1. Who We Are

Steal An Egg Companion (“we”, “us”, “our”) is the data controller for the personal information described in this Policy. Our service-email contact is support@stealaneggcompanion.com. You can also reach us through our contact page. Steal An Egg Companion is an unofficial fan project and is not affiliated with Roblox Corporation or the developers of the Steal An Egg game — see our Disclaimer.

2. Information We Collect

We collect the minimum information needed to operate the Service:

• Account information. Email address, display name, and (for password sign-up) a salted, adaptive hash of your password. If you sign in with Google or GitHub we receive your email and a provider account identifier from the identity provider; we never see your password or your OAuth password.
• Session data. Signed session cookies (HttpOnly, Secure, SameSite=Lax) used to keep you signed in, plus the IP address and user-agent captured by our authentication library for security and abuse prevention.
• In-product content. The data you generate while using the Service: bookmarks, watchlist entries and their per-row notification toggle, saved builds, saved comparisons, calculation history, alert channel subscriptions, in-app notifications, shared-link metadata, and any free-text messages you send via the contact form.
• Billing data. Premium plan, billing period, renewal date, and external subscription ID. Payment-card numbers and CVVs are handled entirely by our payment processor (Waffo); we never receive or store full card details on our servers.
• Usage data. Pages visited, tools used, and aggregate interactions. For signed-in users this is tied to your account; for anonymous visitors it is collected via cookies and aggregated.
• Cookies. Essential cookies for sign-in, security, and your cookie-consent choice; optional analytics and advertising cookies after consent. See our Cookie Policy.

3. How We Use Information

• To provide, maintain, secure, and improve the Service.
• To authenticate you and protect your account from unauthorized access.
• To send the notifications you opt into (game updates, game events, and per-watchlist-row pings).
• To process Premium subscriptions and prevent payment fraud.
• To respond to your messages on the contact page and support emails.
• To display advertisements (Google AdSense) on free accounts; Premium accounts see no ads.
• To understand aggregate usage and improve the Service (Google Analytics, only after consent).

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

4. Cookies and Consent

We use essential cookies for site functionality (sign-in, security, and remembering your cookie-consent choice). On your first visit we show a consent banner that lets you accept or decline analytics and advertising cookies. You can change your choice at any time by clearing the saec-cookie-consent value in your browser’s storage. See our Cookie Policy for details on the cookies set.

5. Third-Party Services

We share data with a small set of vetted processors, each receiving only what they need to do their job:

• Resend — transactional email delivery (sign-in magic links, account notices, opt-in notifications).
• Google Analytics — aggregate usage analytics; loaded only after consent.
• Google AdSense — advertising on free accounts; loaded only after consent.
• Waffo — payment processor for Premium subscriptions; receives billing data directly from your browser.
• Vercel / Neon — hosting and managed PostgreSQL database, used to run the Service and store account data.

6. Children’s Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact support@stealaneggcompanion.com and we will delete it.

7. Data Security

We protect your information using industry-standard safeguards appropriate to the sensitivity of the data:

• Encryption in transit. All traffic between your browser and the Service is served over HTTPS / TLS. We do not serve unencrypted HTTP for any authenticated route.
• Authentication and password storage. Sign-in is handled by the Better Auth library, which stores passwords using a salted, adaptive hash (scrypt by default). We never store your password in plaintext and never have access to your OAuth (Google / GitHub) credentials — those are exchanged directly with the identity provider.
• Session cookies. Session cookies are issued with the HttpOnly, Secure, and SameSite=Lax flags so they cannot be read by client-side JavaScript and are only sent over HTTPS.
• Data storage location. Account and in-product data (email, hashed password, OAuth identifiers, bookmarks, saved builds, saved comparisons, watchlist, calculation history, alerts, notifications, subscription metadata) is stored in a managed PostgreSQL database hosted alongside the Service on Vercel. Application secrets (the Better Auth signing key, the Resend API key, OAuth client secrets, payment-provider keys) are stored as encrypted environment variables and are never exposed in client-side code.
• Access control. Production database access is restricted to the Service’s deployment environment via short-lived, environment-scoped credentials. We do not share database credentials with end users.
• Third-party processors. Email delivery is handled by Resend, analytics and advertising by Google (Analytics, AdSense), and payments by Waffo. Each processor receives only the data needed to perform its function and is bound by its own security and privacy commitments.
• Data retention. We keep your account data for as long as your account is active. If you delete your account, we remove your personal data from our primary systems within 30 days. Aggregated, de-identified analytics data may be retained longer because it can no longer be tied back to you.
• Vulnerability reporting. If you believe you have found a security issue, please email support@stealaneggcompanion.com. Our security contact and disclosure policy are published at /.well-known/security.txt (RFC 9116).

No method of transmission or storage is 100% secure. If we become aware of a breach that materially affects your personal information, we will notify affected users and the relevant authorities within 72 hours of discovery, in accordance with applicable law.

8. Your Data Rights

You have the following rights over the personal data we hold about you. To exercise any of them, contact support@stealaneggcompanion.com from the email address registered to your account so we can verify the request. We respond to verified requests within 30 days.

• Access. Review your account information and in-product data from your account dashboard and the per-feature pages it links to ( /account/bookmarks, /account/saved-builds, /account/saved-comparisons, /account/watchlist, /account/history, /account/alerts, /account/notifications).
• Export. Premium subscribers can export their bookmarks, watchlist, saved builds, saved comparisons and calculation history as CSV (or JSON) from your account dashboard; each export is recorded in an audit log. You can also request a full export of your personal data by emailing us — we will provide it within 30 days.
• Correction. Update your display name and most preferences from account settings. Email changes are not currently editable from the settings page; contact support and we will verify and process the change.
• Deletion of specific data. Delete individual items (a bookmark, a saved build, a watchlist entry, a saved comparison, a single history row, an alert, or a notification) directly from the matching account page. Deletions are immediate and irreversible.
• Notification and analytics preferences. Enable or disable in-app and email notifications for game-update and game-event channels from Account → Alerts. Toggle per-watchlist-row notifications from Account → Watchlist. You can also opt out of personalized advertising at Google Ad Settings, and disable analytics / advertising cookies via the consent banner.
• Account deletion. To delete your account entirely, email support@stealaneggcompanion.com from the address on file. We will verify the request and permanently remove your account and associated personal data from our primary systems within 30 days. Self-service account deletion is on our roadmap; until then this manual channel is the supported path.
• Complaints. If you believe we have handled your data incorrectly, contact us first at support@stealaneggcompanion.com so we can investigate. You may also have the right to lodge a complaint with your local data-protection authority.

9. International Transfers

Our processors may store or process your data in regions other than your own. Where data leaves the EEA / UK, we rely on the processor’s published safeguards (Standard Contractual Clauses, equivalent framework, or vendor’s published security and privacy commitments).

10. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the current version.

For material changes (for example, a new data category, a new processor, or a new purpose) we will provide at least 14 days’ advance notice by posting a banner inside the Service and, for signed-in users, by email to the address on file. Continued use after the effective date constitutes acceptance of the revised Policy. If you do not agree, you may stop using the Service and request account deletion under Section 8.

11. Contact Us

If you have questions about this Privacy Policy, want to exercise any of the rights above, or need to report a privacy concern, email support@stealaneggcompanion.com, or reach out through our contact page.