Privacy Policy

02What we collect

Depending on how you use mm2.money, we collect:

Account details

Your username, email address and, if you sign up with email, a password hash. We never store passwords in plain text.

Sign-in with Google or Discord

If you choose Google or Discord, we receive your account ID, email address, display name and profile picture from that provider. We don't get your Google or Discord password and we don't get access to your contacts, files, messages or servers.

Roblox details

The Roblox usernames you link, their public user IDs and avatars, and the public inventory information needed to show what you can sell.

Trades and payouts

The items in each trade, the price you agreed to, trade codes, timestamps and status. For withdrawals, the payout details you enter: a wallet address and network, a PayPal or Cash App handle, a GCash number, or a Roblox Game Pass. We never ask for seed phrases, private keys or card numbers.

Support messages

What you write in support tickets and any screenshots you attach.

Technical data

IP address, browser and device type, language and approximate country, collected by our servers and our network provider for security and fraud prevention.

03How we use Google user data

When you sign in with Google we request only the basic openid, email and profile scopes. We use this information only to create your mm2.money account, sign you in, show your name and picture in your account, and contact you about your account (for example password resets or security notices).

We do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties except as needed to run the service or required by law, and we do not use it to train AI models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect mm2.money at any time from your Google account settings.

04How we use your data

• Running trades: matching your Roblox account to your mm2.money account and to our trading bots.
• Paying you: sending your money to the payout details you gave us.
• Your account: letting you sign in and see your balance, trades and withdrawals.
• Support: answering your tickets and fixing problems.
• Safety: preventing fraud, stolen or duplicated items, multi-account abuse and attacks on the site.
• Improving the service: aggregated, non-identifying statistics about which features are used.

We don’t use your data for behavioural advertising or profiling, and we don’t sell it.

05Who we share it with

Only the providers we need to operate mm2.money, each limited to what it needs:

• Hosting: our server provider, where the site and its database run.
• Cloudflare: delivers the site securely and protects it from attacks and bots.
• Google and Discord: only if you choose to sign in with them.
• Roblox: we read public profile and inventory information from Roblox.
• Email delivery: to send account and security emails.
• Payout networks: crypto withdrawals are recorded on a public blockchain; PayPal, Cash App and GCash payouts are processed by those companies.
• Authorities: when the law requires it, for example a valid court order.

06Cookies and local storage

We don’t use advertising or cross-site tracking cookies. Clearing your cookies signs you out and resets your preferences.

07How long we keep it

• Account data: while your account is open.
• Trade and payout records: up to 24 months after the trade, for disputes and fraud prevention.
• Closed accounts: deleted within 90 days, except records the law requires us to keep.
• Server logs: deleted within 30 days unless needed for a security investigation.

08Your rights

Depending on where you live (for example under the GDPR or the UK GDPR), you can ask us to:

You can also complain to your local data protection authority. Send requests through a support ticket; we answer within 30 days.

09Security

All traffic is encrypted with HTTPS. Passwords are stored only as bcrypt hashes. Forms are protected against cross-site request forgery, and access to user data is limited to the people who need it to run the service. No system is perfect; if a breach ever affects your data we will tell you and the relevant authorities as the law requires.

10Children

mm2.money is not meant for children under 13 and we don’t knowingly collect their data. If you are under 18, use mm2.money only with a parent’s or guardian’s permission. If you think a child under 13 has given us data, contact us and we will delete it.

11Changes to this policy

When we change this policy we update the date at the top. If a change is significant we’ll let you know on the site or by email.