Updated 10 November 2026 · Version 2026-11-10
Privacy & cookies
What information donut-irl uses, who can see it, and how to exercise your rights.
Information we use
Account records include your email if supplied, unique username, selected profile picture, password hash, connected provider identifiers, security status and the version and time of your policy acceptance. Passwords are hashed and are not stored as plain text. Discord or Telegram sign-in supplies identity and profile information; we do not request access to your private messages.
Trading records include listings, prices, quantities, offers, order IDs, delivery usernames and dispute evidence. Chat stores messages, replies, mentions and uploaded pictures or GIFs. Wallet records may include currency, address, amount, status and transaction references when a payment service is connected. Security processing uses request IPs for rate limits and technical request information.
Purposes and legal grounds
We use account, chat and order information to provide the service you request and perform our agreement with you. Security, fraud prevention, moderation and dispute handling serve legitimate interests in protecting users and the marketplace, balanced against your rights. Records may also be kept where needed to meet a legal obligation or establish or defend a claim.
The signup checkbox records your agreement to the Terms and acknowledgement of this notice. It is not consent to marketing or optional tracking, and we do not send marketing through signup. If optional processing later requires consent, it must be requested separately and can be withdrawn.
Visibility and service providers
Usernames, chosen avatars and active listings can be seen publicly, including the homepage preview and shared listing links. Email addresses and seller Minecraft usernames are not in those public previews. Order and private chat information is limited to its participants and authorised admins; admins may search messages to investigate abuse and disputes. Messages are not end-to-end encrypted.
Cloudflare provides hosting, security and the database. Resend delivers verification and password reset emails. Discord and Telegram process sign-in when you choose them. The wallet is designed to use NOWPayments when configured; a disabled payment connection does not process a deposit or payout. A selected externally hosted GIF or provider profile picture can reveal your IP and browser information to its host when loaded. Providers process information under their own applicable terms and notices.
Security and international processing
Access controls, hashed credentials and expiring sessions help protect your account. Do not share sensitive credentials in chat or listings. No online service can guarantee absolute security.
Providers may process information outside the EEA. Applicable transfers require a lawful GDPR transfer basis, such as an adequacy decision or appropriate contractual safeguards. Contact legal@donut-irl.xyz for information about the arrangements applicable to your data; we do not claim that every provider or processing location has an adequacy decision.
Retention
Session credentials last up to seven days, OAuth requests up to ten minutes, signup verification sessions up to thirty minutes with codes lasting ten minutes, and password reset links up to thirty minutes. Security rate-limit windows vary by action. Expired records are ineligible for access and are cleaned up during relevant authentication activity.
Account, trading, chat and financial records are retained while needed to operate the account, resolve an order or dispute, prevent repeat abuse, meet applicable legal duties or defend a claim. Retention depends on the record, unresolved obligations and applicable law. You can request deletion; records that must be retained may be restricted instead. Public blockchains are outside our control and their records cannot be erased by us.
Essential cookies
donut_session keeps you signed in for up to seven days. donut_oauth protects a sign-in request for ten minutes. donut_verification binds email verification to your browser for thirty minutes. donut_reset temporarily authorises the password reset form for up to thirty minutes. These cookies are HttpOnly and use Secure on HTTPS; they are needed for the authentication action you request.
The site does not add advertising or analytics cookies. Your browser can block or delete cookies, but account features may stop working. A cookie consent banner will be needed before adding non-essential tracking that requires consent; the current essential authentication cookies do not add that tracking.
Your rights and contact
Where applicable, you can request access, correction, deletion, restriction or portability of your information, object to processing based on legitimate interests, and withdraw any separately given consent. We may need proportionate proof that a request is yours. Contact legal@donut-irl.xyz. We aim to respond within the GDPR time limit, normally one month, and will explain any lawful extension or refusal.
You may complain to a data protection authority, particularly where you live, work or believe a breach occurred. Contact support@donut-irl.xyz for account help. Material changes to this notice are versioned and shown before further account activity.