Privacy Policy

• We collect what we need to run the marketplace: your Discord and Roblox basics, your tickets, messages and files.
• We don’t sell your data, show ads or use tracking cookies.
• You can ask us to see or delete your data at any time: [email protected].

We use Discord OAuth2 with the identify and connections scopes. We store your Discord user ID, username, display name and avatar. We look at your connections only to find a verified Roblox account and link it for you; we don’t store your other connections. We never see your email, password, servers or messages.

We keep the Discord access token only for the moment of login; it isn’t stored.

With Sign in with Roblox (OAuth 2.0, scopes openid and profile), or by verifying a phrase on your Roblox profile, we store your Roblox user ID, username, display name and avatar. We don’t get your Roblox password or account access.

To check payments, we use Roblox’s public data and a Cortexed service account to see whether your Roblox account owns the item you were asked to buy, and (when the studio allows it) the studio group’s sales record. For studios, we read the group’s audit log to detect payouts to designers.

• Tickets: what you ordered, your answers, budget, status and payment details (item, price, purchase ID), and support tickets you open with studios.
• Chat messages, images, videos and files you upload, and the final files delivered to you.
• Studio profiles, ticket types, team membership, commission rates and payout records.
• Reviews, notifications, the studios you follow and announcements studios post.
• Reports you send to Cortexed staff. They’re only visible to staff; the person you report isn’t told it was you.

Our server logs record IP addresses and requests to keep the service secure and to rate-limit abuse; logs are kept for about 7 days. Your login is stored in your browser’s local storage (not a cookie) and expires after 14 days or when you log out. We don’t use analytics or advertising trackers.

• To run your account, tickets, chat, file delivery, payment checks, reviews and studio tools.
• To show your public profile bits (name, avatar, Roblox username) to the people you work with, and studio pages and reviews to everyone.
• To keep the platform safe: preventing fraud, handling reports and disputes, and enforcing our Terms.
• To send you in-app notifications (and Discord webhooks a studio sets up for its own team).

We don’t sell or rent personal data. We use these providers to run Cortexed, only for that purpose:

• MongoDB Atlas (database), Cloudflare R2 (file storage and backups), DigitalOcean (API server), and our website host (Vercel or Cloudflare Pages).
• Discord and Roblox, when you log in, link accounts or when we check purchases.

Some of these providers are outside your country, including in the United States. We may also share data if the law requires it or to protect users from harm.

• Account, tickets, messages and files: while your account exists.
• Notifications: 60 days. Server logs: about 7 days. Database backups: 14 days.
• Uploads that were never sent are deleted after a day.
• After deletion, some records may be kept in anonymised form (for example a ticket the other party still needs), or where the law requires.

• Unlink your Roblox account any time in Settings.
• Revoke access in Discord (User Settings → Authorized Apps) or Roblox (Settings → Security → Authorized apps).
• Ask for a copy of your data, a correction, or deletion of your account by emailing [email protected] from, or about, your account. We’ll answer within 30 days.

Depending on where you live (for example under the GDPR or the Australian Privacy Act) you may have further rights, including complaining to your data protection authority.

Cortexed is for people 13 and older. If you believe a child under 13 has an account, contact us and we’ll delete it.

Cortexed is responsible for your data on Cortexed. If we change this policy in a meaningful way we’ll tell you in the app. Contact: [email protected].