1. Who we are and how to reach us
RoCandy is an online marketplace where you can buy, sell and trade in-game items. Listings include Steal a Brainrot (SAB) brainrots, Murder Mystery 2 (MM2) items and Roblox Limiteds, and CS2 skins are planned. Items are delivered and received through trades with our automated bot accounts inside the game or platform.
We decide how and why the personal data in this policy is used, so we are responsible for it.
For privacy questions, or to use any of the rights in section 9, contact us through the support channels listed on the site. Right now that means Discord.
RoCandy is not affiliated with, endorsed by or sponsored by Roblox, Steam, the companies that run them, or the developers of any game. All game names, item names and trademarks belong to their owners.
2. The information we collect
We try to collect only what we need to run RoCandy. Here is what that means in practice.
Information from your Roblox account. For now, you can sign in only with a Roblox account. To prove the account is yours, you paste a one-time passphrase into your Roblox profile description. We then read your public profile through Roblox's public API. From that profile we keep:
- Your Roblox user ID
- Your username and display name
- A link to your avatar image
We never ask for your Roblox password. Never give it to anyone who says they are from RoCandy. Discord and Steam sign-in appear on the site as coming soon. Before they go live, we will update this policy to explain what data they use.
Wallet and deposit information. To run your site balance, we keep a wallet ledger that is linked to your Roblox user ID. It records:
- Your balance, shown in US dollars
- Your crypto deposits: the coin, network, transaction ID, amounts, status and timestamps of each one
You get a personal deposit address for each coin and network, which is how a payment sent to one of these addresses is matched to your account. If you sell items and choose a crypto payout, we use the wallet address and network you give us to send it.
Trade information. Trades with our bots happen inside the game or platform. Our bots see what any trading partner would see there, such as your in-game username and the items in the trade. We use this to make sure the right items go to, or come from, the right account.
Settings kept in your browser. Your account settings are currently stored only in your own browser's local storage, not on our servers. They are your Steam trade URL (for CS2 trades, which are planned), your email address and your email notification preferences. Your browser also keeps a few small preferences, which are described in section 4.
Technical information. When you visit RoCandy, your browser sends standard technical information such as your IP address and browser details. We use your IP address briefly for rate limiting and security, and we do not store it in a database. Our hosting and network provider also processes this kind of data as part of delivering the site.
Messages to support. If you contact us on Discord, we receive the messages you send and the Discord profile details Discord shows us. We use them to help you.
What we do not collect. RoCandy does not handle payment card data itself, and we currently do not use advertising trackers or analytics tools. If we ever need more information from you, for example to meet a legal duty or look into suspected fraud, we will tell you at the time what we need and why.
3. How we use your information and our legal reasons
We use personal data only for the purposes below. Some data protection laws require a legal basis for each use of personal data. Where such a law applies to you, the basis is shown after each purpose.
- Signing you in, keeping you signed in and showing your profile. Basis: performing our agreement with you (contract).
- Running your balance: crediting crypto deposits after network confirmations, keeping your balance correct as you buy and sell, and showing your deposit history in your account. Basis: contract.
- Delivering and receiving items through trades with our bots, and sending sale payouts. Basis: contract.
- Running rewards such as giveaways and daily quests, including counting tickets and picking winners. Basis: contract (the rules of the reward you enter).
- Keeping RoCandy safe. This covers rate limiting, finding and stopping fraud, theft, abuse and automated attacks, and enforcing our Terms of Service, including the 18+ age requirement. Basis: our legitimate interest in protecting RoCandy and its users, and legal obligation where the law requires it.
- Answering support requests and handling disputes. Basis: contract and legitimate interests.
- Meeting legal duties, such as keeping records the law requires or responding to valid legal requests. Basis: legal obligation.
- Remembering choices you make on the site, such as your language and lite mode. Basis: our legitimate interest in a site that works the way you set it up.
We do not sell your personal data, we do not use it for advertising and we do not build advertising profiles about you.
4. Cookies and browser storage
RoCandy uses a sign-in cookie and a small amount of browser storage. We need them to run the site or to remember choices you make.
- Sign-in cookie. When you sign in, we set a cookie that holds your Roblox user ID, username, display name and avatar link. It lasts up to 30 days, or until you sign out. The cookie is signed, so we can tell if anyone has changed it. It is also HttpOnly, so scripts on the page cannot read it.
- Local and session storage. These hold your account settings (Steam trade URL, email address and email notification preferences), your lite-mode choice, a saved copy of your signed-in profile so the site can show you as signed in straight away, and a few similar small preferences. The language you choose is set through the page address.
We do not use advertising cookies, tracking pixels or analytics tools. If that ever changes, we will update this policy first and ask for your consent where the law requires it.
Some parts of the page load from other services. Web fonts load from a third-party font service, and avatar images load from Roblox's image servers. When your browser fetches these files, those services receive your IP address and basic browser details, as they would with any web request. Their own privacy policies cover that data.
You can delete the cookie and browser storage at any time in your browser settings. Deleting the sign-in cookie signs you out. Your settings are stored only in your browser, so clearing site data erases them too, and you will need to enter them again.
6. Crypto payments and public blockchains
Crypto payments work differently from most other data, so please keep these points in mind.
- You get a personal deposit address for each supported coin and network. Before you pay, the site shows the minimum amount and an estimate of the fees. A payment below the minimum is not processed by our payment processor and cannot be credited, and a coin sent on a different network than the one shown can be lost.
