Launching a web shop: a 90-day plan

The plan on one page

The table assumes you already have player accounts (a login that works outside the app stores) and a live game on iOS, Android or both. Without an account system, we would add four to six weeks at the front. All the day ranges here are our own planning estimates, not published benchmarks. The plan also assumes a merchant of record (MoR). Running payments yourself through a payment service provider (PSP) moves most of the tax and compliance rows onto your team.

Days 1 to 14: model and provider

The first decision is who sells to the player. With an MoR, the provider is the legal seller. It charges and remits VAT and sales tax, and disputes count against its merchant account. With a PSP, your studio is the seller, and the tax registrations, scheme thresholds and consumer-law duties are yours. The trade-offs and the full cost comparison are on MoR vs PSP.

Then pick the provider. The provider selection page has the RFP questions. Three checks catch most late surprises:

• Virtual currency. Confirm in writing that the provider allows it. Paddle markets to games, but its prohibited list includes “virtual currency or stored value”. Stripe’s konbini page lists “Real Money Trading (RMT), that is, sale of virtual (in-game) characters, currency” among prohibited categories for that method.
• Checkout control. Stripe Managed Payments, Stripe’s MoR product, accepts video game tax codes but runs only on Stripe-hosted checkout, and players see Onelink as the merchant.
• Counterparty risk. Digital River, once a large MoR, said in January 2025 it could not draw on its credit facility and began winding down. Its Irish arm went into provisional liquidation and its German subsidiaries entered insolvency proceedings. Ask about payout frequency, reserves and how client money is held.

Days 10 to 30: tax and consumer law

If you use an MoR, confirm which countries it registers in and which it does not cover. If you sell as the merchant yourself, the obligations start with the first sale in most markets:

• EU. Games are electronically supplied services, taxed where the player lives. The €10,000 threshold applies only to sellers established in one EU member state; a US, UK or Japanese studio has none. The non-Union One-Stop Shop lets you file one quarterly return. You must hold “two items of non-contradictory evidence” of each player’s location, such as billing address and IP address.
• UK. A business based outside the UK must register for VAT “regardless of taxable turnover” if it supplies anything to the UK.
• US. Since South Dakota v. Wayfair (2018), states can require sellers with more than $100,000 of sales, or in some states 200 transactions, to collect sales tax. Utah, Illinois and Kentucky have dropped the transaction count, from 1 July 2025, 1 January 2026 and 1 August 2026 (the Utah and Kentucky dates as reported by the Sales Tax Institute). Whether in-game currency is taxable varies by state. The tax page has the country table.

Consumer law applies whichever model you choose, because the checkout is yours. In the EU, a player has 14 days to withdraw from a purchase. For currency delivered at once, the right is lost only if the player gives prior express consent, acknowledges losing the right, and receives confirmation (Consumer Rights Directive, Article 16(m)). Directive (EU) 2023/2673 adds an online withdrawal function for contracts that still carry the right, which member states must apply from 19 June 2026; we have not checked each country’s transposition, so confirm it for your markets. EU consumer authorities expect the real-money price next to every virtual currency amount.

Days 10 to 45: account linking and entitlement delivery

This is the longest build and the one players notice when it breaks. A web purchase must reach the right game account on every platform where the player plays, at once, and exactly once.

Build it to four rules. Every order carries a player ID, an order ID and the items granted. Delivery retries until the game confirms it. The game can show the player a receipt for web purchases. Support can look up any order by player or order ID.

Platform rules shape what you can deliver. Apple’s guideline 3.1.3(b) lets a player spend web-bought currency in the iOS app in any country, provided the same items are also sold as in-app purchases. Steam requires in-game purchases inside the Steam client to go through Steam Wallet, and “strongly encourage[s]” linking Steam accounts to your own system. See the Steam rules before you sell PC currency on the web.

Days 20 to 45: catalog and pricing

Start with the packs your top in-app spenders buy, priced in local currency. Decide the web incentive (the offers page covers bonus levels) and design the first three offers together. Watch fixed per-transaction fees on small packs. Stripe’s US card price of 2.9% + 30¢ takes about 33% of a $0.99 pack and 3.5% of a $49.99 one.

