Privacy Policy
What personal data LootDom collects, why, who sees it, how long we keep it, and your choices.
Last updated 14 October 2026
LootLabs Digital LTD, a private company limited by shares incorporated in the Republic of Cyprus under the Companies Law, Cap. 113, with registration number HE 497888 and registered office at 48 Themistokli Dervi, 3rd floor, Office 306, 1066 Nicosia, Cyprus ("Loot Labs", "we", "us", "our" or "ours"), owns and operates LootDom: the website at lootdom.com and its affiliated websites, the games and the player, Studio, and our apps and APIs (the "Services"). This Privacy Policy explains how we handle personal data when you use them. We are the controller of that data under the EU General Data Protection Regulation (GDPR). If you have a question, write to [email protected].
1.What we collect
What you give us
- Account details: your email address, your username and display name, and, if you sign in with Google or Discord, the id and email of that account. LootDom has no passwords.
- Profile details you choose to add: a bio, your birthday, gender, language, country and links to your accounts on other sites. Your birthday, gender, language and country are only visible to you; they help us keep LootDom right for your age and region.
- Your content: the games, places, assets, avatar items and other things you create or upload, and their names and descriptions.
- Messages and chat: direct messages, and chat in games and in Studio. Text is filtered for bad words; where the filter changes a message we keep the original for moderation.
- Reports and support: what you tell us when you report someone or contact us.
- Your agreements: which version of these documents you accepted, and when.
What we collect automatically
- Device and connection: your IP address, browser and device type, and an approximate location (city, region and country) worked out from your IP address on our own systems.
- Sign-ins and sessions: when and from which device you signed in, so you can see and sign out of your sessions and we can spot unusual sign-ins.
- Activity: the games you play and when, when you were last online, your friends and groups, your inventory, and your LootBux transactions.
- Technical logs: errors and diagnostic messages from the website, the player and our servers.
- Safety recordings: when someone reports a problem in a game, a short recording of what happened (see Reports and recordings).
What we get from others
- Google or Discord, if you sign in with them: your account id and email address.
- hCaptcha, which checks that a sign-up is made by a person, and verifymail.io, which checks that an email address can receive mail before we send a sign-in link to it.
- Other players, when they report you or mention you.
Voice chat is optional and off until you turn it on. Voice is end-to-end encrypted: it is scrambled on your device and unscrambled only on the devices of the people you are talking to, so neither LootDom nor our voice provider can hear it, and we never record it. We only process what is needed to connect the call, such as who is in which voice session.
2.How we use it
| What we do | Why we're allowed to (GDPR) |
|---|---|
| Create and run your account, sign you in, and provide the games, Studio, chat, friends and groups | To provide the Services you asked for (contract) |
| Keep LootDom safe: filter text, review reports and recordings, enforce the rules, stop cheating, fraud and abuse | Our legitimate interest, and yours, in a safe platform; legal obligations |
| Protect accounts: spot unusual sign-ins, two-step verification, block automated sign-ups | Legitimate interest in security |
| Process LootBux purchases and sales, and keep records of them | Contract; legal obligations (for example tax records) |
| Voice chat | Your consent, which you can withdraw by turning voice off |
| Fix problems and improve LootDom | Legitimate interest in a working, better service |
| Tell you about changes to your account and to these documents | Contract; legitimate interest |
| Respond to legal requests and protect rights | Legal obligations; legitimate interest |
We do not use your personal data for advertising, we do not build advertising profiles, and we do not make decisions about you that have legal or similarly significant effects by automated means alone.
3.Who sees it and who we share it with
- Other people on LootDom see your username, display name, avatar and creations, and, depending on your privacy settings, your profile, online status, inventory, groups and social links. Your previous usernames are shown on your profile. Who can message you, join you in a game or find you in search is also set there.
- Game creators: when you join a game, its servers receive your user id, username, display name, avatar and how old your account is. Games may keep data about you in their data stores (for example your progress). Creators must follow our Creator Guidelines on handling player data.
- Our moderators and staff, when needed to provide support or keep LootDom safe. Staff access to reports and recordings is limited and logged.
- Service providers that run parts of LootDom for us, under contracts that only let them use the data to provide their service (see the table below).
- Authorities, when the law requires it, or when we believe in good faith it is needed to protect someone from harm, including reports of child exploitation to the organisations responsible for them.
- A buyer or successor, if LootDom is sold or merged, under this policy.
