Privacy policy
What RoPlush collects when you back a campaign or make an account, who processes it, how long it is kept, what deleting an account does, and the rights you have over it under the GDPR.
Last updated 18 September 2026
This policy covers roplush.com: what we collect when you browse the site, back a campaign or make an account, what we do with it, who else touches it, and the rights you have over it.
Who we are
RoPlush runs this site and is the controller of the personal data described here. Write to support@roplush.com about anything on this page.
The short version
- We run no analytics, no advertising and no tracking on this site.
- We set cookies for your basket, for staying signed in, and for Stripe's fraud checks at checkout. Every one is strictly necessary — see the cookies policy.
- You do not need an account to buy anything. An account is how you look an order up later.
- We hold order and invoice records for as long as tax law requires, including after you delete your account, with your name taken off.
- Nothing about you is published unless you switch it on, and you can switch it back off.
- We never sell your data, and we never share it for anyone else's marketing.
What we collect
Browsing the site
Reading roplush.com sets no cookies and runs no analytics: no advertising pixel, no session recording, no fingerprinting. There is nothing to consent to and no banner asking you to.
Our host, Vercel, keeps short-lived server logs, including IP addresses, to serve the site and defend it against attack and abuse. That is our legitimate interest in keeping the site up (Art. 6(1)(f) GDPR). They are kept briefly and build no profile of you.
Backing a campaign
Checkout happens on this website and does not ask you to sign in. We are the seller and the merchant of record; Stripe is our payment processor.
| What | Why | Legal basis |
|---|---|---|
| Name, delivery address, email | To manufacture, ship and support your order | Performance of a contract, Art. 6(1)(b) |
| Order contents, price, currency | Same, plus the tax invoice | Contract, and legal obligation Art. 6(1)(c) |
| Payment result and card fingerprint | To take payment, refund it, and stop fraud | Contract, and legitimate interest Art. 6(1)(f) |
| Country and tax status | To charge the right tax and issue the right invoice | Legal obligation, Art. 6(1)(c) |
We never see your card number. The payment fields on our checkout page are served by Stripe inside their own frame, and your card details go from your browser straight to Stripe without passing through our servers. We receive whether a payment succeeded, the amount, and the last four digits.
If you were signed in when you paid, the order is linked to your account and appears under your orders. If you were not, it is linked to no account, and we will not attach it to one afterwards on the strength of a matching email address. Write to us from the address you ordered with and we will look it up by hand.
If you make an account
An account is optional. This is everything one holds:
| What | Where it comes from | Why |
|---|---|---|
| Email address | You, or the Google or Discord account you sign in with | It is how you sign in, how a password is reset, and where account mail goes |
| Password | You | Signing in. We never see it — it is stored as a hash we cannot reverse |
| Display name | You | The name on your profile |
| Handle | You | Your profile's address, /u/your-handle. Public by definition |
| Bio | You, optionally | Your profile |
| Saved addresses | You, optionally | So checkout can fill the boxes in. You can delete any of them |
| Your order history | Your own orders, linked to the account you were signed into when you paid | So you can find them again |
| Supporter listing choice | You | Whether your name appears publicly as a backer. On for a new account; you can turn it off |
| Connected sign-in providers | Google or Discord, if you use them | So you can see what is connected. We store which providers, and the address each gave |
The legal basis for all of it is performance of a contract (Art. 6(1)(b)). The supporter listing is dealt with below.
There is no profile picture. A profile draws the first letter of your display name.
Signing in with Google or Discord
That provider tells our authentication provider who you are, and the identity it returned is stored: which provider, and the address it gave. We never receive your Google or Discord password, and we get access to nothing else in those accounts.
Keeping the sign-in forms safe
Sign-in, sign-up and password-reset attempts are counted: one counter against the email address an attempt was made with, one against the IP address it came from. A counter is a key and a number, attached to no account. A high count buys a delay of a few seconds, and past twenty attempts in the window the attempt is refused; no account is locked. The count resets fifteen minutes after the attempt that started it, and the row is deleted when the table is next pruned.
The sign-in, sign-up and password-reset forms, the account forms that ask for your password, and the mailing-list forms also carry a Cloudflare Turnstile challenge, which is how we tell a person from a script. Cloudflare receives what its widget needs in order to judge that, including your IP address, and returns a pass-or-fail token that our authentication provider checks, or that we check for the mailing-list forms.
