Loading.
What RoPlush collects when you back a campaign or make an account, who processes it, how long it is kept, what deleting an account does, and the rights you have over it under the GDPR.
Last updated 18 September 2026
This policy covers roplush.com: what we collect when you browse the site, back a campaign or make an account, what we do with it, who else touches it, and the rights you have over it.
RoPlush runs this site and is the controller of the personal data described here. Write to support@roplush.com about anything on this page.
Reading roplush.com sets no cookies and runs no analytics: no advertising pixel, no session recording, no fingerprinting. There is nothing to consent to and no banner asking you to.
Our host, Vercel, keeps short-lived server logs, including IP addresses, to serve the site and defend it against attack and abuse. That is our legitimate interest in keeping the site up (Art. 6(1)(f) GDPR). They are kept briefly and build no profile of you.
Checkout happens on this website and does not ask you to sign in. We are the seller and the merchant of record; Stripe is our payment processor.
| What | Why | Legal basis |
|---|---|---|
| Name, delivery address, email | To manufacture, ship and support your order | Performance of a contract, Art. 6(1)(b) |
| Order contents, price, currency | Same, plus the tax invoice | Contract, and legal obligation Art. 6(1)(c) |
| Payment result and card fingerprint | To take payment, refund it, and stop fraud | Contract, and legitimate interest Art. 6(1)(f) |
| Country and tax status | To charge the right tax and issue the right invoice | Legal obligation, Art. 6(1)(c) |
We never see your card number. The payment fields on our checkout page are served by Stripe inside their own frame, and your card details go from your browser straight to Stripe without passing through our servers. We receive whether a payment succeeded, the amount, and the last four digits.
If you were signed in when you paid, the order is linked to your account and appears under your orders. If you were not, it is linked to no account, and we will not attach it to one afterwards on the strength of a matching email address. Write to us from the address you ordered with and we will look it up by hand.
An account is optional. This is everything one holds:
| What | Where it comes from | Why |
|---|---|---|
| Email address | You, or the Google or Discord account you sign in with | It is how you sign in, how a password is reset, and where account mail goes |
| Password | You | Signing in. We never see it — it is stored as a hash we cannot reverse |
| Display name | You | The name on your profile |
| Handle | You | Your profile's address, /u/your-handle. Public by definition |
| Bio | You, optionally | Your profile |
| Saved addresses | You, optionally | So checkout can fill the boxes in. You can delete any of them |
| Your order history | Your own orders, linked to the account you were signed into when you paid | So you can find them again |
| Supporter listing choice | You | Whether your name appears publicly as a backer. Off unless you turn it on |
| Connected sign-in providers | Google or Discord, if you use them | So you can see what is connected. We store which providers, and the address each gave |
The legal basis for all of it is performance of a contract (Art. 6(1)(b)), except the supporter listing, which is consent (Art. 6(1)(a)) and is dealt with below.
There is no profile picture. A profile draws the first letter of your display name.
That provider tells our authentication provider who you are, and the identity it returned is stored: which provider, and the address it gave. We never receive your Google or Discord password, and we get access to nothing else in those accounts.
Sign-in, sign-up and password-reset attempts are counted: one counter against the email address an attempt was made with, one against the IP address it came from. A counter is a key and a number, attached to no account. A high count buys a delay of a few seconds; nothing is locked and nothing is refused. The count resets fifteen minutes after the attempt that started it, and the row is deleted when the table is next pruned.
The sign-up and password-reset forms also carry a Cloudflare Turnstile challenge, which is how we tell a person from a script. Cloudflare receives what its widget needs in order to judge that, including your IP address, and returns a pass-or-fail token that our authentication provider checks.
Both are our legitimate interest in preventing unauthorised access to accounts (Art. 6(1)(f)).
There is no profiling and no automated decision-making. Your data is not used to advertise anything to you, here or anywhere else.
Two things about an account can be seen by anybody, and both are your decision.
Your profile at /u/your-handle exists as soon as you pick a handle. It
shows your display name, your handle, your bio if you wrote one, and the date
you joined. It shows no email, no address and no order.
The supporter list on a campaign page is publication, and we treat it as publication. It shows your display name and handle among the people who backed that plush, and it links to your profile.
Withdrawing consent does not reach a page somebody saved, screenshotted or archived while you were listed.
We email you about your own order: confirmation, whether the campaign cleared its floor, refunds, and dispatch. That is part of performing the contract, and you cannot unsubscribe from it while an order is open.
If you have an account, we also email you about the account itself: confirming an address, resetting a password, or changing the address the account uses. A reset email you did not ask for means somebody typed your address into the form. Nothing has happened to your account.
There is a mailing list, and the only way onto it is to ask twice.
How you get on it. There are three places to give us an address: the form on the home page, the "tell me when this opens" box on a campaign that has not opened yet, and a checkbox at checkout that is never ticked for you. Whichever one you used, we write to the address to ask whether it is really yours, and it is not on the list until you click the link in that email.
What we hold. The address, which list it is for, which of the three places you gave it to us from, whether and when you confirmed it, and two random strings: one that confirms the address, one that removes it. No name, no order, and no link to your account.
