Privacy policy

Who handles your data

The controller is the owner of The Loot Store. For anything related to your data, write to contact@thelootstore.es.

What is collected and why

If you use the contact form: your name, email address and the message you write. The only purpose is to reply to you. The legal basis is your consent, given by ticking the box on the form.

The contact form message is sent by email to the shop's mailbox and is not stored in any database on this site. What happens inside the game is explained in the next section.

The game (LOOT WORLD)

LOOT WORLD is optional and can be used without giving any data: you can walk around with no name at all. If you pick one, it is a nickname you make up and it does not need to be your real name.

While you are inside, that nickname, your character's colours and its position are shared in real time with anyone playing at the same time, so you can see each other. They are deleted a few seconds after you close the tab.

If you write in the chat, the message is shown to everyone inside and stored alongside your nickname, for at most twenty-four hours and at most one hundred lines. After that it disappears on its own. Writing is voluntary and requires having picked a nickname.

When you save a piece to your bag or open WhatsApp to ask about one, that action is recorded with your nickname and the piece, in the same list and with the same twenty-four hour limit. It lets the shop know what people are interested in, and lets whoever walks in see there is movement. The legal basis is the shop's legitimate interest in understanding demand for its catalogue.

The anonymous walk-throughs that keep the shop from looking empty store only coordinates and three colours: no nickname and nothing that could identify anyone.

If you also leave your email in the welcome, it is written down next to your nickname in a notebook whose only purpose is to recognise you: coming back from another device, you can type your email and the game recovers your nickname. It is voluntary, the legal basis is your consent, and it is kept for one year from your last visit — after that it deletes itself, and you can ask for it to be deleted sooner by writing to contact@thelootstore.es.

Your own browser — never leaving your device, beyond what is described above — stores your game preferences (nickname, your character's look, hairstyle, zoom level, music setting, the bartender's word and the "already seen the welcome" marks). The bag stores only the references of the pieces you set aside, with no personal data, and empties when you close the tab.

Cookies and analytics

This site uses no tracking cookies and no analytics tools. Fonts are served from this domain, so browsing makes no requests to third-party servers either.

The only cookie in use is the admin panel session, which affects only the shop owner and is strictly necessary for that panel to work.

Who else sees your data

Hosting is provided by Vercel Inc. and email by Piensa Solutions. Both act as processors and handle the data solely to provide their service.

The live game state — who is inside, the chat, the activity list and the email notebook — is stored on servers run by Upstash Inc., acting as a processor. The images shown on the game's screens are hosted by Vercel Inc.

If you prefer to write on WhatsApp or Instagram, that conversation is governed by Meta's privacy policies, which are outside this site.

How long it is kept

Contact form messages stay in the mailbox for as long as needed to deal with your enquiry and meet legal obligations. You can ask for them to be deleted at any time.

Game data expires on its own: presence a few seconds after you disconnect, chat and activity after twenty-four hours, and the email notebook one year after your last visit. These are not promises — they are limits enforced by the store itself. The shop can also clear those lists at any time.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to contact@thelootstore.es. You may also complain to the Spanish Data Protection Agency (aepd.es).