Privacy Policy

1. What we collect

• Roblox username — required at checkout. It’s the only way to find you in-game.
• Email address — optional at checkout, required if you create an account or contact support. Used for receipts, order updates and replies.
• Payment information — processed and stored by Stripe. We never see or store your full card number.
• Your name and message — if you use the support or contact form.
• A hashed IP address and your browser’s user-agent string — recorded with public form submissions so we can investigate abuse. The IP is hashed with a secret salt before it is stored; we do not keep raw IP addresses.

2. How we use it

• To process and deliver your order.
• To send your receipt and order updates.
• To answer your support messages.
• To rate-limit and screen public forms against abuse.

We do not profile you, we do not build an advertising audience, and we do not send marketing email.

3. Who we share it with

We don’t sell your personal data. We share it with:

• Stripe — to take payment. Stripe receives your email and payment details.
• Supabase — our database and sign-in provider. Stores your order, your Roblox username and, if you gave one, your email.
• Resend — to send receipts and support replies. Receives your email address.
• Vercel — hosts the site and processes request logs, which we keep free of personal data.
• Cloudflare — bot protection on our public forms.

4. Cookies

We set two cookies: one to remember your cart, and one to keep you signed in if you have an account. Both are strictly necessary, which is why there is no cookie banner on this site.

We do not run Google Analytics, advertising pixels, a tag manager, or any third-party tracking script.

5. How long we keep it

Orders: 90 days after payment we remove the personal data from your order — your email address and your Roblox username are erased and replaced with a marker. The order itself (what was bought, for how much, and when) is kept, because it is a financial record we are required to be able to produce. After that point the order can no longer be traced back to you, and we can no longer look it up for you.

Support tickets: anonymised 90 days after they are resolved — name, email and message are removed, the ticket reference and its timing are kept.

Contact messages: deleted outright after 90 days.

Rate-limit records: deleted after 24 hours.

This runs automatically, once a day. It is not a promise we keep by hand.

6. Your rights

You can ask us for a copy of your data, or ask us to delete it. Contact us on our support page or at support@rovaloot.com and we’ll process the request within 30 days. Deleting your data means we can no longer look up your past orders.

7. Children’s privacy

RovaLoot is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us data, contact us immediately and we will delete it.

8. Changes to this policy

We may update this policy. The “last updated” date at the top of this page reflects the most recent revision.

9. Contact

Questions about privacy? Reach us on our support page or on Discord.