The legal basis is your consent (Art. 6(1)(a) GDPR). Buying something is not consent and never stands in for it. The checkbox at checkout is a separate question that does nothing to your order either way.
What it sends. An email when a new campaign opens, or, if you asked about one campaign, an email when that campaign opens.
Getting off it. Every one of those emails carries a one-click unsubscribe: your mail app's own Unsubscribe button works, and so does the link in the footer. Either removes the row. You can also write to support@roplush.com and we will do it. Leaving the list does not affect email about an order you have placed.
| Who | What they hold | Where |
|---|---|---|
| Supabase | Accounts and sign-in: your email, password hash, connected providers, profile, saved addresses, and the order records themselves | EU/US, standard contractual clauses |
| Stripe | Taking and refunding payment, the card details we never see, receipts, and its own record of the payment | EU/US, standard contractual clauses |
| Vercel | Hosting and delivering this website, and short-lived server logs | EU/US, standard contractual clauses |
| Cloudflare | The Turnstile challenge on the sign-up and password-reset forms, and the IP address it sees while making it | Global, standard contractual clauses |
| Resend | Delivering our email: account confirmations and password resets, updates about your order, and the mailing list | EU/US, standard contractual clauses |
| Google Workspace | The mailbox we read and answer your email from | EU/US, standard contractual clauses |
| Fulfilment and carriers | Your name and delivery address, to pack and deliver your parcel | Depends on your delivery address |
Each is a processor acting on our instructions under a data processing agreement, except Stripe, which is also an independent controller for fraud prevention and its own regulatory obligations.
A partner sees sales figures, never buyers, and never a delivery address. The creators we work with receive no personal data about the people who backed their campaign.
We disclose data where the law requires it — to answer a court order, a subpoena or a lawful request from a government or investigatory body, and where we need to establish or defend a legal claim or investigate fraud.
If the business or part of it is sold, customer and order records may transfer to the buyer as part of that sale. We will say so on this page before it happens.
We do not sell your personal data, and we do not share it for anyone else's marketing.
Our processors hold data in the EEA and in the United States, as the table above sets out. Where data goes outside the EEA it is covered by the European Commission's standard contractual clauses. Where your parcel is packed and posted from depends on the campaign and on your delivery address.
Your basket, staying signed in, and Stripe's fraud checks at checkout. Every one of them is strictly necessary, which is why none requires consent and why there is no cookie banner on this site.
The cookies policy names each one, says what it holds and says how long it lasts.
Passwords are stored as hashes we cannot reverse. The basket and sign-in cookies
are httpOnly, so no script on the page can read them. Card details never reach
our servers. Access to order records is limited to the people who need it, and
every page that shows one checks who is asking on the server.
No website is completely secure. Use a password you have not used anywhere else, and never send us a card number or a password by email.
Creator profiles link out to the creators' own games, channels and social accounts, and some pages link to Stripe. Those sites have their own privacy policies, and this one stops at the edge of roplush.com.
You can delete your account yourself, from your settings. It happens immediately and it cannot be undone. The right of erasure and the duty to keep an invoice genuinely conflict, so here is how we resolve it, and the deletion screen says the same thing before the button.
What goes. Your sign-in, your email address, your password, your connected Google or Discord identities, your display name, your bio, your saved addresses, your supporter listing, and your public profile. Your handle is released the moment the account goes and anybody may take it afterwards.
What stays. The order records: what was bought, what was paid, and the address it shipped to. An order is an invoice and we are required to keep invoices for the period above. What is removed from them is you — the link between those records and your account is set to nothing. Nothing in our database then says they were yours.
What we cannot reach. Stripe holds its own record of the payment, because it processed it. That is subject to Stripe's retention rather than ours.
Deleting your account does not cancel an open order and does not waive anything. If a campaign misses its floor, everyone who backed it is refunded to the card they paid with, whether or not they still have an account here.
Your settings page has a download that gives you what this site holds about your account, as a JSON file: your profile, your email, which sign-in providers are connected, and your saved addresses. You do not have to ask us for it and we do not need to know why you want it.
Under the GDPR you can ask us to:
Several of these you can do yourself, immediately: edit your profile, delete a saved address, turn the supporter listing off, download your data, or delete the account. For anything else, write to support@roplush.com. We answer within one month and we do not charge for it. We may need to confirm who you are first, usually by writing from the address you ordered with or the address on your account.
If you think we have handled your data badly, tell us so we can fix it. You also have the right to complain to the data protection authority in the country where you live.
RoPlush sells to adults. Plenty of the games, channels and communities we make plush for have audiences under 18, so to be clear: you must be 18 or older to place an order or to make an account, or have a parent or guardian do it for you. We do not knowingly collect data from children. If you believe a child has ordered or signed up without permission, write to us and we will cancel the order, delete the account, and delete the data.
If we change this policy we will change the date at the top of the page. If a change is significant and affects an order you have already placed, we will email you rather than rely on you re-reading this page.
Write to support@roplush.com with anything about this policy or about the data we hold on you. Do not include a card number, a password or anything else sensitive in an email.