Privacy Policy

Who we are

[legal name of the person or business running zafue], based in [country], runs zafue and decides how your information is used.

For anything about your information, email [contact email].

What we collect

Your account. Your username. Your email address, if you sign up with email. If you use Discord to log in: your Discord user ID, your Discord username, and the email address on your Discord account (only if Discord says it's verified).

Login codes. We keep a scrambled copy of each 6-digit code we email you, never the code itself. Codes stop working after 10 minutes.

Orders. What you bought or sold, the price, the coin amount, the network you paid on, the transaction ID if you paste one, and what happened to the order (paid, refunded and so on).

Wallet addresses. The payout wallet sellers give us. When a payment reaches zafue's wallets, we record the wallet it came from, the amount and the transaction ID. That information is already public on the blockchain.

Account logins for listings. Sellers enter the account's Roblox username and password, its original email and that email's password, and its recovery details. These are encrypted before they're saved. The site only unlocks them for the seller while the account is unsold, and for the buyer after their payment is confirmed. zafue holds the encryption key, but zafue's admin pages never show the logins. We also keep a scrambled fingerprint of the Roblox username, so we can spot the same account being listed twice without unlocking anything.

What you write and upload. Listings, reviews, problem reports and replies, stolen-account reports, and the screenshots you add.

Seller details. Whether you've applied or been approved, whether your deposit is paid, whether your ID has been verified (the site only stores yes or no), and any ban with its reason. [How ID checks are done and what is kept — for example, a document shown in a Discord ticket and not saved]

Screenshots

Screenshots you upload are stored at a web address that isn't listed anywhere, but anyone who has the link can open it. Listing screenshots are shown to everyone. Screenshots added to a problem report are only shown on the order page, but they're stored the same way.

Cookies

We only use the cookies the site needs to work:

• zf_session keeps you logged in. It holds a random code and lasts 30 days, or until you log out.
• zf_oauth is only set while you log in with Discord, for up to 10 minutes. It protects you from fake login links.

Your browser also remembers which steps of the "secure your account" checklist you've ticked on an order page. That's saved on your device only.

We don't use advertising or tracking cookies.

Why we use it

• to create your account and log you in
• to run orders and escrow: confirming payments, unlocking logins, paying sellers and sending refunds
• to look into reported problems and stolen-account reports
• to prevent fraud, for example spotting accounts listed twice and banning sellers who pull accounts back
• to keep records of the money we receive, hold and pay out
• to email you login codes

[The legal basis for each use — for your professional adviser to fill in]

Who can see what

• Everyone can see seller usernames, listings (with their screenshots and the seller's instructions), sellers' sales, ratings and ID-verified badges, and reviews. Reviews don't show who wrote them.
• Sellers see their buyers only as a number, like "Buyer #1234", never your username or email.
• Buyers see an account's logins only after their payment is confirmed.
• zafue's admins can see account, order and payment details so they can run the site, but not account logins.

We don't sell your information.

Companies that help us run zafue

• Vercel hosts the website. Like most hosts, it may keep short-term technical logs, such as IP addresses, to run and protect the site.
• Supabase stores the database and the screenshots, on servers in London.
• Resend sends our emails. It receives your email address and the login code.
• Discord runs "Continue with Discord". If you use it, Discord shares your Discord ID, username and email with us. Support tickets in the zafue Discord are also covered by Discord's own privacy policy.
• TronGrid, Helius and Alchemy let us check the blockchain for payments into zafue's own wallets. They can only read public blockchain data, and we don't send them your name, email or account details.

Some of these companies are based outside the UK, for example in the United States, so your information may be handled there. [How these transfers are protected — for your professional adviser to fill in]

How long we keep it

[How long you keep each kind of information: accounts, orders and payment records, account logins after a sale, screenshots, and login codes]

Your rights

Depending on where you live, you may have the right to ask for a copy of your information, to have it corrected or deleted, or to object to how we use it. To ask, email [contact email]. There's no delete-account button yet, so please ask us. We may need to keep some records, such as orders and payments, [how long, and why].

If you're unhappy with how we've handled your information, you can complain to [your data protection regulator — in the UK, the Information Commissioner's Office (ICO)].

Keeping it safe

Account logins are encrypted. Login codes and the code in your session cookie are only stored scrambled. The database is locked so it can't be read through Supabase's public tools, and uploads are checked to make sure they're really images. No website is completely secure, though, so never reuse a password from another site.

Children

zafue is for people aged [minimum age] and over.

Changes to this policy

We may update this policy. The date at the top shows when it last changed.