- A payment is credited to your balance after the required network confirmations, at the US dollar value actually received after the processor's fee and the network forwarding cost.
- Blockchain transactions are public and permanent. Anyone can see the addresses, amounts and times of a transaction, and others may be able to link an address to you.
- No one, including us, can change or delete data recorded on a blockchain. The rights to correct or delete data in section 9 therefore cannot apply to it.
- If you sell items for a crypto payout, the payout transaction and the receiving wallet address you give us will also be recorded on the blockchain.
- We may check deposits, trades and payouts for signs of fraud, stolen funds or other misuse, and we may hold a transaction while we check it.
Our Terms of Service explain the rules for deposits and payouts in more detail.
7. How long we keep information
We keep personal data only for as long as we need it for the purposes in this policy.
- Sign-in cookie: up to 30 days, or until you sign out or delete it.
- Browser storage: session storage is cleared when you close the tab, and local storage, including your settings, stays until you clear it. We do not keep a copy of your settings on our servers.
- IP addresses: used briefly for rate limiting and security, and not stored in a database.
- Wallet ledger, balance and deposit records: kept while you use RoCandy. After that, we keep them only while there is still a reason to, for example if you still have a balance, a deposit or trade is disputed or being checked for fraud, or the law requires us to keep financial records.
- Support messages: these are sent through Discord and stored by Discord under its own policies. We use them only to handle your request and any related dispute.
- Blockchain records: permanent and outside our control.
When we no longer need data, we delete it or remove the details that identify you.
8. How we protect your information
We protect the data we hold with safeguards that fit what RoCandy does. For example:
- We never ask for or store your Roblox password. We confirm you own the account with a one-time passphrase in your public profile.
- The sign-in cookie is signed, so we can detect tampering. It is also HttpOnly, so page scripts cannot read it.
- We use rate limiting to slow down abuse and automated attacks.
- We do not handle payment card data ourselves.
No website is completely secure, so please help protect your account too:
- Check the site address before you sign in, and be careful with links from people you do not know.
- Never share your Roblox password or other login details with anyone, including people who say they are RoCandy staff.
- Before you accept a trade, check that it matches the trade you started on RoCandy.
- Protect your Roblox account with the security features Roblox offers, such as two-step verification.
- Check the coin, network and address before you send crypto. A payment sent on the wrong network can be lost.
If a security incident affects your personal data, we will act quickly to contain it. We will tell affected users and the relevant authorities where the law requires us to.
9. Your rights and choices
Depending on where you live, you may have some or all of these rights over your personal data:
- To see the personal data we hold about you and get a copy of it
- To have wrong or incomplete data corrected
- To have your data deleted
- To limit how we use your data, or to object to a use based on our legitimate interests
- To receive your data in a portable format
- To withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.
- To complain to the data protection authority where you live
Some privacy laws also give you the right to opt out of the sale of your personal data or its use for targeted advertising. We do not sell personal data or use it for advertising, so there is nothing to opt out of. We will not treat you differently because you use any of your privacy rights.
How to make a request. Contact us through the support channels listed on the site. To protect your account, we may ask you to show that you control the Roblox account the request is about before we act on it. Where the law allows, someone you authorize can make a request for you, and we will ask for proof of that authority. We will respond within the time limits set by the law that applies to you. If we cannot fully meet a request, for example because we must keep certain records, we will explain why, and you can ask us to reconsider.
Choices you can make yourself. You can sign out at any time. You can also clear your browser's cookies and site data, which removes the sign-in cookie and everything stored in your browser, including your settings.
Automated steps. Some things on RoCandy happen automatically. For example, rate limits can briefly block repeated requests, and deposits are credited once the required confirmations arrive. If you think an automated step has affected you unfairly, contact support and a person will review it.
Emails. Your email address and notification preferences are currently stored only in your browser, so we do not use them to send you emails. If we start sending emails, we will update this policy first, and any marketing emails will include an easy way to unsubscribe.
10. Age requirement
RoCandy is only for adults. You must be at least 18 years old to use it, and you confirm this with a checkbox when you sign in. If you are under 18, please do not use RoCandy or give us any personal data.
Accounts that turn out to belong to someone under 18 will be closed, and we will delete the personal data we hold about that person, except records we must keep by law or to prevent fraud.
Parents and guardians who think their child has used RoCandy can reach us through the support channels listed on the site, and we will look into it.
11. International data transfers
Our service providers work in many countries, and our hosting provider serves RoCandy from data centers around the world. Your personal data may therefore be processed outside the country you live in, including in countries whose data protection laws differ from yours.
Where the law that applies to you requires extra safeguards for these transfers, we will take the steps it requires.
12. Other websites and services
RoCandy links to or works with services we do not control, such as Roblox, Discord, Steam and our crypto payment processor, and, once card payments launch, third-party payment providers. This policy does not cover those services. Their own privacy policies apply to what you do on them, so please read them.
13. Updates to this policy and contact
We may update this policy as RoCandy changes, for example when a feature marked as coming soon launches or when the law changes. When we update it, we will change the "Last updated" date at the top. For a significant change, we will also post a clear notice on the site before the change takes effect.
If you keep using RoCandy after an update takes effect, the updated policy applies to you.
If you have questions about this policy or your personal data, contact us through the support channels listed on the site. Right now that means Discord.