The short version
We built LootKeep so you don't have to think about privacy law and your fans don't have to trust a stranger with their data. Here's everything, in plain language:
- Your files are hosted in the EU and never leave it.
- We keep an ID and a name for each fan. No passwords, no email harvesting.
- Strictly-necessary cookies only. No trackers, no analytics following anyone around.
- EU VAT is handled correctly on every invoice.
Where your files live
Every file you upload is stored on servers physically located in Amsterdam, the Netherlands, with storage providers under EU jurisdiction. This isn't "the EU region of a US cloud". It's actually here, governed by EU law. Your files never leave the EU.
We encrypt files in transit, and your Patreon connection tokens are encrypted at rest. Only people whose Patreon tier (or a manual grant from you) unlocks a file can download it.
Your fans' data
When a fan opens your pack link and taps Continue with Patreon, Patreon tells us who they are and which of your tiers they belong to. We keep two things: a stable identifier and a display name, so we can show them the right files next time.
We never see or store their password. The access token Patreon hands us is used once to confirm their identity, then discarded the moment we've said hello. We don't build profiles, we don't sell anything, and we don't email your fans.
Cookies & tracking
LootKeep sets only strictly-necessary cookies: the one that keeps a fan signed in for their session, and the one that keeps your dashboard secure. That's it.
No advertising cookies. No third-party analytics scripts. No pixels, no fingerprinting, no consent-banner circus, because there's nothing to consent to. The page just works.
The roadmap voting button remembers your vote using your browser's local storage, not a cookie. It stays on your device, is never shared across sites, and sets nothing that follows you anywhere.
Roadmap & updates
Our public roadmap lets you vote on what we build next, send a feature request, and ask to be emailed when something ships. It keeps the same promise as the rest of LootKeep:
- Voting needs no cookie and no account. Your browser remembers what you voted for; on our side we only store a scrambled (hashed) version that can't be traced back to you.
- We store little, and only for good reason. A feature request keeps the text you wrote, plus your email only if you choose to add one. A notify sign-up keeps your email and whether you're still subscribed, with no open- or click-tracking. To curb spam we also keep a scrambled (hashed) form of your network address, never the address itself.
- One-click unsubscribe, always. Every update email has a link that stops them for good, and we honour it.
- Want it all gone? Email [email protected] and we delete the feature requests and sign-ups tied to your address. Votes aren't linked to your email at all, so there's nothing about you to trace there.
Payments & VAT
Paid plans are handled by Stripe, our merchant of record, and you check out through Link, Stripe's secure checkout. Your card details are held by Stripe, never stored by LootKeep. We calculate and apply EU VAT at the correct rate for your country on every invoice and keep the records you'd need if anyone ever asked, so you stay compliant without thinking about it.
Who we share data with
We don't sell data and we don't share it for advertising. We do rely on a short list of trusted providers that process data on our behalf, each only for what its row says:
- Stripe Payments Europe, Ltd. (Link) · Ireland (EU)Subscription payments, tax calculation, invoicing and refunds, as merchant of record. Link is the customer-facing checkout surface; card details are held by Stripe, never by LootKeep.
- Cloudflare · EU jurisdictionReward-file storage (R2) and website delivery, on infrastructure under EU jurisdiction.
- Railway · EU (Amsterdam)Application and database hosting.
- Patreon · United StatesCreator and fan identity, and the tier membership that decides what a fan can download.
- Resend · United StatesTransactional and account email delivery.
Where a provider is outside the EU, the transfer relies on the appropriate safeguards (such as the EU Standard Contractual Clauses). Your reward files themselves never leave the EU.
Your rights
Under the GDPR you can access, correct, export, or delete the data we hold about you at any time. Cancel and your packs stay live through the end of your billing period. Export everything whenever you like. We don't hold your loot hostage.
For payment data specifically, you can also ask Link to delete your details directly. When you do, Stripe cancels any active subscription, deletes the payment records held in our account, and tells us. We treat that as a cancellation and reconcile our records accordingly.
Contact
Questions, or a data request? Email [email protected] and a human in the EU will answer. LootKeep is operated by Antonio Laguna Matías, trading as LootKeep, a sole trader (autónomo) based in Spain, the data controller for the information described here. Our Data Protection contact is reachable at the same address.