Privacy Policy

LWK Store is operated by LWK Trading, LLC ("LWK Trading," "we," "us," or "our"), and is available at lwkstore.com. This Privacy Policy explains what information we collect when you use the Service, why we collect it, who we share it with, and the choices and rights you have over it. It applies to our website, our storefronts, our email communications, and the support channels we operate. By creating an account or using the Service, you acknowledge the practices described here. If you do not agree with them, please do not use the Service.

When you register an account we collect your email address, the username you choose, and a password. Passwords are never stored in readable form — authentication is handled by Supabase, which stores only a cryptographic hash. When you place an order you provide your Discord username and your Roblox username, both of which are required to deliver your items. If you contact support through our live chat we collect the contents of your messages and your username, so that our staff can respond. If you join the referral program we store the referral code you choose. You may also provide your Discord username when subscribing to VIP so that your VIP role can be assigned.

All card payments are processed by Stripe, Inc. LWK Trading does not collect, receive, or store your full card number, expiry date, or security code at any time — those details are entered directly with Stripe and are governed by Stripe's own privacy policy. What we do store is the record of the transaction: the Stripe customer, session, payment intent, and subscription identifiers associated with your account, the amount and currency charged, the number of LWK Coins granted, and the status of the order. We use these records to fulfill purchases, to grant coins reliably even if a payment confirmation is delayed, to manage VIP subscriptions, and to handle refunds and chargebacks.

While your account is active we maintain your LWK Coin balance, your complete transaction history (purchases, credits, refunds, bonuses, and promotional awards), your marketplace and bundle order history including the items purchased and the prices charged at the time of purchase, your VIP status and the date it began, your referral relationships and any commissions earned or claimed, and the promotional codes you have redeemed. Order records retain the item names and prices as they were at the moment of sale, so that a later change to our catalog never alters what your receipt says you paid. We also keep a record of the agreements you have accepted: the version of the Terms of Service and of this Privacy Policy you agreed to when you created your account, the version of the VIP Terms you agreed to if you subscribed to VIP, the date and time of each agreement, and the IP address and browser user-agent from which it was given. We keep this record to evidence your consent, and we retain it for as long as your account exists and for so long afterwards as we may need it to establish, exercise, or defend a legal claim.

When you visit the Service we automatically receive your IP address, browser type and user-agent string, device type, the referring page, and the pages you view. We derive a coarse device classification (phone, tablet, or desktop) from your user-agent in order to serve the appropriate layout. We use your IP address for security purposes, including rate limiting, fraud prevention, and abuse investigation. We keep access logs for the Value List and Trade Calculator — account identifier, timestamp, IP address, and user-agent — to detect scraping, automated access, and account sharing, as described in Section 11 of our Terms of Service. We do not use this information to build advertising profiles, and we do not run third-party advertising or cross-site tracking on the Service.

We use cookies and browser storage only for functions the Service needs in order to work. Your login session is maintained by Supabase authentication tokens stored in your browser. Your shopping cart, your currency preference, and a marker preventing duplicate welcome emails are stored in your browser's local storage and are never transmitted to us except as part of an order you submit. Administrators may hold a signed, HttpOnly maintenance-access cookie. Cloudflare Turnstile sets storage necessary to distinguish humans from automated traffic on our login and signup forms. We do not set advertising or cross-site tracking cookies. You can clear or block this storage in your browser, but doing so will sign you out and may prevent parts of the Service from functioning.

We use the information described above to: create and maintain your account and keep your coin balance accurate; process payments and grant purchased coins; fulfill marketplace, bundle, and VIP orders, which includes passing your Discord and Roblox usernames to our delivery staff; send transactional email such as email verification, welcome messages, order confirmations, coin purchase receipts, and security notices about password or email changes; operate the referral and promotional programs; respond to support requests, including relaying them to our staff through Discord; assign and remove VIP roles in our Discord server; detect and prevent fraud, chargeback abuse, bot activity, and other violations of our Terms of Service; and comply with our legal and tax obligations. We also reserve the right to send promotional email — offers, sales, new item and bundle announcements, and giveaways — to registered users who have not opted out. Every promotional email carries an unsubscribe link, and clicking it stops promotional email to your account; you can also email support@lwkstore.com to be removed. Unsubscribing applies to promotional email only and does not stop service messages such as order confirmations, receipts, security notices, or notices that our Terms of Service or this policy have changed, which are part of providing the Service. We record your promotional email preference against your account so that we can honour it.

