privacy policy

data collected

• account data: email address, username, user id, password hash, account creation time, and admin flag.
• profile data: avatar image uploads, avatar storage key, and avatar url.
• subscription data: plan, status, expiry time, linked gumroad email, product ids, sale ids, subscription ids, order metadata, refund/dispute status, price, currency, and other purchase webhook fields gumroad sends. we do not process raw card numbers.
• loader session data: access sessions, refresh token hashes, token scopes, expiry times, revocation times, and loader session ids.
• dll activity data: dll heartbeat session id, user id, first seen time, and last seen time so admins can see which users currently have the dll loaded.
• hardware lock data: a hashed hwid, a hashed device key, bind time, and hwid reset time. the loader sends hardware details used to create these hashes so an account can be tied to one machine.
• trial claim data: hashed hwid, hashed device key, user id, username, and claim time to enforce one free trial per hwid.
• admin safety data: admin action logs with admin username, action type, target user id, target username/email when the account still exists, action detail, and time.
• operational data: api request source ips may be used for rate limiting, security checks, turnstile verification, and short server logs.

captcha and cookies

cloudflare turnstile is used for captcha checks on login and registration. turnstile may use cookies or similar technology. read cloudflare's cookie policy and turnstile privacy policy.

deletion

account deletion means full deletion of account data held by sippin' milk. to request deletion, email milk@pawslaves.de.