Privacy Policy

We collect only the information needed to run the store and support your account.

• Account authentication — verify it's you when you sign in via Discord
• Order processing — match payments to products and unlock downloads
• Support — respond to your tickets and resolve issues
• Security & abuse prevention — block fraud, chargeback abuse, and unauthorized access attempts
• Service improvement — aggregate usage stats to fix bugs and improve features
• Required disclosures — respond to lawful legal requests when we have to

We do not sell, rent, or share your personal information with advertisers, data brokers, or marketing networks.

We rely on a small number of third parties to operate the store. Each only receives the data they need.

These providers have their own privacy practices. We don't control them, but we chose providers with established privacy commitments.

We use the minimum necessary:

• Session cookie (httpOnly, SameSite=Lax, Secure) — keeps you signed in. Expires when you log out.
• OAuth-state cookie — short-lived (5 minutes), used to protect the Discord login flow against CSRF. Deleted after each login.
• localStorage — preferences such as "terms accepted" and your audio-notification toggle.

No third-party analytics or advertising cookies are set by us. Cloudflare may set bot-protection cookies as part of its DDoS service.

• Account — kept while your account exists; deleted on request (see Section 7).
• Orders & payment records — retained for at least 7 years to comply with tax and accounting law, even if you delete the account.
• Support tickets — archived after closure; deleted after 24 months unless legally relevant.
• Server / access logs — rotated every 5 entries × 10 MB (Caddy logs); older entries discarded automatically.
• Download logs — kept indefinitely as part of the anti-piracy audit trail (anonymized after 12 months if you delete the account).

• TLS / HTTPS everywhere — provided and enforced by Cloudflare
• Login tokens are signed JWTs in httpOnly cookies (not readable from JavaScript)
• Passwords are never collected — Discord handles auth
• Webhooks (Polar / NOWPayments) are verified with cryptographic signatures
• Internal admin access is role-gated and logged

No service is 100% secure. If we ever experience a breach affecting your data, we will notify affected users by email and via a Discord announcement.

You can ask us to:

• Access — get a copy of the data we hold about you
• Correct — fix anything inaccurate
• Delete — remove your account and the personal data tied to it (we'll keep anonymized order records as required by tax law — see Section 5)
• Export — receive your data in a portable JSON format
• Object / restrict — limit how we process specific data

To exercise any of these, open a Discord support ticket or email [email protected]. We respond within 30 days (usually much faster).

EU/UK residents have additional rights under GDPR/UK GDPR including the right to lodge a complaint with your local data-protection authority.

Our Services are not directed to children under 13 (the minimum age for a Discord account). We don't knowingly collect data from anyone under 13. If you believe a child has shared data with us, please contact us and we'll delete it.

You must be at least 18 (or your jurisdiction's age of majority) to make purchases.

Our infrastructure runs on servers located in the EU, with Cloudflare proxying traffic globally. If you access the site from outside the EU, your data may be transferred to and processed in countries with different data-protection laws. By using our Services you consent to this transfer.

We may update this Privacy Policy from time to time. Material changes will be announced in our Discord and in a banner on the site for at least 14 days before they take effect. The "Last Updated" date at the top of this page always reflects the current version.

For privacy questions, data requests, or anything else: