Privacy Policy

Summary

You can read every page of itemshop.gg without an account and without giving us anything. The only data we hold is what you choose to hand over by signing in with Discord, turning on shop alerts, commenting or sending a suggestion, plus the aggregate analytics most websites collect. We do not sell personal information.

Stored in your browser

We set no cookies of our own unless you sign in or vote on a shop (see Accounts and Shop votes below). A few preferences live in your browser's local storage and, unless you are signed in, never leave it:

• Your real-money price display choice (in-game prices, or one of the currencies on offer).
• Which games you have hidden from the header.
• Whether you have dismissed the “add to home screen” prompt.
• A cached copy of recently viewed pages, so the installed app opens offline.

Clearing site data in your browser removes all of it.

Accounts

Signing in is optional and uses Discord. We ask Discord only for the basic profile it calls “identify”: your Discord user ID, username, display name and avatar. We never see your email address, your servers or your messages, and we do not keep the Discord access token after reading your profile. We store that profile with the settings you sync (shop alert games, games hidden from the header, price currency), the items you save to your wishlist (which item, its name and picture as the shop showed it, and when you saved it) and the time you last signed in.

Signed in, opening the site each day builds a daily streak: we keep its length, your longest, the last day you visited and which streak role our Discord bot gave you, if any. If your streak has reached a role, your comments show it beside your name. We also keep a log of what accounts do on the site, so we can see how it is used: signing up and in, streak check-ins, saving and removing wishlist items, shop votes and comments, each with the time. Only we see it; entries are deleted after 90 days.

While you are signed in, your browser holds one cookie, isg_session, which is sent only to our own API and lasts up to 60 days; a second short-lived cookie guards the sign-in round trip itself. Your avatar loads from Discord's image servers. Signing out ends the session; “Delete account” on your account page erases the account, its sessions, your wishlist, your shop votes, your comments, your streak, its activity log and the alerts on every device linked to it, at once.

Your account is private unless you turn on a public profile on your account page. Then a page at itemshop.gg/u/ and a name you choose shows anyone with the link your Discord display name and avatar, the month you joined, your Supporter badge if you have one, the games you pinned to the header and the items on your wishlist. It never shows your Discord username or ID, your alert settings or anything else here, and it asks search engines not to list it. Turning it off, or deleting your account, takes the page down straight away.

If you turn on “Also send them as a Discord message” for your wishlist alerts, Discord asks you for one more permission, “join servers for you”. We use it once, to add you to the itemshop.gg Discord server, because a Discord bot can only message people it shares a server with; the access token is discarded straight after, as at sign-in. We keep only the fact that you asked for the messages, and whether Discord last refused one. Turning the switch off, or pressing “Stop these messages” under any of them, stops them; you can leave the server whenever you like.

Saving an item with the bot's /wishlist add command in Discord does the same as saving it here, and in the itemshop.gg server, or another server that has chosen it, the bot's answer naming the item is posted in the channel for everyone there to see. If you have no account yet, that first save makes one, holding the same profile Discord sends with the command (your Discord user ID, username, display name and avatar) and the item. Sign in with that Discord account to see it, or to delete it. Unless you have chosen otherwise before, your first save from Discord also turns on the Discord messages described above, without the extra permission, since the bot already shares a server with you: it sends one message to say so, and “Stop these messages” under it turns them off.

The Discord bot in your server

If you add the itemshop.gg bot to a Discord server and choose a channel for a game's shop resets, we store the server's ID, that channel's ID and the role you asked it to ping, if any. Watching for an item with /watch add stores the same, with the item. The bot does not read messages or member lists. Removing the alert with /alerts remove or /watch remove, or removing the bot from the server, ends it; a channel it can no longer post in is deleted from our records after a few tries.

A server with Server Pro can set more with /pro, and we store what it sets: the name, colour and opening line its posts go out with, the avatar picture it uploads (which we serve so Discord can show it), how each channel's posts are shaped, and the channel, day and role of its weekly digest. To post under the server's name the bot makes a webhook in each channel it posts in, and we keep that webhook's ID and token. /pro branding reset deletes the look and its avatar, and /pro digest off the digest.

If you buy Supporter, Discord tells us your Discord account has it, and we ask Discord again from time to time while you use the site and the bot. We keep a list of the Discord accounts we gave the Supporter role in our server, so we can take it back if the purchase is refunded, and the time before a saved item leaves that you chose with /supporter leaving, kept with your account.

