Privacy Policy
Last updated: October 19, 2026
1. Introduction
This Privacy Policy explains what data Burrow Studio LLC, a Florida limited liability company at 7901 4th St N, Suite 300, St. Petersburg, FL 33702, United States ("Company," "we," "us," "our"), collects when you use Plonks at https://plonks.org and any related products and services (collectively, the "Services"), why we collect it, how we use and protect it, and your rights regarding that data. Burrow Studio LLC is the controller of your personal data.
Change of operator. Burrow Studio LLC is now the owner and operator of Plonks. Your account data continues to be handled under this Policy, and we will tell you before we make material changes to how we use it.
This Privacy Policy is incorporated into and governed alongside our Terms of Service. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you must discontinue use of the Services immediately.
2. Data We Collect
2.1 Data you provide
| Data | Purpose | Visibility |
|---|---|---|
| Username | Account identity and display name | Public |
| Email address | Account verification, password recovery, account notifications | Private |
| Password | Authentication — stored as a bcrypt hash (12 salt rounds); your plaintext password is never stored, logged, or accessible to us | Private |
| Bio | Optional profile description (max 200 characters) | Public |
| Avatar | Optional profile image (uploaded as data URI, max 2 MB, subject to admin review before display) | Public (after approval) |
| Chat messages and reports | Real-time chat, and moderation of reported content | Chat is visible to other users; reports are private |
| Referral code usage | Track referral relationships for bonus rewards, and keep a one-way keyed hash of the Google/Discord account that claimed a reward (retained after account deletion) so each account can claim only once | Private |
2.2 Data collected automatically
| Data | Purpose |
|---|---|
| IP address | One IP address is stored on your account at registration for fraud prevention and multi-account detection. IP addresses are also processed transiently by our hosting provider and rate limiter to deliver the Services and block abuse, and are recorded in administrator audit logs for admin actions. |
| Device identifier (fingerprint) | A hash derived from basic browser and device characteristics (browser and operating system string, language, processor count, screen size and color depth, and time zone). It is stored in your browser, sent with requests, and saved with your account at registration, along with your browser's user-agent string at that time. We use it only to detect multi-accounting and abuse. We do not use it for advertising, and we do not use it to build profiles of your interests. |
| Online status and activity | Whether you are currently online (visible to friends), when you were last active, and your active session, so that we can deliver real-time features and sign you out of older sessions. |
| Usage analytics | Page views and gameplay events (for example, "pack opened" with the pack name and rarity, or a marketplace price) collected by a self-hosted Umami analytics instance that we operate. Events are not tied to your username or email. See Section 3. |
| Bot protection (Cloudflare Turnstile) | Browser interaction signals and IP address transmitted to Cloudflare during form submissions for bot and abuse detection. See Cloudflare's Privacy Policy. |
2.3 Data from third-party sign-in
If you authenticate via a third-party provider, we receive limited profile data through the OAuth 2.0 authorization code flow. This data is used solely for authentication and initial profile setup.
| Provider | Data Received | Scopes |
|---|---|---|
| Google user ID, display name, email address, profile picture URL | openid email profile | |
| Discord | Discord user ID, username, email address, avatar URL. If you opt in, permission to add you to the Plonks Discord server. | identify email, and optionally guilds.join |
We do not access any other data from these providers (e.g., contacts, messages, your server list, drive files, etc.). The optional Discord guilds.join permission is requested only when you tick “Join our Discord server” and is used only to add you to the Plonks Discord server.
3. Cookies and Similar Technologies
| Technology | Duration | Purpose |
|---|---|---|
refreshToken (HTTP-only cookie) | 30 days | Session continuity. Secure; SameSite=Strict; not accessible to JavaScript. Rotated on each use. |
| JWT access token (in-memory) | 15 minutes | API authentication. Stored in browser memory only — not persisted to disk, cookies, or localStorage. |
| sessionStorage (OAuth state) | Session only | Temporary OAuth flow state (CSRF protection). Automatically cleared when the browser tab closes or the OAuth callback completes. |
| localStorage (device identifier) | Until you clear site data | Stores the device identifier described in Section 2.2 so it stays consistent between visits. Used only for abuse prevention. |
Analytics. We measure usage with a self-hosted Umami instance, loaded through our own domain. It records page views and gameplay events without advertising identifiers and without following you across other websites.
What we do NOT use: We do not currently use advertising cookies, tracking pixels (no Facebook Pixel, Google Analytics, Amplitude, or Mixpanel), or cross-site tracking of any kind. If we introduce advertising in the future, we will update this Policy first and, where the law requires it, ask for your consent.
