Legal
Privacy Policy
Last updated 2 November 2026 · 13 sections
The short version
- We collect only what we need: your account, payments and orders. Without an account, just your email and the order.
- Discord sign-in reads your username, email and avatar, nothing else.
- A gift recipient's email is used only to deliver that gift.
- Besides order emails, at most a few one-off reminders, each with a link to stop them.
- Analytics (PostHog) with masked inputs; no advertising cookies, and we never sell your data.
This summary is for convenience. The full text below is what applies.
01Information we collect
We only collect what we need to run the shop:
- Account: your email address and a hashed password. If you sign in with Discord, your Discord user ID, username, verified email address and avatar. We never get your Discord password.
- Buying without an account: your email address, the items you picked and the payment for that order.
- Payments: top-up records (amount, currency or coin, status, provider reference). Crypto payments are processed by NowPayments and card payments by DebloMassi. You enter your card details on DebloMassi's page; we never see your card number, and we never see or store wallet private keys.
- Orders: what you bought and when, the gift links delivered to you (stored encrypted), and for boosts the invite link and the server's public name, icon and boost count.
- Gifts: the recipient's email address, the name and note you add, and when the gift was sent and revealed.
- Stock alerts: if you ask to hear when an item is in the shop, your email address and that item.
- Wishlists: the items you save. If you share your wishlist, anyone with its link sees those items and, for Discord accounts, your display name; never your email address.
- Server logs: IP address, timestamp and request path.
02How we use it
To run the shop: sign you in, credit payments, deliver orders, email gifts, show you your order history, prevent abuse, answer support requests and understand how the shop is used so we can improve it. We do not sell your data or share it with anyone for advertising.
03Emails we send
Most emails are about something you did: order and delivery emails, gift emails, password resets and replies to your messages. Besides those we send at most a few one-off emails:
- If a payment you started doesn't go through, one reminder with a link back to your items, also when you bought without an account.
- If you made an account but haven't bought anything yet, one welcome email in the first week.
- If you asked for a stock alert, one email when that item is in the shop.
- Each reminder has a link to stop reminders. Order, delivery and gift emails always arrive.
04If someone sent you a gift
The sender gave us your email address so we could deliver their gift. We use it only to send you that gift email (and again if the sender resends it). You don't need an account to reveal a gift, and we don't add you to any mailing list.
05Analytics
We use PostHog, a product analytics service, to understand how visitors use the shop. It records page views, searches, the page or campaign you arrived from, and session recordings in which all form inputs are masked. Once you sign in, these events are linked to your account ID and email address. If you buy without an account, they are linked to that order's customer ID, without your email address. Purchases and top-ups are recorded by our server. Analytics requests are sent through our own domain and processed by PostHog Inc. in the United States. PostHog stores a random identifier in a cookie and in your browser's local storage. If your browser sends a Do Not Track signal, analytics are disabled.
06Error monitoring
When errors occur on our servers we may send technical diagnostics to Sentry, without personal data. This is used only to find and fix bugs.
08Service providers
We share the minimum data needed with the providers that run parts of the shop:
- NowPayments: payment processing.
- Discord: sign-in with Discord, and looking up the public details of the invite link you enter for boosts.
- Our item and boost suppliers: receive the item or invite link and an order number, never your email or account details.
- DebloMassi: card payment processing.
- Resend (Resend Inc., United States): sends our emails, which means it processes your email address and the content of each email.
- PostHog: analytics (see section 5).
- Sentry: error monitoring (see section 6).
09Data storage and security
Gift links are encrypted at rest, passwords are stored as salted hashes, and access is restricted to authorised personnel.
10Data retention
Account data and orders are kept for as long as your account exists. Orders without an account, and the email address they were placed with, are kept as long as we need them to deliver the order, help you with it and keep our payment records. Server logs are kept for up to 90 days. To have your account and personal data erased, email [email protected]; we'll erase it except for payment records we're legally required to keep.
11Your rights
You can access, correct, export or delete your personal data. Email [email protected] and we'll respond within 30 days. You also have the right to lodge a complaint with a data protection authority.
12Changes to this policy
We may update this policy. Changes will be posted on this page with an updated date.
13Contact
The controller of your personal data is OurCompany.Vision Limited, 60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051. Privacy questions? Email [email protected].