This is the short version of what our servers hold, why they hold it, and what we refuse to touch.
What we collect
Email address. Required for account creation, key delivery, and support replies. Your password is stored as a salted hash, so nobody on our side can read it back in plaintext, us included. Your email address itself is stored in plaintext because the delivery flow needs to send to it.
Payment metadata. Checkout runs on Fungies, our payment processor. Fungies handles the card, wallet, or crypto rail; we only receive a confirmation and an order reference. We never see or store your card number, CVV, or bank details. If you want the other side of that transaction, Fungies publishes its own privacy notice.
Hardware identifier hash (HWID). The loader computes a machine-scoped hash from stable hardware fields on first launch and sends it to our licensing endpoint. It is a one-way hash: given the value we hold, we cannot rebuild the serial numbers or component IDs that fed into it. We use it for exactly one thing, stopping a single key from being passed around or run on unlimited machines.
Server logs. Our web server keeps a short access log with your IP address and browser user-agent string. Retention is 30 days, after which entries are purged. We use these to spot abuse, debug delivery failures, and enforce rate limits. They are not shared with third parties.
Cookies
Two cookies, no more. A session cookie is required to keep you signed in while you move between account pages; it clears when you close the browser or sign out. A currency preference cookie is optional and just remembers whether you like to see prices in USD, EUR, or GBP.
We do not set advertising cookies. We do not embed third-party pixels. There is no “accept all” banner because there is nothing to accept beyond the session cookie you already need to use the site.
What we do not do
No ad-network tracking. No selling, renting, or trading your email address, ever, to anyone. No marketing email; the only messages you receive from us are transactional (order confirmation, key delivery, support replies, and any status notices you opted into on the status page). No Google Analytics, no Meta Pixel, no TikTok Pixel, no similar third-party analytics of any kind. Our only site analytics is Cloudflare Web Analytics, which is cookieless and does not profile individual visitors.
Deleting your data
Email support from the address on your account and ask for deletion. We wipe the account row, the HWID hash, and any support tickets tied to that email within seven days. Payment records held by Fungies fall under their own retention rules; we can point you at the right contact there if you want to close that loop too.
Jurisdiction
Any dispute is resolved individually; no class actions. For the operating terms that go with this policy, see the terms of service. For the money side, see refunds.