PRIVACY

Last updated October 22, 2026

We keep as little as we can, encrypt what we keep, and never sell anything.

Who we are

DROP THE DECK runs this site and is the data controller for the information below. You can reach us through the DROP THE DECK Discord. DROP THE DECK is not affiliated with VRChat Inc.

Deck builder

Nothing about you. Your setlist and language are kept in your own browser. We count how often a shared code is opened (the code only).

Backups

  • From Discord we read only your user id and username (scope identify; no e-mail, no servers, no messages). Both are stored encrypted (AES-256-GCM) with a keyed hash to find your account.
  • Your VRChat user id and display name (encrypted the same way). We read your public VRChat profile once to check the bio code; we never ask for your VRChat password.
  • The backups themselves live on the DROP THE DECK game server, tied to your VRChat id, newest 20, at most 180 days.
  • Delete everything any time from the Backup page.

Sponsorships

  • Your e-mail (encrypted) for receipts and your status link; your sponsor name, art and link (shown in the world once approved).
  • Payments are handled entirely by Stripe; we never see or store card numbers, only Stripe’s reference ids.
  • Uploaded images are re-encoded (all metadata such as GPS / EXIF is removed). Art of ended sponsorships is deleted 30 days after the end.
  • Clicks on sponsor links are counted per day and link, without IPs or any id.

Why we use it

To provide what you asked for (the backup service, your sponsorship: contract), to keep the site safe and prevent abuse (legitimate interest), and with the consent you give when you sign in or submit. You can withdraw consent any time by deleting your data or cancelling.

Who we share it with

We use a few processors that handle data on our behalf, and nobody else:

  • Railway: hosting for this site, its database and the game server.
  • Stripe: payments.
  • Discord: sign-in (identify only).
  • VRChat: we read your public profile to check the bio code.
  • GitHub Pages: serves approved sponsor art to the world (public by design).

We don’t sell your data and don’t use it for advertising.

How long we keep it

Backups: at most 180 days. Sponsorship details: while your sponsorship runs, then the art is deleted after 30 days; Stripe keeps payment records as long as the law requires. Your account: until you delete it.

Your rights

You can ask to access, correct, delete or export your data, and object to or restrict how we use it. Most of this you can do yourself on the Backup page; for the rest, message us on the Discord. You can also complain to your local data protection authority.

Cookies

No tracking or advertising cookies. A sign-in cookie (30 days) that holds no personal data, and your setlist / language in your browser’s storage.

Logs and security

IP addresses are used only in memory for rate limits and are not stored. An audit log records actions (sign-ins, uploads, reviews) without personal data.

Children

This site is not directed to children. Don’t use Backup or Sponsorships if you are under 13, or under 16 in the EU.

Changes

We may update this policy; the date at the top always shows the latest version.