A sign-in session cookie, once you sign in, so the site knows it is you.
• An order access cookie, so you can return to an order you placed.
• Your basket, stored in your browser's local storage and never sent to us until you check out.

Analytics — off unless you turn it on

Denied by default. Nothing in this category runs, and no request to an analytics provider is made, unless you have positively granted it.

Advertising — off unless you turn it on

Denied by default, on the same terms. No advertising request is made because a page loaded.

It matters to say what is switched off, because a privacy policy that lists providers a shop does not use is not describing the shop.

• Google Analytics is not active. No analytics measurement is collected on this site today.
• Google Ads measurement is not active. No advertising conversion is recorded.
• No payment provider is connected. Online payment is not switched on, so no card or crypto processor receives anything from this site today.
• Transactional email is not yet live in production. The capability exists in the product; sending is not enabled.

If any of this changes, this section changes with it, and the optional categories above stay denied until you decide otherwise.

We do not sell personal data and we do not share it for anyone else's marketing.

Data is handled by the providers that host and run this shop — hosting and infrastructure — and, where you use it, by the sign-in provider you chose. Support images are stored on our own infrastructure.

• Orders are kept as business records for as long as the applicable law requires.
• Sign-in sessions and sign-in links expire on their own and are short-lived by design.
• Support conversations are kept with the order they belong to.
• Technical logs are kept for a short operational period.

Where data protection law applies to you, you have the right to ask for a copy of the personal data we hold about you, to ask us to correct it, to ask us to delete it, to object to or restrict certain uses, and to receive it in a portable form. You also have the right to complain to your national data protection authority.

Some data cannot be deleted on request where we are required to keep it — the record of a completed sale is the usual example.

Account credentials we hold for an order are stored encrypted and are released only to the buyer who is authorised for that order. Sign-in tokens are stored as hashes, never in a readable form. Access to internal systems is restricted by role.

No system is perfect, and we do not claim otherwise. If something happens that affects you, we will tell you what we know.

This shop is not directed at young children, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will remove it.

When this policy changes we publish a new version with its own version number and effective date, both shown at the top of this page. Earlier versions are kept.

Use the contact details on our Help page. Tell us what you are asking for and which email address your orders were placed with, so we can find the right records.