Privacy Policy

We collect the minimum needed to deliver and defend the service. This document lists everything we store, how long, and who sees it.

1. 01What we store

   - Account: username, email, Argon2id password hash, Discord ID, Discord username, 2FA secret (if enabled). - Session: short-lived JWT in a signed cookie, last login IP + timestamp. - Licenses: HMAC digest of the key (not the key itself), HWID hashes (HMAC of client-supplied material), bind IPs and timestamps. - Orders: amount, currency, SellAuth invoice id, pay address and amount. - Audit log: who did what action, from which IP, with what metadata.

2. 02What we do NOT store

   - Real name, legal address, phone number. - Payment card details — we never see them. Crypto wallet addresses on your side are not stored. - Raw HWID material — only HMAC digests derived from it. - Plaintext license keys — only HMAC digests. A one-shot 24h stash in Redis is the single exception, for your first dashboard reveal. - Game state, screen content, keystrokes outside the loader login prompt.

3. 03Where it lives

   - Primary DB: Neon Postgres in Singapore (ap-southeast-1), encrypted at rest. - Ephemeral cache: Upstash Redis in Singapore, TLS in transit, encrypted at rest. - Email delivery: your configured SMTP provider. - Payment processor: SellAuth. Their privacy policy applies to data they collect directly from you.

4. 04Who we share with

   No ad networks. No analytics vendors. No data brokers. The only third parties involved are SellAuth (payment processing), your SMTP provider (email delivery), and Discord (if you link your account). Each one receives only what is strictly needed for its function.

5. 05Retention

   - Active account data: kept while the account is active. - Login attempts: 90 days. - Audit logs: 365 days. - Expired licenses: HWID bindings purged on expiry; license row kept for order history. - On account deletion request: hard-deleted within 7 days, with audit log entries anonymized.

6. 06Your rights

   You can request an export, correction, or deletion of your data by opening a Discord ticket. We will complete the request within 7 days or explain the delay in writing. You may deactivate 2FA, unlink Discord, or close your account at any time.

7. 07Cookies

   Two cookies only: - 'sid' — signed session JWT, httpOnly, SameSite=Lax, used to keep you logged in. - A localStorage key 'locale' — the language you picked. No ad or tracking cookies.

8. 08Contact

   Open a Discord ticket. For data protection requests, mention 'privacy' in the ticket subject so it's routed to the right person.