Privacy Policy

Received from Battle.net when you sign in:

• ◆Battle.net account id — required. It is how the Service recognises you on your next visit, and it is never shown to other members.
• ◆BattleTag — required. It becomes your display name, visible to other members on your listings and in chat, so that a trade partner can reach you in game. Ask at support@townportal.app if you want a different display name.
• ◆No email address, no password, no game data. Signing in requests no scopes, and Battle.net returns nothing beyond the two items above.

Provided by you: listings, chat messages, trade records, and feedback — whatever you write or agree to. A feedback report also stores the screen path and the language you were using when you sent it, so that the operator can reproduce what you saw.

The Service records some things automatically because other members rely on them:

• ◆Last active time — refreshed while the Service is open in your browser, at most once every five minutes. Other members see it as an approximate availability badge, never as an exact timestamp.
• ◆Response rate and average response time — computed from how you reply to buyers who message you, and shown on your listings.
• ◆Listing timestamps — when a listing was created, bumped, or expired.

In addition, the hosting and database platforms keep access logs on the operator's behalf. These contain IP address, browser user agent, and request time, and are used for security and troubleshooting. The operator does not combine them with your profile for any other purpose.

The Service sets no advertising cookies and runs no ad network. Alongside the cookies for your sign-in session and your language choice, Google Analytics sets cookies that count visits and show which screens get used. They hold a randomly generated identifier — never your BattleTag, your email address, or anything you have written on the Service. If you are visiting from the EU, the EEA, or the UK, we ask before any of this is set, and nothing is measured until you accept. You can change your answer at any time at the bottom of this page, and declining stops the analytics script from loading at all.

Personal data is used only for these purposes:

• ◆Authenticating you and keeping your session.
• ◆Running the Service — publishing listings, delivering messages, recording completed trades.
• ◆Helping members judge each other — availability, response metrics, and completed-trade counts.
• ◆Computing estimated values from completed trades. These are aggregated; no individual trade is exposed.
• ◆Answering the feedback you send and fixing what it points at.
• ◆Measuring how the Service is used — which screens are visited, where visitors arrive from, and where people get stuck — so the parts people depend on can be improved.
• ◆Detecting and preventing fraud, abuse, and manipulation.

Your data is kept for as long as you have an account. There is no scheduled deletion job yet: listings, chat messages, and trade records stay until you ask for them to go, because both parties to a trade need to be able to look back at what was agreed.

To have your account and its data deleted, write to support@townportal.app. It is destroyed without delay — no waiting period. Feedback you sent is deleted along with your account.

Access logs are held by the hosting and database providers under their own retention schedules; the operator does not extend them. Where a law requires records to be kept longer than you have asked, that period applies to those records only, and they are used for nothing else.

Your personal data is not sold, and it is not provided to third parties for their own purposes. It is disclosed only where a law or a court order requires it.

The Service runs on infrastructure operated by others. They process data on the operator's instructions and for no other purpose:

• ◆Supabase — database, authentication, and file storage. Data is held in the Seoul region (Republic of Korea).
• ◆Vercel — application hosting and content delivery. Requests may be served from data centres outside Korea, including the United States, so access-log data is transferred abroad.
• ◆Google — visit measurement through Google Analytics. What is sent is the address of the screen you opened, where you arrived from, an approximate location Google derives from your IP address, and your device and browser type. Two things that happen inside a screen are counted as well: that a search came back empty, and whether posting a listing succeeded or was refused. Neither carries what you searched for, which item it was, or anything that points back to you. Google processes it on servers outside Korea, including the United States. Your BattleTag, your email address, and the content of listings and messages are not sent.

Blizzard Entertainment is not one of these processors — it is where you authenticate. Your browser goes to Battle.net, you authorise the Service there, and Blizzard returns your account id and BattleTag. What Blizzard does with your data in that exchange is governed by Blizzard's privacy policy, not this one, and the operator sends Blizzard nothing about you.

You may at any time ask to see the personal data held about you, correct it, delete it, or stop its processing.

Right now every one of these goes through support@townportal.app, answered within ten days — access, correction, changing your display name, taking a listing down, deleting your account and everything in it. The Service has no self-service controls for them yet. That is a gap rather than a policy: until those screens exist this mailbox is the only channel, which is why it is monitored.

A request may be refused, in whole or in part, where a law requires the data to be kept — you will be told which law and why. If you believe your rights have been infringed, you can report it to the Korea Internet & Security Agency's privacy centre (privacy.kisa.or.kr, 국번없이 118) or apply for dispute mediation to the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).

Access to personal data is limited to the operator. Data is encrypted in transit, and row-level security in the database restricts each query to the rows the requester is entitled to — the application runs under your own session, not a key that bypasses those rules, so a coding mistake cannot quietly hand your private messages to someone else.

Authentication happens at Battle.net, so no password of yours ever reaches the Service and none is stored. Access logs kept by the platforms are used only for security and troubleshooting.

Kevin Seo is responsible for personal data protection for the Service and answers requests personally.

Email: support@townportal.app

If this policy changes, the new version is published in the Service at least seven days before it takes effect, and thirty days before where the change affects your rights or how data is used. The effective date at the top of this page always reflects the version you are reading.