Privacy Policy

ModForge operates the marketplace at modforge.xyz, where people buy and sell game server products, buy and sell established servers, hire developers, and order fixed-price services. This policy explains what we collect and what we do with it. Questions or requests: support@modforge.xyz.

Account data: username, email address and a hashed password (authentication is handled by Supabase Auth). If you sign in with Google or Discord, we receive your email address, display name and avatar from that provider. Profile data you choose to add: bio, avatar, Discord handle, PayPal payout email. If you connect Stripe for payouts, we store only the Stripe account ID and its verification status — your bank details and identity documents are collected and held by Stripe, not by us. Seller application data: experience, portfolio links and work samples. Listing content you upload: titles, descriptions, images and files. Transaction data: purchases, sales, processing fees, refund requests and their outcome, escrow milestones, payouts and coupon use. Contract data: job posts, applications, contracts, milestones and the messages you exchange in a contract. Licence data: licence keys and the server or Roblox Place/Universe identifier a key is bound to. Download logs: which product you downloaded, when, your IP address and your browser user-agent. Sign-in records: the time of each sign-in, your IP address, the approximate location derived from it (city, region, country) and your browser user-agent. Game submissions: if you submit a game to the MyCCU × ModForge programme, the details you enter — your name, Discord handle and email, information about your game, and any stats or revenue figures you choose to share. Messages you send through the contact form, and listings you report. Technical data: IP address, browser and device information, and basic usage such as pages viewed and searches; product view counts store only a one-way hash of your IP address. Analytics: Google Analytics collects usage data through cookies — see section 8.

To run your account and show you your purchases, listings and contracts. To take payments, hold escrow and pay out sellers. To review seller applications and moderate listings before they go public. To operate licensing and anti-piracy — licence keys, server binding and download logging exist to detect shared or resold files. To send transactional email you cannot opt out of while you hold an account (receipts, licence keys, payout and dispute notices) and optional marketing email you can unsubscribe from at any time. To prevent fraud, chargeback abuse and account sharing, and to protect accounts — sign-in records help us spot logins from unusual places. To review game submissions for the MyCCU × ModForge programme and contact you about them. To understand how the site is used (Google Analytics) so we can improve it. To meet legal, tax and accounting obligations.

We process data to perform our contract with you (running your account, purchases and payouts); on legitimate interests (fraud prevention, anti-piracy, account security including sign-in records, reviewing game submissions, improving the Platform); with your consent (marketing email and analytics cookies, which you may withdraw at any time); and to comply with legal obligations (tax and accounting records).

Your username, avatar, bio, public listings and bundles, and your follower and following counts are visible to everyone. Reviews you leave are public and show your username. Sellers see the username of buyers who purchase from them. The two parties to a contract can see each other's username and everything sent in that contract's chat. Your email address, payout details and download history are never shown to other users. Admins can see contracts, milestones, disputes, licence keys, download logs and sign-in records (including IP address and approximate location) for moderation, dispute resolution, account security and anti-fraud.

We do not sell your personal data and we do not run advertising trackers. We share only what is needed with: Stripe, PayPal and Coinbase Commerce (payments, refunds, payouts and escrow — they receive transaction data directly and handle your card or wallet details under their own policies; we never see full card numbers); Stripe Connect, if you choose Stripe payouts (Stripe collects your identity and bank details to verify you and pay you, under Stripe's own terms); Supabase (database, authentication and file storage); Cloudflare R2 (storage for product files, uploads and contract files); Vercel (hosting and request logs; it also supplies the approximate location used in sign-in records); Resend (transactional email delivery); Google (sign-in with Google, and Google Analytics usage statistics); Discord (sign-in with Discord, and a private staff channel where new game submissions are posted for review); and our partner MyCCU, which reviews game submissions with us under the MyCCU × ModForge programme. We may disclose data where legally required, to enforce our Terms, or to protect the rights and safety of our users.

Data is stored on Supabase infrastructure and files on Cloudflare R2, encrypted in transit and at rest. We use row-level security so users can only read their own records. Passwords are hashed and never stored in plain text. Paid files sit in private storage and are served only through short-lived, purchase-gated links. Payout details and sign-in records are readable only by our server and admins. Product content keys are encrypted at rest and are never sent to a buyer in plain form. No system is perfectly secure and we cannot guarantee absolute security.

We use essential cookies to keep you signed in and keep checkout secure, and Google Analytics cookies to measure how the site is used. We do not use advertising or cross-site advertising cookies. Blocking analytics cookies doesn't affect the site; blocking essential cookies will break sign-in and checkout. Details are in our Cookie Policy.

Depending on where you live, you may request: access to the data we hold about you; correction of inaccurate data; deletion of your account and data; a portable export of your data; restriction of or objection to certain processing; and withdrawal of consent for marketing. Email support@modforge.xyz and we will respond within 30 days. You may also complain to your local data protection authority.

Account and profile data are kept while your account is open. If you delete your account we remove personal data within 30 days, with these exceptions: transaction and payout records are kept for up to 7 years for tax and accounting; licence keys, download logs and contract records tied to a completed sale or an open dispute are retained so purchases stay valid and disputes can be resolved fairly; and anything we must keep by law. Sign-in records are kept while your account is open for security. Game submissions are kept while they're being reviewed and for our programme records; ask us and we'll delete yours. Public content you posted (reviews, listing text) may remain but is disassociated from your profile where practicable.

Our providers may process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

ModForge is not intended for children under 13 and we do not knowingly collect their data. If you believe a child has given us personal data, contact support@modforge.xyz and we will delete it.

We will post any updated policy on this page with a new "last updated" date. If a change materially affects how we use your data, we will notify account holders by email.

Privacy requests: support@modforge.xyz. General support: support@modforge.xyz.