Legal
Privacy Policy
Last updated October 17, 2026
This Privacy Policy explains how XPFARM ("XPFARM", "we", "us" or "our") collects, uses and shares information when you use xpbait.com (the "Site") and the Throne Autodrain browser extension (the "Extension"). Each section starts with a short summary; the summary is there to help you read the section, and the full text of the section is what applies.
1. Who we are
In short: XPFARM runs this Site from Texas, USA.
XPFARM is operated from the State of Texas, United States, and is responsible for the personal information described in this policy. You can reach us at katohiroto@yahoo.com.
2. Information we collect
In short: Basic Discord profile details, your settings, and records of your contributions. We never see or store your card number.
| Information | Where it comes from | Why we need it |
|---|---|---|
| Discord user ID, username, display name and avatar | Discord, when you log in | To log you in and show your own profile |
| Your public display name and privacy settings (hide name / hide amounts) | You, in your dashboard | To show the Supporters list the way you choose |
| Contribution records: item, amount, date, payment method type (new or saved card) and status | Created when you contribute | To process contributions, update progress bars and show your history |
| A payment-processor customer reference (e.g. a Stripe customer ID) | Stripe | To let you use the cards you saved with Stripe |
| Basic details of saved cards: brand, last 4 digits, expiry date | Stripe, shown to you only | So you can choose and manage your saved cards |
| Cookies (see Section 6) | Your browser | To keep you logged in and remember your age confirmation |
When you log in with Discord we ask only for the identify permission. We do not receive your email address, your Discord servers, your messages or your friends list.
We never receive or store your full card number or security code. Card details are entered with and stored by Stripe.
3. Information we don't collect
In short: No analytics, no ads, no tracking.
We do not use analytics, advertising or tracking tools, we do not build advertising profiles, and we do not sell or rent your personal information.
4. How we use your information
In short: Only to run the Site and the features you use.
We use your information to:
- log you in and keep you logged in;
- process Contributions and show their status in your dashboard;
- calculate wishlist progress and show the public Supporters list according to your privacy settings;
- prevent fraud and misuse, handle payment disputes, and enforce our Terms of Service;
- respond to you when you contact us;
- keep the records we are legally required to keep.
If you are in the European Economic Area or the United Kingdom, our legal bases are: performance of a contract (providing the Site and processing your Contributions), legitimate interests (preventing fraud, securing the Site and showing the Supporters list, which you control), and legal obligation (financial record-keeping).
5. What is public
In short: Only what you choose to show on the Supporters list.
The public Supporters list shows your display name, your total contributed and your number of Contributions. You can hide your name (you'll appear as "Anonymous") and/or your amounts at any time from your dashboard. Your Discord ID, username and avatar are never shown publicly.
6. Cookies
In short: We only use three cookies, all needed for the Site to work.
| Cookie | Purpose | Lasts |
|---|---|---|
xpfarm_age_verified | Remembers that you confirmed you are 18 or older | 1 year |
xpfarm_session | Keeps you logged in | 30 days, or until you log out |
xpfarm_oauth_state | Protects the Discord login from forgery | 10 minutes |
These cookies are strictly necessary for the Site to function, so they do not require consent. We use no analytics, advertising or third-party tracking cookies. Stripe may set its own cookies on its checkout pages; see Stripe's privacy policy.
7. Who we share information with
In short: Only with the services that run the Site. We never sell your data.
We share personal information only with:
- Stripe, Inc.: to process payments and store saved cards. See stripe.com/privacy.
- Discord Inc.: to log you in. See discord.com/privacy.
- DigitalOcean, LLC: hosts the servers and database that run the Site. See digitalocean.com/legal/privacy-policy.
- Authorities or others, when required: if the law requires it, or where needed to protect our rights, prevent fraud, or respond to a payment dispute.
- A successor: if the Site is sold or reorganized, your information may transfer to the new operator under this policy.
We do not sell or rent your personal information, and we do not share it for advertising.
8. Where your information is stored
In short: In the United States.
The Site is operated from the United States, and our service providers process information in the United States. If you use the Site from outside the U.S., your information will be transferred to and processed in the U.S., where privacy laws may differ from those where you live.
9. How long we keep information
In short: Until you ask us to delete your account. Payment records stay, without your identity attached.
- Account and profile information is kept until you ask us to delete your account.
- Login sessions expire after 30 days or when you log out.
- Contribution records are kept as financial records for as long as needed for accounting, tax and dispute purposes, typically up to 7 years. If you delete your account, these records are anonymized (see Section 10).
- Payment-processor records are kept by Stripe under its own policies.
10. Your rights and choices
In short: You can hide your info anytime, and email us to see or delete your data.
In your dashboard you can, at any time, change your display name, hide your name or amounts on the Supporters list, and remove saved cards.
By emailing us at katohiroto@yahoo.com you can ask to:
- access a copy of the personal information we hold about you;
- correct information that is inaccurate;
- delete your account and personal information;
- object to or restrict certain processing;
- receive your information in a portable format.
Deleting your account. Email us from the address you want us to reply to, with your Discord username. To protect your account, we may ask you to verify the request (for example, by sending us a message from that Discord account). When we delete your account, we:
- delete your Discord details, display name, settings and login sessions;
- delete your customer record with Stripe, which removes your saved cards;
- anonymize your contribution records: the amounts stay, so wishlist progress remains accurate, but they are no longer linked to you, and you are removed from the Supporters list.
We will respond within 30 days. We will not discriminate against you for exercising any of these rights. If you are in the EEA or UK, you also have the right to complain to your local data protection authority. Depending on where you live (for example Texas, California or other U.S. states), you may have additional rights under local law, and we will honor them as required.
11. The browser extension
In short: The extension collects nothing.
The Extension does not collect, store or send any personal information. When you open it, it loads the public wishlist from the Site, the same information anyone can see at xpbait.com/wishlist. It has no access to your other tabs, browsing history or accounts, and it contains no analytics or tracking.
12. Security
In short: We protect your data, but no system is perfect.
We use reasonable measures to protect your information, including encrypted (HTTPS) connections, secure and HttpOnly login cookies, storing only a one-way hash of your login session, and leaving all card handling to Stripe. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
13. Children
In short: The Site is for adults only.
The Site is only for people 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has used the Site, contact us at katohiroto@yahoo.com and we will delete their information.
14. Changes to this policy
In short: If we change this policy, the date at the top will change.
We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page, and for significant changes we may also give notice on the Site.
15. Contact
Questions or requests about your privacy? Contact us at katohiroto@yahoo.com.