4. How We Use Your Data and Our Legal Bases
| Purpose | Legal basis (EU/UK users) |
|---|---|
| Operate, maintain, and provide the Services (authentication, game mechanics, trading, marketplace, chat, social features) | Performance of a contract |
| Verify your identity, secure your account, and send account-related emails (verification, security alerts, deletion confirmations) | Performance of a contract; legitimate interests in security |
| Detect and prevent fraud, multi-accounting, and abuse (including wash trading, item funneling, token funneling, referral abuse, and duplicate IP and device detection) | Legitimate interests in protecting the Services and our users |
| Enforce our Terms of Service, moderate content, and protect the safety of users | Legitimate interests; legal obligations |
| Analyze aggregated usage patterns to improve the Services | Legitimate interests in improving the Services |
| Respond to your inquiries and support requests | Performance of a contract; legitimate interests |
| Comply with legal obligations and respond to lawful requests | Legal obligation |
We do not sell your personal data. We do not currently use your data for advertising or behavioral targeting. We do not share your data with third parties except as described in Section 5. We do not make decisions about you that have legal or similarly significant effects using solely automated processing. Automated fraud checks may flag accounts for human review.
5. Data Sharing and Service Providers
We share data only with the following service providers, and only as needed for the stated purpose. They process data on our behalf under their own terms and data protection commitments.
| Provider | Data Shared | Purpose |
|---|---|---|
| Vercel | All traffic to the Services, including IP addresses and request data | Hosting, serverless compute, and content delivery |
| MongoDB Atlas | Account and game data described in this Policy | Primary database and backups |
| Upstash | Short-lived operational data such as rate-limit counters, session and presence state | Shared cache and rate limiting |
| Ably | User IDs, chat messages, trade and notification events, online presence | Real-time delivery of chat, trades, and notifications |
| Cloudflare | IP address, browser interaction signals | Bot protection (Turnstile) and DNS |
| Resend | Email address, email content | Sending verification and account notification emails |
| OAuth tokens exchanged during authentication | Third-party sign-in (only if you choose it) | |
| Discord | OAuth tokens exchanged during authentication; your Discord ID if you opt in to joining our server | Third-party sign-in and optional server join (only if you choose them) |
| Law enforcement and legal process | As required by applicable law, court order, or legal process | Compliance with legal obligations; protection of rights and safety |
| Successors | Data described in this Policy | If we merge with, are acquired by, or sell assets to another company, your data may be transferred, and the new owner will be bound by this Policy until you are notified of changes |
We are not responsible for the privacy practices of third-party services you choose to use, such as Google or Discord sign-in. We encourage you to review their respective privacy policies.
6. Game Data
The following categories of game data are stored in association with your account to operate the Services and to maintain game integrity:
- Token balance, pack opening statistics, pity counters, and daily reward streaks.
- Inventory (items and packs owned, quantities).
- Trade history (parties involved, items and tokens exchanged, timestamps, status).
- Marketplace listings (items listed, prices, buyer/seller references, status).
- Gift logs (sender, recipient, amount, fee).
- Friend connections and friend request status.
- Chat messages (automatically deleted after 30 days).
- Integrity records: a token ledger of every change to your token balance and a log of pity-system outcomes, kept to resolve disputes and keep the economy fair.
This data is subject to the retention and deletion provisions described in Sections 8 and 9 below.
7. Moderation and Safety Data
To protect the integrity of the Services and the safety of our users, we collect and store the following moderation-related data:
- Ban status, ban reason, ban duration, and trading lock status.
- Account history (an audit trail of administrative actions taken on your account, such as bans, unbans, trading locks, and deletion events).
- Chat reports and user reports (including snapshots of message content at the time of the report).
- Fraud alerts generated by automated detection systems (covering patterns such as wash trading, item funneling, token funneling, rapid high-value trading, one-sided trades, referral abuse, and duplicate IP or device registration).
- Admin audit logs (records of administrative actions, including the administrator's IP address).
Certain fraud-related records may be retained after account deletion as described in Section 9.
8. Data Retention
| Data | Retention |
|---|---|
| Account data | For as long as your account is active, until deletion under Section 9 |
| Chat messages | 30 days after creation, then automatically deleted |
| Token ledger | 2 years, then automatically deleted |
| Pity-system log | 1 year, then automatically deleted |
| Fraud alert records, gift logs, and admin audit logs | Retained after account deletion for abuse prevention and the integrity of the Services. They are kept without a fixed expiry and we review them periodically to remove records we no longer need. |
| Deleted-account recovery snapshot | Up to 14 days after purge, then automatically deleted |
| Database backups | Up to 8 days, so deleted data can remain in backups for that period before it is overwritten |
| Aggregated, anonymized analytics data | May be retained indefinitely |
9. Account Deletion and Data Purge
You may request account deletion from your account Settings page at any time.
- Upon request, your account enters a 7-day grace period during which you may cancel the deletion by logging back in.
- After the grace period, the following irreversible actions occur automatically:
Permanently deleted
- Inventory and pack ownership records.
- Friend connections and friend requests.
- Pending avatar submissions.
- Chat reports and user reports (both filed by and filed against you).
Anonymized
- Chat messages: your username is replaced with an anonymous identifier; message content is replaced with "[deleted]."
- Trade records: your user reference is removed; item and token details are cleared.
- Marketplace listings: seller and buyer references are removed.
- Your user record: email, IP address, password, avatar, bio, and OAuth provider links are permanently erased. Your username is replaced with an anonymous identifier.