We rely on a small number of processors to run the Service, and information is shared with them only for the purposes described. Supabase provides our database and authentication and therefore stores your account, order, and transaction records. Stripe processes all payments and subscriptions. Google Workspace delivers our transactional email and therefore processes your email address and message contents. Discord Inc. is where orders are delivered and support conversations are relayed, and receives your Discord username, your Roblox username, and your order details for that purpose. Cloudflare provides Turnstile bot protection on our login and signup forms and receives the technical signals needed to assess whether a visitor is automated. Vercel hosts the website and provides aggregate page-view analytics. Upstash provides the rate-limiting store that holds short-lived, IP-derived counters. Each of these providers processes data under its own privacy policy, and we encourage you to review them.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. Beyond the service providers listed above, we disclose information only in these circumstances: to our delivery and support staff, to the extent needed to fulfill your order or answer your question; when required by law, subpoena, or other valid legal process; when necessary to investigate suspected fraud, chargeback abuse, or threats to the safety of our users or staff; to enforce our Terms of Service or protect our legal rights; and in connection with a merger, acquisition, or sale of assets, in which case we will give notice before your information becomes subject to a different privacy policy.

We retain your account information for as long as your account remains open. Transaction, order, and payment records are retained for at least seven years after the transaction, because we are required to keep them for tax, accounting, and dispute-resolution purposes; this applies even after an account is closed. Support conversations are retained while they remain relevant to an open or recent matter. Security and rate-limiting logs are short-lived and are discarded automatically. When you ask us to delete your account, we remove or anonymize the personal information we are not legally required to keep, and retain the remainder only for as long as the applicable obligation requires.

You may access and correct most of your information directly from your account page, including your email address, password, and email preferences. You can stop promotional email at any time using the unsubscribe link in any promotional message we send, or by emailing support@lwkstore.com; service messages about your account, your orders, and changes to our Terms or this policy continue regardless. You may also ask us to provide a copy of the personal information we hold about you, to correct information that is inaccurate, to delete your account and associated personal information, or to restrict or object to particular processing. To make any of these requests, email support@lwkstore.com from the address associated with your account; we may ask you to verify your identity before acting, and we will respond within the period required by applicable law. Exercising these rights will never cause us to deny you service or charge you a different price. Note that deleting your account forfeits any remaining LWK Coin balance, which has no cash value and is not redeemable for money.

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the right to know what personal information we collect, use, and disclose; the right to request deletion of that information; the right to request correction of inaccurate information; and the right not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined by that law, and we have not done so in the preceding twelve months. You may exercise these rights, or designate an authorized agent to do so on your behalf, by emailing support@lwkstore.com.

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from them. If you are between 13 and the age of majority in your jurisdiction, you may use the Service only with the involvement and consent of a parent or legal guardian, who is responsible for any purchases made through your account. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information and close the account. Parents or guardians who believe a child has provided us with personal information may contact support@lwkstore.com and we will act promptly.

We take reasonable measures to protect your information. All traffic to the Service is encrypted in transit. Passwords are hashed by our authentication provider and are never visible to us. Financial operations such as coin balance changes are performed server-side under database-level access controls, so that balances and prices cannot be altered from a browser. Administrative functions are restricted to verified administrator accounts and enforced on the server. Our login and signup forms are protected against automated abuse. No system is perfectly secure, however, and we cannot guarantee absolute security; you are responsible for keeping your password confidential and for notifying us promptly at support@lwkstore.com if you believe your account has been compromised.

LWK Trading, LLC operates in the United States, and the providers we use store and process data in the United States and other countries. If you access the Service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection law may differ from that of your own jurisdiction. Where local law grants you additional rights over your personal information, we will honor those rights to the extent they apply to us.

We may update this Privacy Policy as the Service changes or as the law requires. When we do, we will raise the version number and update the effective date shown at the top of this page, and we will give more prominent notice of material changes affecting how we use your information. Your continued use of the Service after an update takes effect constitutes acceptance of the revised policy. We encourage you to review this page periodically.

For any question, concern, or request relating to your privacy or personal information — including requests to access, correct, or delete your data — as well as general help with an order or your account, contact us at support@lwkstore.com or use the live support chat on the site. LWK Store is operated by LWK Trading, LLC.