Privacy Policy

Last updated 10 July 2026

Alca Market is a fan-run, non-commercial project. This policy describes, in plain language, exactly what data the site touches. The short version: it collects the minimum needed to run a trading board, and nothing else.

What we collect

• Discord identity: when you sign in, Discord provides your Discord user ID and username (the identify scope only). We never see your email, password, servers, or messages.
• Your market activity: the envoy name you choose, your trade status, the listings you post, the trades you complete or accept, and the reputation you give and receive.
• A session cookie: one strictly necessary cookie named sid that keeps you signed in. See the Cookie page.
• Technical logs: the site runs on Cloudflare's infrastructure, which processes IP addresses and request metadata to deliver and protect the site, as any web host does.

What we do not do

• No analytics, no advertising, no tracking pixels, no fingerprinting.
• No data is ever sold or shared for marketing.
• Fonts and all assets are served from this domain. Visiting the site contacts no third party except Cloudflare, which hosts it, and Discord, only at the moment you choose to sign in.

Why we process it (legal bases)

Account and trading data are processed to provide the service you request (performance of a contract, GDPR Art. 6(1)(b)). Security logging is a legitimate interest (Art. 6(1)(f)).

Where it lives

Data is stored in a Cloudflare D1 database and processed on Cloudflare's global network. Cloudflare acts as the hosting processor under its own data processing terms.

How long we keep it

• Session cookies and server sessions expire after 30 days.
• Account data is kept until you request deletion.
• Completed trades form other players' reputation ledgers, so on account deletion trades are anonymised (your name is detached) rather than erased, unless you request full erasure.

Your rights

Under the GDPR you can request access to, correction of, or deletion of your data, ask for a copy in portable form, and object to processing. There is no self-service button yet, so requests are handled personally and promptly: contact spektrumgg on Discord. You may also complain to your local data protection authority (in Denmark, Datatilsynet).

Children

The Service is not directed at children under 13, and account use requires a Discord account, which has its own age requirements.

Changes

If this policy changes, the date above will change with it.