Privacy Policy
What itsbonkersLOL collects, why, and how to get it removed.
Last updated: October 16, 2026
This policy explains what personal information itsbonkersLOL ("we", "the site", itsbonkerslol.com) and the itsbonkersLOL Discord bot collect and what we do with it. We've tried to keep it short and plain. Anything marked [REVIEW] should be checked by a lawyer before you rely on it.
The short version
- You can use the calculator, values, item pages and changelog without an account. We store nothing about you when you do, apart from anonymous daily visit counts.
- If you make an account, we store your username, a scrambled (hashed) version of your password, your inventory, and anything you choose to add to your profile.
- We don't ask for your real name. Adding an email is optional (13 and older only), and it's only used for password resets and the emails you choose. We don't run ads or third-party analytics, and we don't sell or share your information.
- Linking Roblox or Discord is optional. If you link Discord, the bot can see your roles and whether you boost our Discord server, so it can give you roles, badges and booster perks.
- The screenshot scanner reads your screenshot inside your own browser. The picture is never uploaded.
- We use one cookie, only if you open someone's invite link (see Cookies and browser storage).
- You can ask us to show you, fix or delete your data at any time from the contact page.
What we collect on the website
| Information | Why | Who can see it | How long we keep it |
|---|---|---|---|
| Username and password (stored as a one-way hash, never in plain text) | To run your account | Your username is public | Until you delete your account |
| A sign-in token for each device you sign in on, saved in that browser's local storage. We keep only a scrambled (hashed) copy, plus the device type (for example "Chrome on Windows") and when it was last used | To keep you signed in, and so you can see and sign out your devices in Settings | Only you | Until you sign out on that device or from Settings, or after 90 days without use |
| Your inventory, its value over time, and the ID of each item copy you own | To show your inventory, value chart and item copies | Public on your profile | Until you remove it or delete your account. The value chart keeps the last 180 days. |
| Item copy history: who owned each numbered item copy and when it changed hands through a trade both people confirmed | So people can check where an item came from | Public on that item copy's page | As long as the item copy exists [REVIEW] |
| Profile details you add: profile picture, banner, Discord and Roblox usernames you type in, pinned items, wishlist, badge showcase, profile theme, decoration and opening animation | To show your profile the way you set it up | Public on your profile | Until you change or remove them, or delete your account |
| Followers and who you follow | To show follower lists and notify people | Public on your profile | Until you unfollow or delete your account |
| Completed trades, trade history and trader ratings | To show trade history and ratings on profiles | Public on your profile | Until you delete your account [REVIEW] |
| Trade ads, offers and trade chat messages | To run Trade Ads and let traders talk | Ads are public. Offers and chats are only visible to the two people trading (site staff can see them when handling a report) | Until deleted [REVIEW: set a deletion date] |
| Notifications, badges, login streak and price alerts you set | To show your notifications, badges and streak, and tell you when a value changes | Notifications and price alerts: only you. Badges and streak badges: public on your profile | Read notifications: 30 days. The rest: until you remove it or delete your account |
| Linked Roblox account (optional): your Roblox user ID, username and display name, received from Roblox when you choose "Link Roblox account" | To show a verified button to your real Roblox profile | Public on your profile | Until you unlink it or delete your account. We never see your Roblox password and don't keep Roblox's sign-in tokens. |
| Linked Discord account (optional): your Discord user ID, username and display name, received from Discord when you choose "Add bot & link Discord" | To show a verified Discord button on your profile, and to connect your site account with the Discord bot and our Discord server | Public on your profile | Until you unlink it in Settings or delete your account. We don't keep Discord's sign-in tokens. |
| Server Booster status (only if your Discord is linked): whether you boost our Discord server, and since when | To unlock booster-only profile decorations, themes and the Server Booster badge | The badge and booster tag are public on your profile | Until you stop boosting, unlink Discord or delete your account |
| Email address (optional, 13 and older only) | Password reset links, a welcome email, and (if you leave them on) a summary of new messages and offers while you're away and occasional update emails. Sent through our email provider, Resend. | Only you and the site owner. Never shown on your profile. | Until you remove it or delete your account. You can turn off optional emails with the unsubscribe link in any of them. |
| Invites: who invited you (if you signed up through someone's invite link), how many people opened and joined through your link, and a scrambled code made from the joining person's IP address | To give invite badges, and to stop people inviting themselves with extra accounts | The number of friends you invited is shown to you and as badges on your profile. Who invited whom: you, the inviter's totals, and site staff | Until the account is deleted. The code can't be turned back into the IP address. |
| Theme choice, settings and which value updates you've seen | To remember your settings | Only you | Until you delete your account |
| Reports you send, replies between you and staff about them, and warnings, mutes, timeouts or bans on your account | To keep the site safe and let you follow up on your reports | You (for your own reports and their replies) and site staff | Up to the last 1,000 reports. Moderation records stay with the account. [REVIEW] |
| A copy of any account deleted by staff (everything the account had) | So an account deleted by mistake or by a rogue staff member can be put back | The site owner | 30 days, then removed for good |
| A log of staff actions (for example bans, inventory wipes and role changes, with who did them and when) | To keep staff accountable and apply daily limits | The site owner | Rolling log [REVIEW: set a deletion date] |
| Messages you send through the contact form | To answer your request | The site owner | Up to the last 500 requests |
| Messages from older site features (trade ad chats, direct messages, counter offers) that are no longer available | Kept from when those features were active | Site staff could access them | Until deleted [REVIEW: set a deletion date] |
| Visit counts (how many people visited each day, and how often shared links were opened) | So the owner can see how much the site is used | The site owner, as totals only | About 2 months. Each visitor is counted with a code made from their IP address and browser that changes every day and can't be turned back into the IP; the IP itself is never saved. |
| Your IP address, in our hosting provider's request logs | Running and securing the server | Our host (Railway) | As long as Railway keeps logs [REVIEW] |
What we collect through the Discord bot and server
The itsbonkersLOL bot runs in our Discord server and can be added to other servers. It saves what it needs on this site's server; the bot itself keeps nothing else.
