Privacy policy
Last updated · 2026-04-28Who we are
L2 Market is an independent listings board for Lineage 2 players. The publisher of L2 Market is the data controller for the personal data described below. We are not affiliated with NCSOFT®.
What we collect from Discord
When you sign in we receive the following from Discord's OAuth flow: your Discord user ID (a numeric snowflake), your Discord username and global display name, your avatar URL, and your email address (used only to validate the account, never shown publicly). We never receive your Discord password. You can review and revoke L2 Market's Discord access at any time from your Discord account settings.
What we collect as you use the service
We store the listings you post, the trades you confirm, the messages you exchange on-platform, and the reputation events derived from those trades. We log request metadata (timestamp, request id, route, status code, IP address) for security, abuse prevention, and operational debugging.
What we store on your device
L2 Market uses your browser's localStorage for two non-sensitive preferences: your active server (so you don't pick it on every visit) and your dismissed-banner state. These values stay on your device and are never transmitted unless you make a request that needs them.
Cookies
We use first-party cookies that are strictly necessary to operate the service: a session cookie that keeps you signed in, and an anti-forgery token that protects form submissions against cross-site request forgery. These are managed by our authentication framework, are scoped to the L2 Market domain, and do not require consent under EU/UK rules.
Analytics
We use Google Analytics to measure aggregated traffic so we can prioritise improvements. Google Analytics sets first-party cookies on the L2 Market domain. We do not enable Google's advertising features or cross-property identity, and we do not pass personal data into events. To opt out, install Google's official browser opt-out add-on (https://tools.google.com/dlpage/gaoptout) or block analytics cookies in your browser. A one-click cookie consent banner is on the post-launch roadmap; until it ships, please use the browser-level controls above to decline analytics.
How we use your data
We use your data to operate the service: render your seller profile, route messages between buyers and sellers, build reputation, prevent abuse, and respond to support enquiries. We do not sell your data. We do not use it to train machine-learning models. We do not run third-party advertising on the site.
Who we share data with
We share data with infrastructure providers we contract with to operate the service (hosting, database, error monitoring), with Discord (the OAuth identity provider you sign in through), and with our analytics provider (Google Analytics). We do not sell your data. We disclose data when required by law, court order, or to protect the safety of users or the integrity of the service.
Your rights
You can export the data we hold about you (listings, trades, messages, profile) and you can delete your account at any time from your dashboard. Deleting your account anonymises your completed trades — the counterparty keeps the trade record so their reputation history stays intact, with your handle replaced by a placeholder. Subject to applicable law, you also have the right to access, correct, restrict, or object to processing of your personal data, and the right to lodge a complaint with your local data protection authority.
Children
L2 Market is not directed at children under 13. We require Discord sign-in and Discord itself enforces a minimum age of 13. If we become aware we have collected personal data from a child under that age, we will delete it.
Data retention
Account and listing data is kept while your account is active. Server logs are kept for a limited operational period necessary for security and debugging, then deleted. After account deletion, anonymised trade records remain so the counterparty's reputation stays intact. Backup snapshots may persist for a limited rotation period before being overwritten.
International transfers
Our infrastructure may be located in different jurisdictions. Where personal data is transferred outside your region, we rely on the subprocessors' standard contractual clauses and equivalent safeguards. The current hosting region is documented in the operator's deployment record and available on request.
Changes
We may update this policy as the product, our subprocessors, or applicable law change. We will update the "Last updated" date above and, for material changes, surface a banner on the site. Material changes affecting how analytics works will trigger a fresh consent prompt.
Contact
Privacy questions, data export, or deletion requests — use the contact channel published in the footer.