Privacy Policy

This Privacy Policy explains how TradeDome ("we", "us", "our") collects, uses, stores and protects personal data when you use our website trade-dome.com (the "Service"). We operate the Service as a beta platform for trading Fortnite sprites and related in-game items.

By creating an account or using the Service, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Service.

TradeDome is the data controller responsible for your personal data under the General Data Protection Regulation (GDPR) and the UK GDPR. If you have questions about how we handle your data, contact us at support@trade-dome.com.

Account information

• Username, display name, email address, and avatar.
• A region/locale setting you may optionally configure.
• Account-reputation data such as XP points, rank tier and completed-trade counts.

OAuth provider data

When you sign in or link an account via OAuth, we receive:

• Epic Games OAuth: Epic display name, Epic account identifier, and an encrypted access/refresh token used only to keep your Epic connection active.
• Discord OAuth: Discord username, Discord account identifier, and your Discord avatar.

We never receive your Epic or Discord password. OAuth tokens are stored encrypted and are used solely to authenticate your linked sessions.

IP addresses and technical data

• IP address, browser type, operating system and device identifiers.
• Presence/online-status pings used to display whether you are online, offline or away (idle for more than 10 minutes).
• Server logs containing timestamps, request routes and error diagnostics.

Trade and chat content

• Trade posts you create, including the sprite offered/requested and notes.
• Messages you send in live chat and private trade rooms.
• Moderation records such as reports, warnings and audit-log entries.

We use Epic Games and Discord as OAuth sign-in providers so you do not have to create a separate password. When you authorise TradeDome through either provider, the provider shares the data described above with us according to its own privacy policy:

• Epic Games — Epic Games Privacy Policy
• Discord — Discord Privacy Policy

You can revoke TradeDome's access at any time from your Epic or Discord account settings. Revoking access disables linked features but does not automatically delete data already processed; see Deletion Requests below.

• To create and manage your account and authenticate sessions.
• To display your profile, rank, online status and trade history to other users.
• To create, match and moderate trade posts and private trade rooms.
• To run live chat and to filter prohibited language for community safety.
• To award XP, ranks and leaderboard placement.
• To analyse aggregate usage and improve the Service.
• To detect, investigate and prevent fraud, abuse and violations of our rules.
• To comply with legal obligations where required.

• Contract: creating your account and running trades necessary to deliver the Service you requested.
• Legitimate interests: fraud prevention, security, analytics and community moderation, balanced against your rights and expectations.
• Consent: for analytics, advertising and any optional features that are not strictly necessary.
• Legal obligation: where we must retain records to comply with applicable law.

We use cookies and browser local storage to keep you signed in, remember your theme preference, and operate the Service. The categories we use are:

• Essential: authentication session tokens and security cookies required for the Service to function.
• Preference: theme (light/dark) and UI settings stored locally on your device.
• Analytics & advertising: set by our analytics provider and by Google AdSense where advertising is shown (see below). You can opt out of non-essential cookies through your browser settings or a consent banner where shown.

We use privacy-conscious analytics to understand aggregate traffic and feature usage. Analytics may record anonymised page views, device type and approximate region derived from your IP address. We do not use analytics to build individual behavioural profiles for sale, and analytics data is kept separate from your account identity where possible.

Where advertising is shown on the Service, it is delivered by Google AdSense and other advertising partners. These providers may use cookies and device identifiers to serve ads based on your prior visits to this and other websites.

• Google's use of advertising cookies enables it and its partners to serve ads based on your visits to our site and others.
• You can opt out of personalised advertising via Google Ads Settings here and via aboutads.info.
• Third-party vendors and advertising partners are controllers of the data they collect under their own privacy policies.

We do not share your account email or Epic/Discord identifiers with advertising partners.

Your data is stored on secured infrastructure operated by our hosting and database providers located in the European Union and other regions as described in International Data Transfers. We protect data with:

• Row-level database access controls so users can only read their own private data.
• Encryption in transit (TLS) and at rest for sensitive fields such as OAuth tokens.
• Separation of service-role credentials from public/client credentials.
• Automated security scanning and review of database access policies.

No method of transmission or storage is fully secure, but we work to protect your data using industry-standard measures.

• Active account data: kept for the life of your account and removed shortly after you delete it.
• Trade posts & trade rooms: private trade rooms are permanently deleted once a trade is completed. Public trade posts are removed when you cancel them or shortly after completion.
• Chat messages: live-chat messages are retained as needed for moderation and then purged on a rolling basis.
• OAuth tokens: encrypted tokens are removed when you unlink an account or revoke access, or when they expire.
• Server logs & analytics: retained for up to 90 days for security and debugging.
• Moderation/audit records: retained as necessary to enforce our rules and respond to legal requests.

Our infrastructure providers may process data outside your country, including in the United States. Where personal data leaves the European Economic Area, the UK or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, and we assess transfers to ensure an adequate level of protection. Epic Games and Discord may also transfer your data internationally under their own policies.

The Service integrates with and may share limited data with the following providers:

• Supabase — authentication and database hosting (row-level security enforced).
• Epic Games — OAuth sign-in and inventory lookups.
• Discord — OAuth sign-in and community features.
• Cloudflare — CDN, DNS and edge security.
• Google AdSense — advertising (where shown).

Each provider processes data under its own privacy policy. We share only the minimum data necessary to deliver the relevant feature.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure ("right to be forgotten") of your data.
• Restrict or object to processing of your data.
• Portability — receive your data in a structured, machine-readable form.
• Withdraw consent at any time, without affecting processing done before withdrawal.
• Lodge a complaint with your data protection authority.

To exercise any of these rights, email support@trade-dome.com. We respond within one month, extendable by two months for complex requests, and will inform you of any extension.

You can request deletion of your account and associated personal data at any time from your account settings or by emailing support@trade-dome.com. Upon deletion, we remove your profile, trade posts, trade rooms, chat messages and encrypted OAuth tokens. We may retain limited records where required for legal obligations, fraud prevention or moderation audits. Account deletion cannot be undone.

The Service is not directed at children under 13 (or the minimum age required to use Epic Games or Discord in your region). We do not knowingly collect data from children. If you believe a minor has registered, contact us and we will promptly remove the account.

We may update this Privacy Policy as the Service evolves. We will revise the "Last updated" date above and notify you of material changes through the Service or by email where appropriate. Continued use after changes take effect constitutes acceptance.

For privacy questions, data requests or complaints, contact our data protection team at support@trade-dome.com. You also have the right to lodge a complaint with your local data protection authority.