Both are our legitimate interest in preventing unauthorised access to accounts (Art. 6(1)(f)).
How we use it
- To fill your order. Manufacturing, shipping, refunding and supporting what you bought.
- To answer you. Email you send us about an order, a fault or a question.
- To run your account, if you have one.
- To keep the site and your account safe. Blocking fraudulent payments and slowing down password guessing.
- To meet our legal obligations. Invoices, tax records, and answering a lawful request.
- To tell you when a campaign opens, if you asked to be told.
There is no profiling and no automated decision-making. Your data is not used to advertise anything to you, here or anywhere else.
What is published, and only if you say so
Two things about an account can be seen by anybody, and both are your decision.
Your profile at /u/your-handle exists as soon as you pick a handle. It
shows your display name, your handle, your bio if you wrote one, and the date
you joined. It shows no email, no address and no order.
The supporter list on a campaign page is publication, and we treat it as publication. It shows your display name and handle among the three most recent backers of that plush, and it links to your profile.
- It is on for a new account.
- It publishes your name, your handle, how long ago you backed and your badge for that campaign. It never publishes what you paid, how many you bought, your email or your address.
- You can turn it off at any time, in your settings. Turning it off removes you from every campaign page the next time a page is drawn, and empties the list of what you have backed on your own profile.
Turning it off does not reach a page somebody saved, screenshotted or archived while you were listed.
Email about your order and your account
We email you about your own order: confirmation, whether the campaign cleared its floor, refunds, and dispatch. That is part of performing the contract, and you cannot unsubscribe from it while an order is open.
If you have an account, we also email you about the account itself: confirming an address, resetting a password, or changing the address the account uses. A reset email you did not ask for means somebody typed your address into the form. Nothing has happened to your account.
The mailing list
There is a mailing list, and the only way onto it is to ask twice.
How you get on it. There are three places to give us an address: the form on the home page, the "tell me when this opens" box on a campaign that has not opened yet, and a checkbox at checkout that is never ticked for you. Whichever one you used, we write to the address to ask whether it is really yours, and it is not on the list until you click the link in that email.
What we hold. The address, which list it is for, which of the three places you gave it to us from, whether and when you confirmed it, and two random strings: one that confirms the address, one that removes it. No name, no order, and no link to your account.
The legal basis is your consent (Art. 6(1)(a) GDPR). Buying something is not consent and never stands in for it. The checkbox at checkout is a separate question that does nothing to your order either way.
What it sends. An email when a new campaign opens, or, if you asked about one campaign, an email when that campaign opens.
Getting off it. Every one of those emails carries a one-click unsubscribe: your mail app's own Unsubscribe button works, and so does the link in the footer. Either removes the row. You can also write to support@roplush.com and we will do it. Leaving the list does not affect email about an order you have placed.
Who we share it with
| Who | What they hold | Where |
|---|---|---|
| Supabase | Accounts and sign-in: your email, password hash, connected providers, profile, saved addresses, and the order records themselves | EU/US, standard contractual clauses |
| Stripe | Taking and refunding payment, the card details we never see, receipts, and its own record of the payment | EU/US, standard contractual clauses |
| Vercel | Hosting and delivering this website, and short-lived server logs | EU/US, standard contractual clauses |
| Cloudflare | The Turnstile challenge on the sign-in, sign-up, password and mailing-list forms, and the IP address it sees while making it | Global, standard contractual clauses |
| Resend | Delivering our email: account confirmations and password resets, updates about your order, and the mailing list | EU/US, standard contractual clauses |
| Google Workspace | The mailbox we read and answer your email from | EU/US, standard contractual clauses |
| Fulfilment and carriers | Your name and delivery address, to pack and deliver your parcel | Depends on your delivery address |
Each is a processor acting on our instructions under a data processing agreement, except Stripe, which is also an independent controller for fraud prevention and its own regulatory obligations.
A partner sees sales figures, never buyers, and never a delivery address. The creators we work with receive no personal data about the people who backed their campaign.
We disclose data where the law requires it — to answer a court order, a subpoena or a lawful request from a government or investigatory body, and where we need to establish or defend a legal claim or investigate fraud.
If the business or part of it is sold, customer and order records may transfer to the buyer as part of that sale. We will say so on this page before it happens.
