Privacy notice

The short version

This site is a single page describing a reseller programme, plus a form to apply to it. It has no analytics, no advertising, no tag manager, no session recording and no third-party form service. If you never open the application, nothing about you is collected at all — not even a page-view counter.

If you do apply, we ask Discord who you are, we ask you four questions, and we post both into a private channel that we read. That is the entire system.

Who we are

The Vending Machine operates thevendingmachine.cc and the reseller platform it describes. Contact for anything on this page, including a request to delete an application, is through a ticket in our Discord HQ, or by replying in the private channel opened with you.

What we collect, and when

Just reading the page

Nothing that identifies you. The site is static files served by Cloudflare Pages. Cloudflare processes the request as our infrastructure provider and keeps its own operational logs — that is unavoidable for anything served over the internet, and it is described in Cloudflare's own privacy documentation.

Signing in with Discord

The application form asks Discord for the identify scope and nothing else. That returns your user id, username, display name and avatar. It does not include your email address, your servers, your friends or your messages, and nothing is ever posted to Discord on your behalf.

The access token Discord issues is used once, inside the request that created it, to read that profile — and then discarded. It is never stored, never logged and never sent anywhere else. What we keep instead is a short-lived cookie of our own containing only your Discord id, username, display name and avatar, signed so it cannot be edited, and valid for thirty minutes.

Submitting an application

We collect exactly what the form shows you:

• the business or server name you enter;
• your answer to where you intend to sell;
• a referral code, if you have one;
• an alternative contact, if you choose to give one;
• the Discord identity above, so we know the application is really from you;
• the country, request id and browser user-agent Cloudflare attaches to the request, which is how a flood of automated submissions is told apart from real people.

All of it is posted into a private Discord channel that only we can read. It is not written to a database, not added to a mailing list, and not used to create an account — an application is a message to us, and approving one is a separate conversation.

Cookies

Three, all strictly necessary, all first-party, all HttpOnly and Secure, and none of them used for tracking or advertising:

• a ten-minute cookie holding a random value that ties your sign-in request to the answer that comes back from Discord — the standard defence against someone else starting a sign-in on your behalf;
• a thirty-minute signed cookie holding the Discord identity described above;
• a cookie set by Cloudflare Turnstile, the challenge that tells a person from a script. Turnstile is designed not to profile users and does not use cookies for cross-site tracking.

There is no consent banner because there is nothing here that requires consent — no analytics and no advertising cookies exist to ask about. Clearing your cookies signs you out; nothing is left behind.

Who else sees it

Cloudflare serves the site, runs the Turnstile challenge and runs the code that handles the form, as our processor. Discord sees the sign-in because it is the sign-in, and receives the application because the channel we read is on Discord. That is the complete list. We do not sell, rent or share your information with anyone else, and there is no advertising network involved in any part of this site.

How long it is kept

• The cookies: ten and thirty minutes respectively, then they expire.
• The duplicate check: so the same person cannot flood the channel, we keep a one-way hash of your Discord id — from which the id cannot be recovered — for thirty days. Nothing else is stored with it.
• The application itself: it stays in the private channel as our record of the conversation, for as long as that record is useful. Ask us and we will delete it.

Your rights

Depending on where you live you may have the right to ask for a copy of what we hold about you, to have it corrected, to have it deleted, or to object to our using it. Ask through a ticket in HQ. Because an application is one message in one channel, honouring any of these is genuinely a small task — we would rather you asked than assumed.

Children

This is a business programme and it is not directed at children. Discord's own terms require you to be at least 13, and older in some countries. Do not apply if you are under 18.

Changes

If what the site does changes, this page changes with it, in the same release. The date at the top is the last time that happened.