LootSpectrum
Sign in

Data Privacy

Last updated: 09.10.2026

1. Controller

Paul Münchhausen

Richard-Wagner-Str. 22

66773 Schwalbach

Germany

Email: paul@muenchhausen.dev

Discord: @patimue

2. General Processing When Visiting the Website

When you visit our website, technical data is processed to ensure secure operation and provide the service. This includes:

  • IP address
  • Date and time of access
  • Referrer URL
  • Browser type and version
  • Operating system

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation).

3. Accounts and Authentication (Clerk)

LootSpectrum uses Clerk for authentication services. When you register or sign in, we process your email address and account identifiers.

If you sign in with Google or Discord, we receive basic profile information from these providers (for example: username, unique user identifier, email address, avatar).

Legal basis: Art. 6(1)(b) GDPR (contract performance).

4. Service Data Stored in Your Account

Depending on your usage, we may store:

  • Email address
  • Inventory events (case openings, trade-ups, drops)
  • Preferences (price source, UI settings)
  • Supporter entitlement decisions and time-bounded access grants
  • Minimal subscription, cancellation, checkout and webhook projections

Public statistics are displayed in aggregated form and are not directly traceable to individuals.

We also compute internal, aggregated figures from account data, for example how many accounts become Supporters within a day of their first sync. These are counts only. They are not used for decisions about individual accounts and are not published. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing whether the product works for the people who use it).

5. Payments (Stripe)

The supporter flow redirects to Stripe-hosted Checkout and Portal pages. LootSpectrum does not store card numbers or CVCs. Stripe receives payment, billing-address, tax-location, invoice, fraud-prevention and related data required for the selected transaction.

LootSpectrum stores an opaque billing reference; allowlisted customer, subscription, plan, status and period fields; time-bounded one-time grants; checkout-attempt state; webhook deduplication state; and the minimum encrypted cancellation declaration and confirmation-outbox evidence. Raw webhook bodies, Checkout/Portal URLs, card data, billing addresses and unrestricted Stripe objects are not persisted.

The checkout-attempt state includes the place in the product from which the checkout was started, as a fixed label such as "statistics overview". It is stored with the attempt and deleted with it. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing which parts of the product lead to a purchase). You may object under Art. 21 by emailing us.

Legal basis: Article 6(1)(b) GDPR for contract/payment coordination, cancellation and entitlement delivery; Article 6(1)(c) for legally required invoice/tax records; and Article 6(1)(f) for narrowly scoped security, webhook deduplication, reconciliation and claims records.

Stripe acts as processor for some services and as an independent controller for regulated payments, fraud prevention and compliance. Details on Stripe's role, subprocessors and international-transfer safeguards are described in Stripe's privacy policy.

Stripe privacy policy: https://stripe.com/privacy

6. Diagnostics and Security Logging

Vercel and Railway process operational logs for the website and API so we can keep the service stable and secure. These logs may include timestamps, request IDs, route templates, request methods, response status, duration, deployment/region context, and fixed error or outcome codes. Our own application logging is designed to omit request bodies, URL queries, credentials, payment data, and direct account or payment identifiers. Opaque API request IDs and bounded upstream correlation IDs may be retained; they can be pseudonymous technical personal data when combined with other provider or request records.

The request logs kept by the hosting provider of the website (Vercel) go further than our own: for each request they include the requested path with its query parameters and the browser's user-agent string. The parameters our own links add (from and src) are labels for a place in the product, not personal data.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stability and security).

Railway retains its platform logs for 7 days; Vercel retains runtime logs for the short period defined by its plan, currently one day. Logs are kept only as long as needed for operations and no longer than 30 days unless a documented, record-specific incident hold applies.

7. Website Audience Measurement (Vercel Web Analytics)

We use Vercel Web Analytics to see aggregated use of the website: page views, referrers, country, browser, operating system, and device class. Vercel documents that the product does not set cookies and does not store IP addresses. Visitors are distinguished with a hash derived from the incoming request. That hash resets after one day and is not used to follow a person across days or other websites. We still treat the hash and related request metadata as potentially pseudonymous personal data, not as data that falls outside the GDPR merely because it is described as anonymized.

The measurement script reads the current page URL in the browser and sends a first-party request to Vercel. Query strings and URL fragments are removed before an event is sent, so checkout, share, or similar parameters are not reported to Vercel Web Analytics. This applies to that product only; the hosting request logs in section 6 and the usage counters in section 8 are described separately. This is first-party audience measurement, not advertising, remarketing, or cross-site tracking.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding how the public website is used so we can keep it reliable and improve it). You may object under Art. 21 by emailing us. A device-level technical opt-out is also available by storing va-disable=1 in local storage, which prevents measurement events from being sent from that browser.