| Information | Why | Who can see it | How long we keep it |
|---|---|---|---|
| Commands you use, with your Discord user ID and username (sent to the bot by Discord) | To answer the command | The answer is shown where you used it. Our host's logs record which commands were used | Not stored by us beyond host logs |
| Your roles in our Discord server (if your Discord is linked) | To give you the Verified role, badge roles and your site name, and to keep staff roles the same on the site and in Discord | Server members can see roles as usual in Discord | Read when needed, not stored separately |
| Moderation cases in our Discord server: warnings, timeouts, kicks and bans, with the reason and the staff member who did it, and automod actions | To keep the server safe and keep a record of moderation | Server staff and the site owner. The owner also gets a Discord DM for bans, timeouts, inventory wipes and staff role changes | Up to the last 5,000 cases |
| Support tickets and their transcripts (the messages in the ticket) | To answer your ticket and keep a record of it | You, server staff and the site owner | Until deleted [REVIEW: set a deletion date] |
| Mod applications: your answers, the decision and any message staff send with it | To review applications and let you know the result | Server staff and the site owner. You get the decision by DM | Until deleted [REVIEW: set a deletion date] |
| Giveaway entries | To pick winners | Winners are announced in the server | Up to the last 100 giveaways |
| Direct messages the bot sends you on our behalf (for example announcements or replies from the owner), with the text and who sent it | So the owner can see what was sent | The site owner | Up to the last 300 messages |
| Messages you send in our server | The bot checks new messages for spam, invite links and mass mentions (automod) and doesn't save them, except inside tickets and moderation cases | As usual in Discord | Not stored by us |
Discord's own Privacy Policy covers everything else that happens on Discord.
Cookies and browser storage
We use one cookie, stt_ref, and only if you open someone's invite link (itsbonkerslol.com/r/<name>). It remembers who invited you for 30 days so they get credit if you sign up. It isn't used for ads or tracking.
The site also saves a few things in your own browser's local storage: your sign-in token, your theme, your inventory as a backup, and which value update you last saw. These stay on your device.
The screenshot scanner reads item names from your screenshot inside your browser. The image never leaves your device; only the items you choose to add are saved to your inventory.
Who we share it with
- Railway hosts the site and the bot and stores their data in the United States. [REVIEW: confirm region]
- Roblox, only if you choose to link your Roblox account: you sign in on Roblox's own page and Roblox tells us your Roblox user ID, username and display name.
- Discord, if you link your Discord, use the bot or join our server: you approve the link on Discord's own page, and Discord sends the bot your user ID, username, roles and booster status so it can answer commands, give roles and run the server.
- Resend delivers our emails, if you add an email address. It receives your address and the email's content.
- Cloudflare Turnstile checks that people creating an account are human. When you sign up, your browser talks to Cloudflare for this check.
- Item values come from a public Google Sheet, and item pictures come from the SCP: Roleplay wiki on Fandom. Our server fetches these itself, so your browser never contacts Google or Fandom when you use the site. The screenshot scanner's files are also served from our own server.
- Anything you put on your public profile, and public item pages, can be seen by anyone and may show up in search engines.
- We may share information if the law requires it.
We do not sell or share your personal information for advertising, as "sell" and "share" are defined in the California Consumer Privacy Act. Because of that, there is nothing to opt out of.
Your rights
Wherever you live, you can ask us to:
- Show you the personal information we hold about you (access)
- Fix anything that's wrong (correction)
- Delete your account and data (deletion)
- Give you a copy of your data in a usable format (portability)
California residents (CCPA/CPRA): you have the rights above, the right to know what we collect and why, and the right not to be treated differently for using them. We don't sell or share personal information and don't use sensitive personal information.
EU and UK residents (GDPR / UK GDPR): we rely on performing our agreement with you to run your account and the features you turn on (like linking Discord), and on legitimate interests for security, moderation, preventing invite abuse and counting visits. You can also object to processing, ask us to restrict it, and complain to your local data protection authority. [REVIEW: name a contact or EU/UK representative if required]
To make a request, use the contact page. We'll reply within 30 days (45 days for California requests). We may ask you to confirm you own the account, for example by sending the request while signed in. Deleting your account also removes your Discord link, booster perks, followers and invite records; moderation records may be kept where we need them to keep the site safe.
Children
SCP: Roleplay is played by people of all ages. We don't collect real names or locations. The only age question is when adding an email: that's optional and only allowed if you confirm you're 13 or older. Accounts work fully without an email. Discord itself requires users to be at least 13 (or older where local law says so). Please don't put personal details like your real name, school or address in your profile. If you're a parent and want your child's account or information removed, contact us and we'll delete it. [REVIEW: COPPA — see note to the owner]
Security
Passwords are protected with scrypt, a slow, memory-hard hash, and are never stored as plain text. Sign-in tokens are only stored in hashed form too. Connections to the site use HTTPS. Staff have daily limits on bans and inventory wipes, and the owner is alerted to each one. No system is perfectly secure, so please use a password you don't use anywhere else.
Changes to this policy
If we change this policy, we'll update the date at the top. Big changes will also be announced in the site banner.
Contact
Use the contact page for any privacy question or request.