Privacy Policy

1. Who we are

Mystery Market operates an independent marketplace for Roblox in-game items and digital gift links. We are not affiliated with Roblox Corporation, Discord Inc., or game developers. This policy describes our practices only; third-party services (Discord, Roblox, Stripe, etc.) have their own policies.

2. Information we collect

Depending on how you use the Service, we may collect:

• Account identifiers: Discord and Roblox account IDs, usernames, avatars, and OAuth tokens needed to authenticate you
• Order and delivery data: Roblox username at checkout, cart contents, order history, delivery status, redemption keys (stored as hashes), Discord ticket or thread IDs for fulfillment
• Payment metadata: transaction IDs, amounts, payment method type, and status from Stripe, cryptocurrency processors (e.g. NOWPayments), Cash App references, or Roblox game pass confirmations—we do not store full card numbers or wallet private keys
• Technical data: IP address, browser type, device information, cookies or similar identifiers, and security logs (rate limits, failed logins)
• Communications: messages you send to support or in delivery channels related to your order
• Admin and audit data: for authorized staff only— passkey/WebAuthn credentials, admin action logs, and fraud-investigation records

3. How we use information

We use personal information to:

• Process orders, verify payments, and coordinate in-game delivery
• Authenticate users and secure accounts
• Prevent fraud, chargeback abuse, and policy violations
• Provide customer support and resolve disputes
• Maintain, debug, and improve the Service
• Comply with legal obligations and enforce our Terms

We do not sell your personal information. We do not use your data to train general-purpose AI models.

4. Legal bases (EEA/UK users)

Where applicable, we process data based on: performance of a contract (fulfilling your order), legitimate interests (security, fraud prevention, improving the Service), legal obligation, and consent where required (e.g. non-essential cookies if offered).

5. How we share information

We share information only as needed with:

• Payment processors (e.g. Stripe, NOWPayments) to process transactions
• Discord and Roblox when you connect those accounts or when delivery requires in-platform coordination
• Hosting and infrastructure providers (e.g. database, CDN, email) under contractual confidentiality obligations
• Law enforcement or regulators when required by law or to protect rights, safety, and security
• Successors in a merger, acquisition, or asset sale, subject to this policy

6. Cookies and similar technologies

We use essential cookies and session storage for authentication, cart state, and security. We may use analytics or preference cookies where enabled; you can control non-essential cookies through your browser settings. Disabling essential cookies may prevent checkout or sign-in.

7. Data retention

We retain order, payment, and audit records for at least two (2) years to support dispute resolution, tax and accounting needs, and legal compliance. Security logs may be kept for a shorter or longer period depending on risk. You may request deletion of non-essential data where we are not required to retain it; orders tied to financial records may be retained in anonymized or minimized form.

8. Security

We use HTTPS, webhook signature verification, rate limiting, hashed redemption keys, and passkey authentication for admin access. No method of transmission or storage is 100% secure; you use the Service at your own risk and should protect your Discord, Roblox, and payment accounts.

9. International transfers

We may process data in the United States and other countries where our providers operate. By using the Service, you understand your information may be transferred to jurisdictions with different data protection laws. Where required, we rely on appropriate safeguards such as standard contractual clauses.

10. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, or port your personal information, object to or restrict certain processing, and withdraw consent where processing is consent-based. California residents may have additional rights under the CCPA/CPRA (know, delete, correct, opt out of sale—note we do not sell personal information). EEA/UK residents may lodge a complaint with a supervisory authority.

To exercise rights, contact us through your order support channel with enough detail to verify your identity. We may deny requests that are unfounded, excessive, or conflict with legal retention duties.

11. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. Users ages 13–17 should use the Service only with parental permission as described in our Terms. If you believe we collected data from a child under 13, use the order support page and we will take steps to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date will change when we do. Material changes may be communicated through the Service where appropriate. Continued use after updates means you accept the revised policy.

13. Contact

For privacy requests regarding Mystery Market at mystery.markets, use the order support page. Include "Privacy request" in your message and information sufficient to verify your account or order.