We do not sell your personal data, and we do not share it for anyone else's marketing.
Where your data is held
Our processors hold data in the EEA and in the United States, as the table above sets out. Where data goes outside the EEA it is covered by the European Commission's standard contractual clauses. Where your parcel is packed and posted from depends on the campaign and on your delivery address.
Cookies
Your basket, staying signed in, and Stripe's fraud checks at checkout. Every one of them is strictly necessary, which is why none requires consent and why there is no cookie banner on this site.
The cookies policy names each one, says what it holds and says how long it lasts.
Security
Passwords are stored as hashes we cannot reverse. The basket and sign-in cookies
are httpOnly, so no script on the page can read them. Card details never reach
our servers. Access to order records is limited to the people who need it, and
every page that shows one checks who is asking on the server.
No website is completely secure. Use a password you have not used anywhere else, and never send us a card number or a password by email.
Links to other sites
Creator profiles link out to the creators' own games, channels and social accounts, and some pages link to Stripe. Those sites have their own privacy policies, and this one stops at the edge of roplush.com.
How long we keep it
- Order and invoice records: ten years from the end of the year in which the order was placed. Tax and accounting law requires this, the period varies by country, and we keep to the longest one that can apply to us. We cannot delete these earlier, and a deletion request does not override it.
- Your account: until you delete it. Nothing about an account expires on its own, and we do not close accounts for being unused.
- Saved addresses: until you delete them, or until you delete the account, which deletes them with it.
- Mailing list: until you unsubscribe, which deletes the row rather than flagging it. An address that never confirms is deleted within thirty days.
- Support email: three years from the last message.
- Basket cookie: fourteen days, or until you clear it. It lives only in your browser.
- Sign-in cookies: for the life of the session. Signing out ends it.
- Sign-in attempt counters: the count resets after fifteen minutes, as described above.
- Server logs: short-lived, as set by our host.
Deleting your account
You can delete your account yourself, from your settings. It happens immediately and it cannot be undone. The right of erasure and the duty to keep an invoice genuinely conflict, so here is how we resolve it, and the deletion screen says the same thing before the button.
What goes. Your sign-in, your email address, your password, your connected Google or Discord identities, your display name, your bio, your saved addresses, your saved card and the customer record that held it at Stripe, your supporter listing, and your public profile. Your handle is released the moment the account goes and anybody may take it afterwards.
What stays. The order records: what was bought, what was paid, and the address it shipped to. An order is an invoice and we are required to keep invoices for the period above. What is removed from them is you — the link between those records and your account is set to nothing. Nothing in our database then says they were yours.
What we cannot reach. Stripe holds its own record of each payment, because it processed it. That is subject to Stripe's retention rather than ours.
Deleting your account does not cancel an open order and does not waive anything. If a campaign misses its floor, everyone who backed it is refunded to the card they paid with, whether or not they still have an account here.
Taking your data with you
Your settings page has a download that gives you what this site holds about your account, as a JSON file: your profile, your email, which sign-in providers are connected, and your saved addresses. You do not have to ask us for it and we do not need to know why you want it.
Your rights
Under the GDPR you can ask us to:
- give you a copy of the data we hold about you
- correct it if it is wrong
- delete it, where we are not required to keep it
- restrict or object to how we use it
- send it to you, or to someone else, in a portable format
- stop relying on your consent, where consent is what we relied on
Several of these you can do yourself, immediately: edit your profile, delete a saved address, turn the supporter listing off, download your data, or delete the account. For anything else, write to support@roplush.com. We answer within one month and we do not charge for it. We may need to confirm who you are first, usually by writing from the address you ordered with or the address on your account.
If you think we have handled your data badly, tell us so we can fix it. You also have the right to complain to the data protection authority in the country where you live.
Children
RoPlush sells to adults. Plenty of the games, channels and communities we make plush for have audiences under 18, so to be clear: you must be 18 or older to place an order or to make an account, or have a parent or guardian do it for you. We do not knowingly collect data from children. If you believe a child has ordered or signed up without permission, write to us and we will cancel the order, delete the account, and delete the data.
Changes
If we change this policy we will change the date at the top of the page. If a change is significant and affects an order you have already placed, we will email you rather than rely on you re-reading this page.
Contact us
Write to support@roplush.com with anything about this policy or about the data we hold on you. Do not include a card number, a password or anything else sensitive in an email.