Bandit Market

Legal

Privacy

What we store, what we don’t, and who else sees it. Plain English, same as the terms.

The short version

No analytics, no tracking cookies, no ad networks, no third-party scripts. Your browser talks to this site and nothing else.

We keep the minimum needed to take an order and deliver it: who you are on Discord, the Minecraft name to deliver to, and a record of what you bought.

What we store

  • Your Discord account — ID, username and avatar, from signing in. This is how an order is tied to a person.
  • Your Minecraft username — where the order gets delivered.
  • Your orders — what you bought, what it cost, how you paid and where it got to.
  • Your balance, if you top one up, and the deposits and spends that make it up.
  • Reviews you write, and referral codes you use or earn from.

What we never store

  • Card details. The site takes cryptocurrency only — there is nowhere to type a card number.
  • Your email, real name or address. We never ask, and there is no field for them.
  • Your password. Sign-in goes through Discord, so you type it into Discord, never into this site.
  • Your IP address. It is never written to our database. It is used only, and briefly, to stop one person hammering the site and to count how many people are on it — in a form that cannot be traced back to you.

Cookies

Two, both strictly necessary: one keeps you signed in for 30 days, the other exists for the few seconds you are being sent to Discord and back. No tracking or advertising cookies, which is why there is no consent banner — there is nothing to consent to.

Who else sees it

We do not sell your data and we do not share it for advertising. These see part of it to do their job:

  • Discord — you sign in through it, so it knows you did.
  • NOWPayments, our payment processor — gets the amount, the currency and your order reference. Not your name, your Discord account or your Minecraft username.
  • The DonutSMP, Mojang and GeyserMC APIs — get your Minecraft username, to look up the account and show your skin.
  • Public blockchain explorers — get a payment address or transaction id when we check a payment has arrived. Those are public on the chain anyway.
  • Supabase, Hetzner and Cloudflare — they host and carry the site, so the data passes through them.

Age

Signing in needs a Discord account, and Discord requires you to be at least 13 — older in some countries. We do not knowingly keep information about anyone younger.

If you are a parent or guardian and want a child’s account and its details removed, ask on Discord and we will do it.

How long we keep it, and getting it removed

Orders and the balance ledger are kept — they are the record of what you paid and what you received, and deleting them would leave a dispute with nothing to settle it. Sign-in sessions expire after 30 days.

Want your account and its personal details removed? Ask on Discord from the account in question and we will do it. Where we have to keep the record of a completed transaction, we will say so plainly rather than quietly keeping it.

Anything else — including if you think somebody else has got into your account — same place. Message from the account you ordered with.

We may update this page. The version shown here is the one that applies while it is displayed. It describes how the site actually behaves; it is not legal advice and has not been reviewed by a lawyer.