1. Information We Collect
Account Information
When you create an account, we collect:
- Username — your chosen display name on the platform
- Email address — used for account verification, authentication, and support communications
- Password — stored as a bcrypt hash with salt; we never see or store your plaintext password
- Profile information — optional avatar, banner image, and bio you choose to provide for your virtual identity
Usage Information
As you use the platform, we automatically collect:
- Session data — login timestamps, IP address, browser user-agent, and session duration for security purposes
- Activity data — virtual listings you create, messages you send, interests you express, and favorites you save
- Device information — browser type, operating system, and screen resolution (for responsive design)
User-Generated Content
Content you create on the virtual platform, including:
- Listing details (titles, descriptions, images, pricing)
- Messages sent through the platform's messaging system
- Reviews and ratings left for other users
- Support ticket communications
2. How We Use Your Information
We use the information we collect to:
- Provide and maintain the virtual marketplace platform, including listings, messaging, and user profiles
- Authenticate and secure your account, prevent fraud, and detect unauthorized access
- Facilitate communication between buyers and sellers through our virtual messaging system
- Send notifications about messages, interest requests, listing updates, and support ticket responses
- Improve the virtual platform by analyzing usage patterns and fixing bugs
- Enforce our Terms of Service and comply with legal obligations
- Provide customer support when you reach out to us
3. Data Storage & Security
We take security seriously and implement the following measures:
- Encryption in transit — all data transmitted between your browser and our servers is encrypted via TLS/SSL
- Password hashing — passwords are hashed using bcrypt with 12 rounds of salting
- Session management — sessions are stored server-side with IP and user-agent fingerprinting; invalid sessions are automatically revoked
- Rate limiting — API endpoints are rate-limited to prevent abuse
- CAPTCHA protection — registration and login are protected by Cloudflare Turnstile
- Input sanitization — all user input is sanitized to prevent XSS attacks
- CSRF protection — cross-site request forgery checks on all state-changing requests
4. Cookies & Tracking
We use the following cookies:
- Session cookie (
session_token) — an HttpOnly, Secure, SameSite=Strict cookie used to authenticate your session. This is essential for the platform to function and cannot be disabled.
We do not use:
- Third-party advertising cookies
- Analytics tracking cookies
- Social media tracking pixels
- Cross-site tracking mechanisms
Our service worker (sw.js) may cache static assets for offline access, but does not track your browsing activity.
5. Data Sharing
We do not sell your personal information to third parties. We may share your information only in the following circumstances:
- With other users — your username, avatar, bio, and reputation score are visible on your virtual public profile and listings. Your email is never shared with other users.
- With service providers — we use Cloudflare for hosting, CDN, and security services. Cloudflare's use of your data is governed by their Privacy Policy.
- For legal compliance — we may disclose information if required by law, court order, or to protect the rights and safety of our platform and users.
- In case of business transfer — if we are involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.
6. Your Rights
You have the following rights regarding your data:
- Access — you can view all your account data through your profile and settings pages
- Correction — you can update your username, email, avatar, banner, and bio at any time through Settings
- Deletion — you can request account deletion by contacting us on our Discord. Upon deletion, your account data, messages, and listings will be permanently removed.
- Export — upon request, we can provide a copy of your account data in a machine-readable format
- Objection — you can opt out of non-essential notifications through your notification settings
7. Data Retention
We retain your data for as long as your account is active:
- Account data — retained until you delete your account
- Messages — retained as part of your conversation history until you delete them or your account is deleted
- Session data — automatically expired after 7 days of inactivity
- Security logs — retained for up to 90 days for security auditing purposes
- Support tickets — retained for 1 year after closure for reference purposes
8. Children's Privacy
The Smallverse Market virtual platform is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete such information promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the platform or via email. Your continued use of the platform after changes constitutes acceptance of the updated policy.
10. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:
- Discord: Join our Discord
- Platform: Submit a Support Ticket