Privacy policy
Last updated October 15, 2026
This policy explains what personal data Decor (run by Decor) collects, why, and the choices you have. We keep as little as we can.
What we collect
Orders: the email you give at checkout, the items, prices and payment status, and the gift links we deliver (stored encrypted).
Accounts: your email and a securely hashed password, plus your saved looks, favorites, cart and the images you upload in the Studio.
Security: the sessions you're signed in on (with a browser description), and network addresses stored only as a keyed hash, to prevent abuse.
We don't sell your data, show ads, or use tracking or advertising cookies.
Why we use it
To take payment for and deliver your orders, to email you about them, to run your account, to keep the store secure and prevent fraud, and to meet our legal and bookkeeping obligations.
Cookies and local storage
We use one essential cookie to keep you signed in. Your cart, Studio looks and a few preferences are kept in your browser's storage so they survive a reload. None of these are used for tracking.
Who else processes data
Your payment provider (to take your crypto payment), Discord (when you preview someone's profile by their Discord user ID), our captcha provider (to stop bots on sign-in), our email provider (to send order and account emails), and our hosting provider. Each only gets what it needs for that job.
How long we keep it
Orders are kept for bookkeeping. Account data is kept until you delete your account; deleting it removes your profile, sessions, saved looks, favorites, cart and uploads, and detaches and anonymises your orders. Sign-in sessions expire after 30 days of inactivity.
Your rights
You can download your data and delete your account from your account page at any time. For anything else (correcting data, questions about your order data) email us at support@decor.gg. Depending on where you live, you may also have the right to complain to a data protection authority.
Security
Passwords are hashed with argon2id, gift links and order links are encrypted at rest, staff accounts can use two-step verification, and the site is served over HTTPS. No system is perfectly secure, but we work to protect your data.
Changes
If we change this policy, we'll update the date below; significant changes will be highlighted on the site.