Privacy Policy
Our privacy position is data minimalism: we hold almost nothing personal, by design. This page lists everything we store, why, for how long, and how to get it deleted.
On this page
If you just browse
You can use search, listing pages, comparison, and every guide without an account. We set no advertising or cross-site tracking cookies and load no third-party trackers. Product analytics, if enabled, are cookieless and aggregate (page counts, not people) — which is why there is no cookie banner here: there is nothing to consent to.
Standard server logs (IP address, request path, user agent) exist briefly for security and abuse prevention — rate limiting, blocking attacks — and are not used to profile you.
If you create an account
Everything we store about a registered user:
- Email address — your login identity and where the verification link goes. Legal basis: performing the service you signed up for.
- Password hash — a modern, salted password hash (argon2id), if you set a password. We never store or see the plaintext.
- Display name and avatar — the name you go by on LootWise (until you set one, the part of your email before the @) and, if you pick one, the name of a Fortnite cosmetic whose icon is your avatar. You cannot upload a picture.
- Google or Discord sign-in — if you use one, we receive your account ID with that provider, your email address, whether the provider has verified it, and your name there. We store the provider and that account ID, so we recognize you next time; the email becomes your account email when we create a new account, and the name becomes your first display name, which you can change. We store no provider passwords, access tokens, or profile pictures.
- Age confirmation — the time you confirmed you are 13 or older.
- Favorites and saved searches — the listings and filter sets you chose to save.
- Sign-in and email links — a session record per signed-in device, and for each verification or password-reset email a hash of its one-time link (never the link itself). Verification links expire after 24 hours, reset links after one hour.
- Timestamps — account creation, email verification, session expiry.
We also record a few product events — a search (its filters and result count), which account pages you open (the account ID only, no IP), a click through to a listing (which listing, its rank and the sort), a signup and a login (the method used) — to learn what people look for. While you are signed in, those events carry your account ID. They never carry an IP address, a user agent, or a device fingerprint.
That's the complete list. No payment data (nothing is sold here), no profiling, no selling or sharing of personal data with third parties. A single, essential session cookie keeps you signed in; it does no tracking.
Emails we send
Today: a verification email when you sign up or ask for another one, and a password-reset email when you ask for one. That's it. If optional price-alert emails ship later, they will be opt-in with one-click unsubscribe. No marketing lists, no newsletters you didn't ask for.
Listing data contains no personal data
The listings we index are offers by anonymous-to-us sellers on third-party marketplaces. We deliberately store no seller names, handles, avatars, or profile links — only numeric trust signals like a rating percentage (details on the transparency page). Because the listing dataset holds no personal data, we retain it indefinitely as the product's core asset.
Deletion, export, and your rights
- Delete: the account page has a self-serve delete that hard-deletes your user row, sessions, verification and password-reset records, Google or Discord links, favorites, and saved searches — immediately. Backups made before the deletion keep a copy until they age out: copies on our server within about a week, encrypted off-site daily backups within about five weeks, and monthly ones after 12 months. Product events you created stay, with your account ID removed, so they no longer point to anyone.
- Export: email us and we'll send a copy of everything we hold about you (it's the short list above).
- Correct / complain: write to hello@lootwise.gg for any privacy question, correction, or complaint. EU/EEA users additionally have the rights of access, rectification, erasure, restriction, portability, and objection under the GDPR, and may lodge a complaint with their supervisory authority.
Where data lives and changes to this policy
The site runs on reputable cloud infrastructure; user data lives in our own database and is not shared with advertisers or data brokers. Transactional email is delivered through our email provider, which processes the recipient address solely to deliver the message. If this policy changes materially, the date above changes with it.