Shop alerts

If you turn on notifications for a game, your browser gives us a push subscription: an endpoint URL and the encryption keys needed to send to it. We store that together with the list of games you chose. If you are signed in it is linked to your account, so the same games reach each of your devices; otherwise it is not linked to a name, an email address or anything else about you. We use it only to send the alert when that shop rotates and, if you are signed in with wishlist alerts on, when an item you saved is back in the shop. Signed out, turning alerts off in the bell menu removes the subscription. Signed in, the device stays subscribed even with no games chosen, so wishlist alerts can reach it; signing out on that device or deleting your account removes it. Revoking notification permission in your browser stops everything, and endpoints that stop working are deleted automatically.

Shop votes

Anyone can give a shop a thumbs up or down. We store the vote against the game and the shop day. Signed in, it is kept with your account and deleted with it. Signed out, your first vote sets one cookie, isg_voter, a random number sent only to our own API that lasts up to a year, so the same browser counts once and can change its vote; we keep only a scrambled copy of it, linked to nothing else about you. Clearing the cookie cuts that link. Your IP address is used in memory to limit how fast one address can vote and is not written anywhere.

The itemshop.gg bot puts a thumbs up and a thumbs down under each shop post it makes in Discord, and the number of each is added to that shop's tally here. We read only the two counts: not who reacted. When saved items come back to a shop, the itemshop.gg Discord server is told which, and how many people had each on a wishlist: a number, never names.

Comments

Signed in, you can comment under a shop. We store what you write with your account, the game, the shop day and when you posted it. Anyone reading that shop sees the comment with your Discord display name and avatar, and a link to your public profile if you have turned one on; never your Discord username or ID. Each new comment is also posted to a private channel where the site's maintainers watch for abuse. Deleting a comment erases it for good; if it has replies, an empty line saying it was deleted stays above them, with no name or words. Deleting your account erases all your comments, the replies under them, and your votes.

When you vote a comment up or down, we store your vote with your account so it counts once and you can change it. Others see only the total, never who voted.

If you report someone's comment, we store that you reported it so it counts once; the author is not told who. A comment we hide for breaking the rules is kept, out of sight, so the decision can be undone. Your IP address is used in memory to limit how fast one address can comment and is not written anywhere.

Suggest an edit

The “Suggest an edit” button sends your message, the page you were on and its title, any text you had highlighted, and your browser's user-agent string. That is stored so we can act on it and is posted to a private channel where the site's maintainers triage corrections. There is no name or email field, so please don't put personal details in the message. Your IP address is used in memory to limit how many suggestions one address can send per hour and is not written anywhere.

Analytics

We use Google Analytics to understand which pages are read and roughly where visitors come from. It sets its own cookies and processes data under Google's privacy policy. We look at it in aggregate only. Browser settings that block third-party scripts stop it entirely, and the site works the same without it.

The API

When you make an API key we keep, with your account, the project name, link and description you give, a fingerprint (hash) of the key (never the key itself), and when it was made, last used and revoked. The admin of this site can see these with your Discord handle, to know who uses the API for what. Deleting your account deletes your keys.

For requests to the API we count, per day, which endpoint and game was asked for and which key asked; for a request without a working key, the website it came from (its Origin or Referer header) or, failing that, the User-Agent the app sent. To count how many different callers there are, we keep a one-way hash of each caller's IP address, made with a random key that is replaced and thrown away every day, so an address can't be recovered from it or linked from one day to the next. We delete those hashes after 30 days. The IP address itself is never stored.

Hosting and logs

The site runs on Railway. Like any web server it keeps short-lived request logs, which include IP addresses, for operating and securing the service. They are not used to identify individual readers.

Third-party content

Item art and shop data come from the games' own services, from data feeds we run ourselves and from feeds such as locker.gg, the Steam item store, Battle.net and Bungie.net; Fortnite pages from before October 29, 2026 show art from fortnite-api.com. Images are loaded directly from those servers, and opening a Rocket League item fetches its shop history from our Rocket League feed, so those servers see your IP address and browser details, as they would for any image on the web. Nothing about you or your account is sent with those requests.

Advertising and affiliate links

The site shows ads served by Google AdSense. Google and its partners use cookies and similar technologies to serve and measure those ads, which can include ads based on your visits to this and other sites. You can opt out of personalised advertising at adssettings.google.com, and read how Google uses this data at policies.google.com/technologies/partner-sites. Some links may carry an affiliate code: if you click through and buy something, we may earn a commission at no cost to you.

Children

The site is not directed at children under 13, and we do not knowingly collect information from them.

Your choices and rights

You can remove everything we hold about you yourself: delete your account from the account menu, turn off alerts to delete your push subscription, and clear site data to remove local preferences. If you want a suggestion you sent deleted, or have any question about this policy, email [email protected] and we will sort it out. Depending on where you live you may have legal rights to access, correct or erase personal data; the same address handles those requests.

Changes

If this policy changes, the date at the top moves and the new text applies from then on. See also our terms of use.