Privacy policy

1. Who is responsible for your data

The data controller is LootBazar. For any question about your data, write to us at [email protected].

2. What data we keep

• From Discord, when you sign in: your account id, username, display name and the link to your avatar. We do not receive your email address or your password.
• When your account was created, the version of the terms you accepted and when you accepted it.
• Sign-in sessions: the session code, stored only as a cryptographic fingerprint (hash), with its creation and expiry dates.
• The listings you publish, with the item data and screenshots. Listings are public.
• Technical data: hosting providers keep request logs (for example, IP addresses) for a short time, for security.

3. Why, and on what legal basis

• to create and run your account and listings — performance of a contract (Art. 6(1)(b) GDPR);
• to protect the platform against fraud and abuse — our legitimate interest (Art. 6(1)(f));
• to keep proof that you accepted the terms — our legitimate interest.

We make no automated decisions that affect you and we do no marketing profiling.

4. How long we keep it

• your account and its data: as long as you have the account;
• a session: until you sign out, or after 30 days without use;
• after your account is deleted, its data is deleted, except what the law requires us to keep.

5. Who else sees it

Your listings and display name are public. Otherwise, data is processed on our behalf by providers:

• Neon — the database, hosted in the EU (Frankfurt);
• Railway — the application servers, in the EU (Amsterdam);
• Cloudflare — the network that delivers the site to you, and the contact email.

Some of these providers are companies based outside the EU. Transfers use the safeguards required by the GDPR: standard contractual clauses or the EU–US Data Privacy Framework.

When you sign in, your data is also processed by Discord, under its own privacy policy. Your avatar is loaded from Discord’s servers.

We do not sell your data and we do not share it with anyone for marketing.

6. Cookies

We only use strictly necessary cookies, without which signing in does not work:

• lb_session — keeps you signed in;
• lb_oauth — links the return from Discord to your browser, for 10 minutes.

Your chosen theme (day or night) is stored only in your browser. We use no analytics or advertising cookies.

7. Your rights

You can ask to access your data, correct or delete it, restrict its processing and get a copy in a portable format. You can object to processing based on our legitimate interest. Write to us at [email protected]; we reply within one month.

You can also lodge a complaint with a data protection authority — in Romania, ANSPDCP (dataprotection.ro).

8. Minors

LootBazar is for people aged 16 or over. If we learn that an account belongs to someone younger, we delete it.

9. Security

The connection to the site is encrypted (HTTPS). Session codes are stored only as cryptographic fingerprints, and access to data is limited to what is necessary.

10. Changes

We publish any change here, with its date.