Vercel privacy policy: https://vercel.com/legal/privacy-policy

8. Usage Counters

We count how often two kinds of links are used, and from which place in the product: the links to the Supporter plans, and the affiliate partner link to tradeit.gg. For the Supporter plans we also count how often the plans page is opened and how often a checkout is started. The counting is done by our own servers while they answer a request you made anyway. Nothing is stored on or read from your device for it: the place is part of the link you follow, and a checkout request carries the same label along. The counts stay in our own database instead of going to an analytics service.

  • Stored for a Supporter-plans count: the step (link used, plans page opened, checkout started), the place in the product as a fixed label, whether the request came from a desktop or a phone, and the hour.
  • Stored for a partner-link count: the place in the product as a fixed label, the name of the item the link was for, if any, and the time.
  • Not stored: your account, your IP address, any cookie or device identifier. To tell desktop from phone and to leave out search-engine crawlers, the server reads the browser information sent with the request; that information itself is not stored with the count.
  • Single counts older than 14 days are reduced to daily totals and deleted by a daily job.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing which parts of the product are used).

9. Help Centre Questions

The Help page has a box for asking a question. Each keystroke searches the help topics inside your browser. When you pause typing for about half a second, or press Enter, the text in the box at that moment is sent to our API and from there to OpenRouter, which passes it to the decision model "Jev" provided by TypeSafe. The model only answers which help topic fits your question; it does not produce text.

  • Sent to OpenRouter and TypeSafe: the text in the box, and nothing else. The request comes from our server, so they do not receive your IP address, and no account or device identifier is attached.
  • Every request asks these providers not to store your question or use it for training (data collection denied).
  • Text sent while you are still typing is answered and not recorded. Once a question has stayed unchanged for a few seconds, or you pressed Enter, we record which topic was shown and whether you marked it as helpful, without your IP address and without a link to your account.
  • If no help topic fits such a finished question, the question itself (shortened to 200 characters) is kept so that we can add the missing topic. It is stored without IP address or account link and deleted after 90 days.

Please do not put personal data into the question box. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering support questions and improving the help centre).

OpenRouter privacy policy: https://openrouter.ai/privacy

10. External Content and Links

Some content is loaded from third-party providers:

  • Steam static image CDN (item images)
  • Discord CDN (user avatars when linked)
  • Affiliate partner links to tradeit.gg and csfloat.com (only when you click them)

When these resources are loaded, your IP address is transmitted to those providers. Legal basis: Art. 6(1)(f) GDPR (service delivery).

11. Cookies and Local Storage

Device access is limited to authentication, user-requested preferences such as theme selection, and the first-party Vercel Web Analytics script described above. Vercel documents that this measurement does not set cookies. The usage counters in section 8 store nothing on your device and read nothing from it. No marketing tags or embedded payment components are used; Checkout and Portal are hosted by Stripe.

Authentication and user-requested preference storage may be strictly necessary to provide the service you request (§ 25(2) TDDDG). Vercel Web Analytics is first-party audience measurement described in section 7; it is not a marketing cookie. The GDPR legal basis for each processing is stated in the sections above.

12. Hosting and Processors

The website is delivered through Vercel and the API runs on Railway. Clerk provides authentication services and Stripe processes payments. OpenRouter and TypeSafe process help-centre questions as described in section 9. Vercel also processes the audience-measurement events described above. The database hosting provider processes the minimum application data needed to operate the service. Cancellation confirmations are issued as an immediate downloadable receipt; no email-delivery provider is currently used for them.

Where providers process data outside the EU/EEA, transfers are safeguarded by the provider's EU-U.S. Data Privacy Framework certification and/or Standard Contractual Clauses under Article 46(2)(c) GDPR.

13. Retention

Abandoned checkout attempts are deleted after 30 days; webhook deduplication records and ended subscription or one-time-grant projections after 90 days. Minimum contract, cancellation, invoice and accounting evidence is retained for the applicable statutory period. Help-centre questions that matched no topic are deleted after 90 days. Usage counts (section 8) older than 14 days are reduced to daily totals. Operational data is not retained merely because an accounting record must remain.

14. Your Rights

You have the right to access, rectification, deletion, restriction, objection, and data portability under the GDPR. To exercise your rights, contact us at the email above.

You also have the right to lodge a complaint with your supervisory authority. For Saarland, Germany this is the Landesbeauftragte fuer Datenschutz und Informationsfreiheit Saarland.

15. Changes

We may update this privacy policy when necessary. Significant changes will be communicated in the app or on the website.