Retained after deletion
- Fraud alert records (retained for abuse prevention and the integrity of the Services).
- Gift logs (retained for fraud detection purposes).
- Admin audit logs (retained for accountability and legal compliance).
- The one-way referral hash described in Section 2.1.
For a limited time after the purge, a recovery snapshot of your account record (excluding your password and security secrets) and routine database backups still exist, as described in Section 8. After they expire, the personal data we deleted cannot be recovered. We are not responsible for any loss of data resulting from account deletion that you initiate.
10. Children's Privacy
The Services are intended for users who are at least 13 years old. When you register, you confirm that you are at least 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided personal data, we will promptly delete the account and all associated data.
If you are a parent or guardian and believe a child under 13 has created an account, or you want to review or delete data about your teen, contact us at support@plonks.org. We may ask for information to verify the request.
Users between 13 and 17 years of age should use the Services only with the knowledge and permission of a parent or legal guardian. We do not knowingly use data from users under 18 for advertising or behavioral profiling. Please remember that your username, bio, avatar, and chat messages can be seen by other players, so avoid sharing personal information there.
11. International Data Transfers
The Services are hosted and operated in the United States. If you use the Services from outside the United States, including from the European Economic Area or the United Kingdom, your data is transferred to and processed in the United States, which may have different data protection laws than your country. Where required, we rely on appropriate safeguards for these transfers, such as the EU-U.S. Data Privacy Framework (and its UK extension) certifications of our service providers where available, or Standard Contractual Clauses. Contact us for more information about the safeguards that apply.
12. Your Rights
All users
- Access — You can view your account data on your Profile and Settings pages.
- Correction — You can update your username, email, bio, and avatar through Settings at any time.
- Deletion — You can request full account deletion from Settings, subject to the grace period and purge process described in Section 9.
- Data portability — Contact us at support@plonks.org to request a copy of your data.
Additional rights for EU/EEA and UK residents (GDPR)
If you are located in the European Union, the European Economic Area, or the United Kingdom, you may also have the right to:
- Object to the processing of your personal data.
- Request restriction of processing of your personal data.
- Withdraw consent at any time, where we rely on consent (this does not affect earlier processing).
- Lodge a complaint with your local data protection supervisory authority.
Where we rely on legitimate interest as a legal basis for processing (such as fraud prevention), you may object by contacting us at support@plonks.org.
Additional rights for California residents (CCPA)
If you are a California resident, you have the right to:
- Know what personal information is collected, used, and disclosed. The categories we collect are identifiers (username, email, IP address, device identifier), internet and activity data (game activity, analytics events), and user content (bio, avatar, chat). We use them for the purposes in Section 4 and disclose them to the service providers in Section 5.
- Request deletion of your personal information.
- Correct inaccurate personal information.
- Non-discrimination for exercising your privacy rights.
We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act (CCPA), and we have not done so in the preceding 12 months.
We will respond to verifiable requests within one month (GDPR) or 45 days (CCPA), extendable where the law allows and we tell you why. We reserve the right to verify your identity before fulfilling any request. Certain data may be retained as permitted by law even after a deletion request, as described in Sections 8 and 9.
13. Security
- Passwords hashed with bcrypt (12 salt rounds) — never stored in plaintext.
- All communications encrypted via HTTPS/TLS.
- Authentication cookies: HTTP-only, Secure, SameSite=Strict.
- Access tokens stored in volatile memory only (not persisted to disk).
- Access controls restricting data to authorized personnel.
- Automated fraud detection systems monitoring for abuse patterns.
NO METHOD OF TRANSMISSION OVER THE INTERNET OR ELECTRONIC STORAGE IS COMPLETELY SECURE. WHILE WE IMPLEMENT COMMERCIALLY REASONABLE SECURITY MEASURES, WE CANNOT GUARANTEE ABSOLUTE SECURITY. TO THE EXTENT PERMITTED BY LAW, WE MAKE NO WARRANTY, EXPRESS OR IMPLIED, REGARDING THE SECURITY OF YOUR DATA. If we learn of a data breach affecting your personal data, we will notify you and regulators as required by law.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For material changes, we will notify you through the Services (e.g., a banner or a prompt to review and accept the updated policy) before or when the changes take effect. Changes required by security updates, legal obligations, or bug fixes may take effect immediately. Continued use of the Services after any changes constitutes your acceptance of the revised Privacy Policy, except where the law requires your consent. It is your responsibility to review this Privacy Policy periodically for changes.
15. Governing Law
This Privacy Policy shall be governed by and construed in accordance with the laws of the State of Florida and applicable U.S. federal law, without regard to its conflict of law principles, and without limiting any mandatory data protection rights you have under the laws of your country. Any disputes arising under this Privacy Policy are subject to the dispute resolution provisions set forth in our Terms of Service.
16. Contact Us
For questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:
Burrow Studio LLC
7901 4th St N, Suite 300
St. Petersburg, FL 33702, United States
support@plonks.org