Privacy Policy
Last updated: August 8, 2026
In short:we collect what we need to run your account, take payments, hold escrow and stop piracy. We don't sell your data and we don't run ad trackers. Downloads and licence activations are logged on purpose — that's how sellers are protected from file sharing.
1. Who We Are
ModForge operates the marketplace at modforge.xyz, where people buy and sell game server products, buy and sell established servers, hire developers, and order fixed-price services. This policy explains what we collect and what we do with it. Questions or requests: support@modforge.xyz.
2. What We Collect
Account data: username, email address and a hashed password (authentication is handled by Supabase Auth). Profile data you choose to add: bio, avatar, Discord handle, payout email. Seller application data: experience, portfolio links and work samples. Listing content you upload: titles, descriptions, images and files. Transaction data: purchases, sales, escrow milestones, payouts and coupon use. Contract data: job posts, applications, contracts, milestones and the messages you exchange in a contract. Licence data: licence keys and the server or Roblox Place/Universe identifier a key is bound to. Download logs: which product you downloaded, when, your IP address and your browser user-agent. Technical data: IP address, browser and device information, and basic usage such as pages viewed and searches.
3. Why We Collect It
To run your account and show you your purchases, listings and contracts. To take payments, hold escrow and pay out sellers. To review seller applications and moderate listings before they go public. To operate licensing and anti-piracy — licence keys, server binding and download logging exist to detect shared or resold files. To send transactional email you cannot opt out of while you hold an account (receipts, licence keys, payout and dispute notices) and optional marketing email you can unsubscribe from at any time. To prevent fraud, chargeback abuse and account sharing. To meet legal, tax and accounting obligations.
4. Legal Bases (UK/EU users)
We process data to perform our contract with you (running your account, purchases and payouts); on legitimate interests (fraud prevention, anti-piracy, security, improving the Platform); with your consent (marketing email, which you may withdraw at any time); and to comply with legal obligations (tax and accounting records).
5. What Other Users Can See
Your username, avatar, bio and public listings are visible to everyone. Reviews you leave are public and show your username. Sellers see the username of buyers who purchase from them. The two parties to a contract can see each other's username and everything sent in that contract's chat. Your email address, payout details and download history are never shown to other users. Admins can see contracts, milestones, disputes, licence keys and download logs for moderation, dispute resolution and anti-fraud.
6. Who We Share Data With
We do not sell your personal data and we do not run third-party advertising trackers. We share only what is needed with: Stripe and PayPal (payments, payouts and escrow — they receive transaction data directly and handle your card details under their own policies; we never see full card numbers); Supabase (database, authentication and file storage); Vercel (hosting and request logs); Resend (transactional email delivery). We may disclose data where legally required, to enforce our Terms, or to protect the rights and safety of our users.
7. Storage & Security
Data is stored on Supabase infrastructure, encrypted in transit and at rest. We use row-level security so users can only read their own records. Passwords are hashed and never stored in plain text. Paid files sit in private storage and are served only through short-lived, purchase-gated links. Product content keys are encrypted at rest and are never sent to a buyer in plain form. No system is perfectly secure and we cannot guarantee absolute security.
8. Cookies
We use essential cookies only — to keep you signed in and to remember basic preferences. We do not use advertising or cross-site tracking cookies. Blocking cookies will break sign-in and checkout.
9. Your Rights
Depending on where you live, you may request: access to the data we hold about you; correction of inaccurate data; deletion of your account and data; a portable export of your data; restriction of or objection to certain processing; and withdrawal of consent for marketing. Email support@modforge.xyz and we will respond within 30 days. You may also complain to your local data protection authority.
10. Retention & Deletion
Account and profile data are kept while your account is open. If you delete your account we remove personal data within 30 days, with these exceptions: transaction and payout records are kept for up to 7 years for tax and accounting; licence keys, download logs and contract records tied to a completed sale or an open dispute are retained so purchases stay valid and disputes can be resolved fairly; and anything we must keep by law. Public content you posted (reviews, listing text) may remain but is disassociated from your profile where practicable.
11. International Transfers
Our providers may process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.
12. Children
ModForge is not intended for children under 13 and we do not knowingly collect their data. If you believe a child has given us personal data, contact support@modforge.xyz and we will delete it.
13. Changes to This Policy
We will post any updated policy on this page with a new "last updated" date. If a change materially affects how we use your data, we will notify account holders by email.
14. Contact
Privacy requests: support@modforge.xyz. General support: support@modforge.xyz.