Privacy Policy

This Privacy Policy explains how Haunt Market ("Haunt Market", "we", "us", or "our") collects, uses, stores, and protects information when you visit our website or use our services, including signing in through Discord via our authentication provider (haunt.gg). By using Haunt Market, you agree to the practices described in this policy.

When you sign in to Haunt Market, you are redirected to authenticate through haunt.gg, which connects to your Discord account. Once you authorize the connection, we receive and store the following information from your Discord/haunt.gg profile:

• Your Discord user ID (subject identifier) and account UID
• Your username, display name, and preferred username
• Your profile picture and public profile URL
• Your email address and email verification status, where the email permission scope has been granted
• We also automatically collect your IP address when you access our services, which we use for security, fraud prevention, and enforcement of our platform rules (including bans and access restrictions).
• Any linked account connections you have chosen to make visible on your profile

We never have access to your Discord password. Authentication is handled entirely by haunt.gg using the OAuth 2.0 protocol with PKCE (Proof Key for Code Exchange), and the authorization state is validated on every login to prevent forged or replayed requests.

To keep you signed in, we store the following browser cookies, all of which are set as HTTP-only, meaning they cannot be read or modified by client-side scripts:

• access_token — a short-lived token used to authenticate requests on your behalf
• refresh_token — a longer-lived token used to silently renew your session without requiring you to log in again
• expires_at — a timestamp used to determine when your access token needs to be refreshed
• session_user — your account identifier, used to associate your browser session with your profile

These cookies are strictly necessary for the operation of the service. We do not use advertising cookies or third-party tracking pixels.

We use the information described above to:

• Authenticate you and maintain your logged-in session
• Display your username, avatar, and profile information within the platform
• Detect abuse, prevent fraud, and enforce bans or access restrictions using IP address and device/session information
• Operate support tickets and respond to inquiries you submit
• Maintain the security and integrity of the platform, including detecting fraud or abuse
• Communicate important updates about your account or our services when necessary

We do not sell your personal information to third parties.

We do not share your personal information with third parties except:

• With haunt.gg and Discord, as necessary to authenticate and maintain your session
• If required to do so by law, regulation, legal process, or governmental request
• To protect the rights, property, or safety of Haunt Market, our users, or the public
• In connection with a merger, acquisition, or sale of assets, subject to standard confidentiality protections

Vouches, listings, and community content you choose to post publicly on our website or Discord server are, by nature, visible to other users and are not covered by this policy in the same way private account data is.

We retain your account information for as long as your account remains active or as needed to provide you with our services. When you log out, your session cookies are cleared from your browser and your access and refresh tokens are revoked with haunt.gg. You may also revoke Haunt Market's access to your Discord account at any time through your Discord connection settings.

We take reasonable technical and organizational measures to protect your information, including:

• Storing authentication tokens in HTTP-only cookies that are inaccessible to client-side JavaScript
• Encrypting data in transit using HTTPS/TLS
• Validating OAuth state and PKCE code verifiers on every login to prevent authorization code interception and cross-site request forgery
• Limiting access to account data to the systems and personnel that require it to operate the service

No method of transmission or storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security.

Depending on your location, you may have the right to request access to, correction of, or deletion of your personal information. You can:

• Log out at any time to end your session and revoke stored tokens
• Revoke Haunt Market's access from your Discord account settings, which prevents further authentication
• Contact us through our Discord server or support ticket system to request deletion of account data associated with your profile

Haunt Market is not directed at individuals under the age of 13, or under the minimum age required by Discord's Terms of Service in your jurisdiction, whichever is higher. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child in violation of this policy, we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of Haunt Market after changes take effect constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or how your information is handled, please reach out through our Discord server or by opening a support ticket.