Synodic Store privacy policy

Synodic Studio ("Synodic", "we", "us") runs the Synodic Store at store.synodicstudio.com (the "Store") and is the data controller for the personal data described in this policy. That means we decide why and how your data is processed and we are responsible for it.

Synodic Studio is a trade name, not yet a registered company, so there is no CVR number to give. Until there is one, the controllers are the studio's two founders, Nicklaz Lentz and Kian Nikolaj, acting jointly. As joint controllers we have agreed in writing how we share responsibility under Article 26 GDPR. Nicklaz Lentz is the point of contact for questions and requests about personal data, but you may exercise your rights against either of us.

The studio is based in Aarhus, Denmark and can be reached at contact@synodicstudio.com. We have not appointed a data protection officer, because the scale and nature of our processing does not require one under Article 37 GDPR.

This policy covers the Store website. It does not cover what happens on Roblox, including the purchase itself, which is governed by Roblox's own privacy policy. Our support portal at support.synodicstudio.com and our anticheat, SynodicAC, have their own privacy policies, which you will find alongside this one on www.synodicstudio.com/privacy.

Like every website, the server that delivers the Store sees technical data with each request: your IP address, the time, the address you requested and your browser's user agent (which describes the browser and device type). This is standard server log data. We use it to keep the Store secure and running, and we do not use it to identify or profile you.

Logging in is optional. You can browse the Store and open any item on Roblox without it. If you choose "Log in with Roblox", Roblox asks you to approve access and then sends us the following, using the standard OAuth scopes "openid" and "profile":

• your Roblox user ID;
• your Roblox username;
• your Roblox display name.

We use this for two things: to show your avatar in the Store, and to show which of our items you already own. To do the second, we check your Roblox user ID live against Roblox's public inventory API when you view the Store. The result is shown to you and not saved.

The Store has no database. Your login details are not stored on our server. They are kept only in a signed session cookie in your browser (see below), and they are gone when you log out or the cookie expires.

The Store sets two cookies, both only when you log in with Roblox:

synodic_store_session

Keeps you logged in. Contains your Roblox user ID, username and display name, signed so that it cannot be altered. Lasts 30 days or until you log out. Strictly necessary for the login you asked for.

synodic_store_oauth

Protects the login process against forged requests while you approve access on Roblox. Lasts 10 minutes and is deleted once you are logged in. Strictly necessary for a secure login.

Under the Danish cookie rules, which implement Article 5(3) of the EU ePrivacy Directive, storing information in your browser normally requires your consent, but not when it is strictly necessary to provide a service you have explicitly asked for. Both cookies fall within that exemption, which is why the Store shows no cookie banner: there is nothing to consent to.

The Store uses no analytics, no tracking, no advertising and no third-party fonts. If we ever add something that requires consent, we will update this policy first and ask for your consent before it runs.

The cart is kept in your browser's local storage under the name "synodic-cart". It holds only a list of the items you have added, identified by their short names in the Store. It stays in your browser until you remove the items or clear your browser data. Like the cookies above, it is strictly necessary for a feature you use, so it needs no consent.

Because the Store has no checkout and every purchase happens on Roblox, we never receive:

• payment data of any kind, such as card or bank details;
• your Roblox password;
• your email address.

Every buy button in the Store opens the item on roblox.com. The purchase is made there, with Robux, and Roblox processes the data involved as an independent controller under its own privacy policy. We have no control over that processing.

On our side, we see only that the Synodic Studio group on Roblox received the sale, as Roblox reports it to us. The Store itself does not record your purchases.

Avatar images in the Store are loaded from Roblox's image servers. When your browser fetches them, Roblox can see your IP address, as with any website your browser contacts. Item prices are fetched from Roblox by our own server, not by your browser, so that the Store shows Roblox's current prices. Product images are served from our own server.

The live service status shown in the Store is fetched by our server from ac.synodicstudio.com, the status page of SynodicAC. Your browser does not contact that service, and no data about you is sent to it.

Logging you in and showing your avatar and owned items

Done because you asked for it by logging in. Legal basis: performance of a contract, or steps taken at your request (Article 6(1)(b) GDPR). The two login cookies are part of this.

Server logs and security

Used to detect abuse, diagnose faults and defend against attacks. Legal basis: our legitimate interest in running a secure, reliable store (Article 6(1)(f)). We have weighed this against your interests and consider the impact minimal, given how little is kept and for how short a time.

We do not use your data for marketing, we do not build profiles, and we do not make decisions about you by automated means.

• Hetzner Online GmbH, Germany, which rents us the server in the EU that runs the Store. Hetzner acts as a processor on our behalf, and the server logs are stored there.
• Roblox Corporation, USA, when you log in with Roblox, when we check which items you own, when your browser loads avatar images, and when you buy an item on roblox.com. Roblox is an independent controller for data on its platform, and its own privacy policy applies.

We do not sell personal data and we do not share it with advertisers or data brokers. We may disclose data where the law requires it, for example in response to a valid request from a public authority.

The Store runs on a server in the EU. Roblox Corporation is based in the USA, so data that goes to or comes from Roblox, as described above, is transferred to the USA. Those transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the safeguards the provider offers, such as the European Commission's standard contractual clauses.

Server logs

Kept for at most 30 days, then deleted.

Session cookie

Stays in your browser for 30 days or until you log out, whichever comes first. We keep no copy on our server.

Login security cookie

Lasts 10 minutes and is deleted as soon as you are logged in.

Cart

Stays in your browser until you remove the items or clear your browser data. We never receive it.

Because the Store has no database, we hold nothing else about you.

Under GDPR you have these rights over your personal data. You can exercise any of them by writing to contact@synodicstudio.com.

Access

Ask whether we hold data about you and receive a copy of it, along with the information in this policy.

Rectification

Have inaccurate data corrected and incomplete data completed.

Erasure

Have your data deleted where there is no longer a good reason for us to keep it.

Restriction

Ask us to stop using your data, while keeping it, in certain situations.

Portability

Receive the data you gave us in a structured, commonly used, machine-readable format, where we process it by automated means on the basis of contract or consent.

Objection

Object to processing based on legitimate interest. We will stop unless we can show compelling grounds that override your interests.

You can also end the processing of your login data yourself at any time by logging out, which deletes the session cookie, and empty your cart by removing its items or clearing your browser data.

We answer requests within one month. For complex or numerous requests we can extend this by up to two further months, and we will tell you if we do. We may need to confirm your identity before acting on a request. Requests are free unless they are clearly unfounded or excessive.

Many Roblox players are young, so we have tried to write this policy plainly. To log in you must meet Roblox's own age requirements. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child's data has reached us, write to contact@synodicstudio.com and we will delete it.

The Store is served over HTTPS only. The session cookie is signed, so its contents cannot be changed without us noticing. The server is in the EU, access to it and to our secrets is limited to the people who need it, and the Store keeps no database of users.

If a breach were to affect personal data, we would notify Datatilsynet within 72 hours where the law requires it, and tell the people affected where the breach is likely to put them at high risk.

If you believe we have handled your data unlawfully, you have the right to complain to a supervisory authority. Ours is Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk. You may also complain to the authority in the EU country where you live or work. We would appreciate the chance to resolve the matter directly first, but you are not obliged to contact us before going to an authority.

We will change this policy when the Store or the law changes. The date at the top tells you when it was last revised. Material changes will also be announced on the site and on our Discord.

Questions, requests and complaints about personal data: contact@synodicstudio.com. Please put "Privacy" in the subject line so it reaches the right person quickly.