We do not sell or rent your personal data, and we do not share it for advertising.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting the website, databases, game data stores, game servers and logs | United States; game servers in the US and the EU |
| Cloudflare | Delivering the website, storing uploads and recordings, connecting voice calls (encrypted end to end) | Worldwide network |
| Google, Discord | Sign-in, if you choose them | United States |
| hCaptcha | Telling people from bots at sign-up | United States |
| verifymail.io | Checking that an email address can receive mail | Varies |
| Proton | Our email | Switzerland |
| Payment providers | Processing purchases, once paid purchases open (we will name them here before they do) | Varies |
4.Children
LootDom is used by people of all ages, and we take extra care with young players.
- A child under 13, or under the age of digital consent where they live if that is higher (14 in Cyprus, and between 13 and 16 elsewhere in the EU), may use LootDom only with the consent of a parent or guardian.
- We only collect from children what we need to run their account and keep them safe. We do not use children's data for advertising, and children's profile details such as their birthday are never shown to others.
- Safety tools apply to everyone: text is filtered, people can be blocked and reported, and privacy settings limit who can message or join a player. Messages and joining are limited to friends by default.
- A parent or guardian can ask to see the personal data we hold about their child, to correct or delete it, or to stop us collecting more, by writing to [email protected]. We will check that the request really comes from the child's parent or guardian before acting on it.
- If we learn that we have collected personal data from a child without the consent we need, we will delete it.
5.Reports and recordings
When a player reports a problem in a game, the game server keeps a recording of the minute before the report and the ten seconds after it: the players' names and positions, what they were holding, their health, the parts of the game nearby, the chat (as written and as filtered), and events such as joins, deaths and kicks. Recordings contain no audio and no video.
Only moderators can open a recording, and every viewing is logged. A recording no report needs is deleted after one day. Otherwise it is kept while a report about it is open, and deleted 30 days after the last one is closed, and never more than 90 days after it was made.
When you report someone from their profile or a conversation, the report includes your recent messages with them, so a moderator can see what happened.
7.How long we keep it
We keep personal data for as long as we need it for the reasons above, then delete or anonymise it.
| Data | How long |
|---|---|
| Your account, profile, content, messages, friends and inventory | While your account exists |
| Your previous usernames | While your account exists; old usernames are never given to anyone else |
| Sign-in history | 180 days |
| Signed-in devices | About 13 months after last use |
| Notifications | 90 days |
| Report recordings | 1 day, or up to 30 days after the report is closed (90 days at most) |
| Reports and moderation decisions | As long as needed to keep LootDom safe, handle appeals and deal with repeat problems |
| Voice session records | 1 day (voice itself is never recorded) |
| Server logs | 30 days |
| Records of transactions, agreements and account changes | As long as the law requires us to keep them |
| Game data stores | Decided by each game; earlier versions of a value are kept for 30 days |
When an account is closed, we delete its personal data within 30 days, except for what we must keep for legal, safety or fraud-prevention reasons, and content other people still use under the licence in our Terms.
8.Keeping it secure
We protect your data with encryption in transit, encryption at rest for our databases and game data, end-to-end encrypted voice, keys held in a dedicated key service for games' private settings, two-step verification for accounts, and access controls and audit logs for our staff. No service can be perfectly secure, so please keep the email account you sign in with safe, and tell us at [email protected] if something looks wrong.
9.International transfers
LootDom's servers are mainly in the United States, with game servers in the EU as well, and some providers work worldwide. When we transfer personal data out of the European Economic Area, we use the safeguards the GDPR requires: an adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or the European Commission's standard contractual clauses.
10.Your choices and rights
On LootDom: you can change your profile, your privacy settings (who sees your profile and online status, who can message you and join you, whether you appear in search), turn voice chat on or off, block people, and manage your signed-in devices and two-step verification.
By asking us: depending on where you live, you have the right to:
- get a copy of the personal data we hold about you, and to receive it in a portable form;
- have inaccurate data corrected;
- have your data deleted (closing your account);
- object to, or ask us to restrict, how we use your data;
- withdraw consent you have given, without affecting what we did before;
- complain to a data protection authority: ours is the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy), and you can also go to the authority where you live.
To use these rights, write to [email protected] from the email address on your account. We will answer within one month (or sooner where the law requires), and we will not treat you differently for using them. If you live in a US state with a privacy law, you have the rights that law gives you; we do not sell or share personal data for targeted advertising.
11.Changes to this policy
We will update this policy as LootDom changes. When a change matters, we will tell you on LootDom and ask you to accept the new version before you carry on using your account.
12.Contact us
The controller of your personal data is LootLabs Digital LTD, a private company limited by shares incorporated in the Republic of Cyprus under the Companies Law, Cap. 113, with registration number HE 497888 and registered office at 48 Themistokli Dervi, 3rd floor, Office 306, 1066 Nicosia, Cyprus. Write to [email protected] about anything in this policy, or by post to the address above.