Last updated: 19 October 2026

This policy explains what personal data DonutHeist (donutheist.com) collects, why, and what you can do about it. Questions or requests: donutheistsupport@gmail.com.

What we collect

• Order details: your email address, the Minecraft username and edition you enter, what you bought, the price and when you ordered.
• Payment details: your payment is handled by the provider you choose, for example Whop for cards, Apple Pay and Google Pay, or a cryptocurrency processor. We get the payment status and basic details such as your country, but never your full card number.
• Technical details: your IP address, approximate country, network and browser. They're sent with your order to help prevent fraud, and our hosting provider processes them when you visit the site.
• Reviews, only if you leave one: your rating, what you write and what you bought. Reviews are public: they can be shown on our shop with your name on SellAuth, or as Anonymous if you choose to stay anonymous.
• Support messages: what you write in tickets on our site or in emails.
• Free 5M, only if you claim it: your email address, the Minecraft username and edition you enter, your language, when you agreed to receive our deals and news by email (and when you unsubscribed, if you did), your approximate country, a code made from your IP address with a secret key (we don't store the IP address itself), and when you asked for your code, confirmed it and got the 5M.
• Past claims on our former Discord server: if you claimed the free 5M or won a giveaway there, we keep your Discord account, the Minecraft username you gave us, what we sent you and when, so each person gets the free 5M only once.
• Visit statistics, only if you allow "Analytics" in our cookie banner: which pages you open and how far you scroll, which pack or amount you pick, the edition you choose, whether the username check passed and, if not, what kind of mistake it was (for example a space or an @), never the name itself, how long the buy window was open and how long the name check and checkout took, whether checkout opened and any checkout error message, FAQ questions and buttons you click, currency changes, error messages from the page, the website or link that brought you (for example a utm_source tag), your device type, language and approximate country. We use no cookies for this. A visit is recognised by a code made from your IP address and browser with a random key that changes every day, so your IP address is not stored and visits on different days can't be connected. These statistics are never linked to your orders or your username, and visits that reach checkout are only counted in totals. If your browser sends a "Global Privacy Control" signal, nothing is recorded.
• On your device: the site remembers the edition and username you last entered, so you don't have to type them again, whether you already claimed the free 5M or closed its window (so it doesn't keep popping up), and an affiliate code if you came through an affiliate link. This stays in your browser and you can clear it at any time. Our shop platform also uses the cookies it needs for the cart, checkout, login and security.

What we use it for

• To deliver your order and send your receipt and order updates.
• To help you when you contact us.
• To show buyer reviews on our shop, and to give you the review coupon.
• To prevent fraud, chargebacks and abuse.
• To run the free 5M: check your email address with a code, stop abuse (bots, repeat claims, several accounts, disposable email addresses), make sure each person claims it only once, and send you the 5M.
• To send you the deals and news emails you agreed to receive when you claimed the free 5M, until you unsubscribe.
• To keep the records the law requires, for example for accounting and tax.
• With your permission (the "Analytics" choice in our cookie banner): to see where visitors get stuck, find things that are broken, and improve the site.

We don't sell your data, and we don't use advertising trackers.

Deals and news emails

To get the free 5M, you need to agree to receive our deals and news by email: you tick the box for it when you claim the free 5M. The box is never ticked for you. The first one tells you when your free 5M is paid. You can unsubscribe anytime with the link in each of these emails: open it, press Unsubscribe, and we stop. You keep your 5M. The email with your code isn't marketing: we only send it because you asked for it.

Who we share it with

Only with services that help us run the shop:

• SellAuth, which runs our shop, checkout, emails and support tickets;
• payment providers, such as Whop and cryptocurrency processors;
• Cloudflare, which hosts and protects the site, runs our automatic delivery and the free 5M (it keeps a record of each delivery: order number, Minecraft username, amount and price, plus the free 5M claims) and stores the visit statistics;
• Cloudflare Turnstile, which checks that a free 5M request comes from a person, not a bot, and sees your IP address and some details about your browser;
• Brevo, which sends the email with your free 5M code and the deals and news emails you agreed to receive, and can record whether they are delivered and opened and which links in them are clicked;
• Discord, where our team gets an alert for each new order and each free 5M we send (with the Minecraft username, never the email address), so we can check deliveries and step in if one fails;
• Google, which provides our support email and the site's fonts.

When you type your username before checkout or in the free 5M window, your browser checks it with public Minecraft lookup services: PlayerDB and minetools.eu for Java names, GeyserMC for Bedrock names, and Crafthead for the skin picture. These services see the name you typed and your IP address. When you claim the free 5M, our server checks Java names again with Mojang (or PlayerDB if Mojang doesn't answer), which only see the name.

Some of these providers process data outside your country, including in the United States.

How long we keep it

We keep order records for as long as the law requires for accounting and tax, and other data only as long as we need it for the reasons above. Visit statistics are deleted automatically after 35 days; Cloudflare's backups can keep deleted data for about 7 more days.

• A free 5M request whose code was never confirmed is deleted after 2 days.
• A confirmed free 5M claim is kept, so the same person, email address or Minecraft account can't claim twice. Past claims and giveaway records from our former Discord server are kept for the same reason.
• Your agreement to receive deals and news lasts until you unsubscribe.

Your rights

You can change your cookie choice at any time with "Cookie settings" at the bottom of the site; turning "Analytics" off stops the visit statistics. You can stop deals and news emails at any time with the unsubscribe link in each one. You can ask for a copy of your data, ask us to correct it, or ask us to delete it where the law allows. We have to keep some order records. Email donutheistsupport@gmail.com. If you're unhappy with how we handle your data, you can also complain to your local data protection authority.

Children

Buyers under 18 need permission from a parent or guardian. For orders we only collect what we need to process them. Visit statistics are only recorded if "Analytics" is allowed in the cookie banner, and they never include names, email addresses or order numbers. The free 5M is only for players 13 or older. If a child under 13 gave us their email address, contact us and we'll delete it.

Changes

We may update this policy. The latest version is always on this page.