Privacy
What we collect, why, how long we keep it, and what you can ask us to do about it.
Draft. This has not been reviewed by a lawyer. It describes what the site actually does today, which is the part we can state accurately without one.
Last updated: 18 September 2026
1. The short version
We collect what a marketplace needs to work and to stay honest: an email to sign you in, a date of birth to check you are 18, the trades you make, and some technical records that let us spot fraud. We do not sell anything about you, we do not run advertising trackers, and we never see your card number.
We are not Roblox, and we are not the developer of any game whose items are traded here.
2. What we collect, and why
To give you an account
Your email address. A date of birth, once, at signup. A handle, which is public and is how the site names you. Optionally a display name and a short profile blurb, both of which you write and both of which are public.
We do not store a password, because there isn’t one — you sign in with a link sent to your email.
To check you are old enough
Your date of birth is stored and we do arithmetic on it. If you tell us you are under 18 we refuse the account and keep a one-way keyed hash of the email address, so the same address cannot simply try again. We do not keep the address itself, and because the hash is keyed with a secret only we hold, nobody else can test a guessed address against that list.
To run trades
What you list, what you buy, what you sell, prices, and the state of each order. Messages you send in an order thread. Reviews you write and reviews written about you. Which game account you verified, and its username — that is public on your profile, because the person trading with you needs it.
To move money
Deposits and withdrawals: amount, currency, state, and a reference from our payment processor. We never receive, see or store your card number — that goes directly to Stripe. If you sell and get paid, Stripe collects whatever identity documents it needs and holds them; we store only an opaque account reference and whether you are currently payable.
To keep the marketplace from being robbed
When you sign in we record two one-way values: a hash of your IP address and a hash of your browser’s user-agent string, both keyed with a secret only we hold. Neither can be read back. We also keep a coarse, readable label such as “Chrome 141 on Windows”, which is all a person needs when looking at a record and is not specific enough to single anybody out.
When a trade is disputed or a withdrawal is requested, we compare those values — and the payout destination — between the two sides, because two accounts that are really one person is the most common way a marketplace is stolen from. The result is shown to a human, who decides. Nothing is refused automatically on this basis.
We also keep an audit log of actions that move money or change permissions: who did what, to what, and the values before and after.
To tell sellers whether anyone is looking
When you view a listing we record that a view happened. What we store is not you: it is a one-way value combining your identity with the day, so the same person produces a different value tomorrow and the table cannot be turned into anyone’s browsing history. No IP address, no user agent and no account id is kept against a view. A signed-out viewer is not counted at all.
3. What we do not do
We do not sell or rent personal information. We do not run advertising or analytics trackers, and there are no third-party pixels on this site. We do not build a profile of you for anything other than fraud prevention, and we do not buy data about you from anyone.
4. Who can see what
Other users see your handle, your profile blurb, your verified game username, your reviews and your record as a seller. Your record as a buyer — whether you turn up for trades — is shown only to someone you are actually trading with, to staff, and to you.
Our staff can read order threads and disputes, and see the fraud signals above. They cannot post in your conversations.
Our processors, who act on our instructions: Stripe (payments and payouts), our email provider (sign-in links), and our hosting and database providers.
Nobody else, unless we are legally required to hand something over.
5. How long we keep it
| What | How long | Why that long |
|---|---|---|
| Your sign-in session | 30 days, then deleted 90 days after it expires | Past expiry it signs you in to nothing. It is kept a little longer only so the fraud comparison below can still see it — a check with a 30-day memory is one that can be waited out. |
| Sign-in links | 15 minutes, deleted 1 days after that | These hold your address in plain text, on purpose, so that asking for a link for an address with no account behaves exactly like asking for one that has. |
| Listing views | 90 days | Sellers are asking about this week. |
| Rate-limit counters | 1 days | They count minutes. |
| A handle you gave up | 60 days' quarantine, then forgotten | The quarantine stops somebody taking your name the moment you change it. After it, the record serves nothing. |
| Orders, ledger, deposits, withdrawals | As long as the law requires | The other side of your trades has a right to their own history, and a chargeback can arrive months after the order it disputes. Kept even if you close your account. |
| Audit log | Indefinitely | It exists so that we cannot quietly undo something, and a record with an expiry date is one that can be outwaited. It holds no readable address and no browser string. |
| A refusal at the age screen | Indefinitely | The point of it is that it cannot be outwaited by trying again later. It holds no address, only a one-way keyed digest. |
6. Your rights
Depending on where you live you can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, or object to some of it.
A copy
Email support@s6n.se from the address on the account. We will send you a machine-readable file of your account, your listings, your orders, your offers, the messages you wrote, your reviews, your deposits and withdrawals and your ledger entries. It will not contain your sign-in tokens, the keyed hashes (they are one-way and say nothing to you), your two-factor secret, the other side’s messages, or staff notes about your account — and the file lists what it leaves out and why.
We answer that by hand rather than with a download button, because a download button hands your whole account to whoever takes over your email.
Correction
Your handle, display name and profile blurb are yours to edit on your account page. Anything else, ask us.
Closing your account
You can close it yourself. We erase your display name, your profile blurb, your date of birth and your two-factor secret, your handle is released, anything you were selling is delisted, and every session is signed out.
We refuse to close an account over an order still in progress or a balance still held. The first would leave somebody waiting for an item or their money; the second would be us quietly keeping yours. Finish or cancel, withdraw, then close.
What stays after you close, and why
Your orders, your ledger entries, the reviews you wrote about other people, and your email address. The address is the key to those money records and to a dispute that has not arrived yet. That is not us keeping your data because it is convenient — it is that deleting it would delete somebody else’s record of a trade they were part of. Once the chargeback window on your last order has passed, ask us and we will erase the address too.
A refusal at the age screen cannot be deleted on request. It exists precisely so that the refusal cannot be undone by asking again.
7. Cookies
One cookie, for your session, so the site knows you are signed in. It is not used for tracking and there is no third-party cookie here. Your theme choice is stored in your browser and never sent to us.
8. Under 18s
You must be 18 to use this site. We do not knowingly collect anything from anyone under 18; if we find out we have, we freeze the account, return the balance and keep only the refusal record.
9. Changes and contact
If we change this in a way that matters we will say so on the site rather than quietly updating the date. Questions: support@s6n.se.
See also the terms of use.