Consider a gate. Monopoly GO’s web store, per Stash, opens only to players at board level 10 who have played for at least a month. A gate focuses the launch on committed spenders.

Days 30 to 60: the in-game link, region by region

Build the link once and switch it by storefront. As of 4 October 2026:

• Apple, US. Buttons and links allowed, 0% commission for now. Apple may stop your link being more prominent than its own purchase button. See Apple US.
• Apple, EU. Since 1 October 2026: 15% (10% reduced) on sales within 7 days of the tap. Your choice of payment options must stay in place for 12 months, and you file a monthly transaction report within 15 days of month end. Kids category apps cannot link out; under-13s see no out-of-app offers; 13 to 17 need a parental gate. See Apple EU.
• Google Play, US. External content links carry a fee on transactions within 24 hours of the click, due since 1 October 2026, and the fee is contested. See Google Play.
• Everywhere else. Check the rest-of-world rules. Outside the regional exceptions, Apple’s 3.1.1(a) bans in-app links, and you reach players by email and other channels outside the app, which guideline 3.1.3 allows.

Record the storefront and the link-tap time on every order. You need both to report and pay store fees that depend on attribution windows.

Days 30 to 60: fraud and chargebacks

If you are the merchant, disputes count against your own merchant account. Visa’s monitoring program flags a merchant as “Excessive” at a ratio of 1.5% in its Asia Pacific, Canada, EU and US regions since 1 April 2026 (2.2% before), once the merchant has at least 1,500 fraud reports plus disputes in a month. Latin America and the Caribbean is also at 1.5% with the same 1,500 floor. CEMEA (Central Europe, Middle East and Africa) stays at 2.2%, with a floor of 150 fraud reports plus disputes and USD 75,000. The ratio counts fraud reports plus disputes over settled card-not-present transactions. Your MoR carries this exposure if you use one.

For European cards, PSD2 requires strong customer authentication on online payments, and a merchant that skips it carries the fraud loss (Article 74(2)). Low-value payments up to €30 can be exempt, within cumulative limits of €100 or five transactions. Even with a hosted checkout, a PSP merchant completes an annual PCI self-assessment (usually SAQ A).

Log the evidence you will need to fight a dispute: payment ID, items granted, delivery time and in-game use. The chargebacks page covers the rest.

Days 40 to 60: support and refunds

Write a refund policy per market before launch, and train support on it. Some local methods cannot be refunded through the payment rail. Stripe’s documentation says OXXO payments “can’t be refunded”, so you need a separate way to credit the player.

Decide your chargeback policy with counsel. The FTC’s 2022 settlement with Epic included $245 million in refunds and an order that “bars Epic from blocking consumers from accessing their accounts for disputing unauthorized charges”.

Days 40 to 75: analytics and soft launch

Tag every order with its source (in-game link, email, social, creator, direct), storefront and platform. Report the metrics on measuring D2C from launch day, joined to finance data so net revenue per $100 is real.

Soft launch to your top in-app spenders in one or two markets where an in-game link is allowed, with a random holdout that does not see the web offer. We plan on four to six weeks of holdout data to tell whether web revenue is new or moved from the store.

Days 75 to 90: scale

Open the web shop to more players and markets in the order the soft launch supports. Add email segments, creator codes and social one at a time so each has a clean read. Add local payment methods where your traffic shows demand (see payment methods by market). Review the store fee rules monthly; several changed in the weeks before this page was written.

Launch-day checklist

1. Written confirmation from the provider that in-game currency is permitted, for every payment method you enable.
2. Tax registrations in place, or the MoR’s coverage list checked against your markets.
3. Checkout captures the EU withdrawal waiver and shows the real-money price beside every currency amount.
4. A test purchase from every platform lands in the right account, and support can find it by order ID.
5. The in-game link shows only in storefronts where it is allowed, and every order records storefront and link-tap time.
6. Dispute evidence is logged automatically, and one named person owns the dispute ratio.
7. A holdout group is excluded from web offers for the first four to six weeks.