Privacy policy

Last updated 25 July 2026 · data controller: [legal entity not configured]

What we collect from Discord

Signing in uses the identify and email scopes and nothing else. That gives us:

Your Discord user ID — the stable key we store your account under
Your username and display name
Your avatar hash
Your email address

We cannot see which servers you are in, read any message, or post as you. The token we receive does not carry those permissions. Your username and avatar refresh each time you sign in so the site does not show a stale profile.

What we collect when you buy

Order records: plan, quantity, price, discount, status, timestamps
The licence keys issued to you
Which payment provider you chose and that provider's transaction reference

We never see your payment details. Card numbers and Skrill logins are entered on the provider's own site, not ours, and crypto is paid from your own wallet to an address the processor generates. No card data touches this server, and there is nothing here for an attacker to take.

What the bot collects

The desktop software sends a hardware identifier (HWID) to the licensing server so a key binds to one machine, along with your IP address and the account name you chose inside the bot. It logs activity events — encounters, shinies, captchas — so the Discord integration can relay them to you.

The bot does not read your files, your browser, your keystrokes outside the game window, or anything about your machine beyond the identifier used for licence binding.

Why we hold it

To deliver what you bought and show it back to you on your licences page
To stop one key being used by ten people
To handle refunds, disputes and support tickets
To meet tax and accounting obligations on completed sales

Who else sees it

We share data with a small number of processors, each for one job:

Skrill — to take card and wallet payments. They receive the amount, currency and order reference.
NOWPayments — to take Bitcoin and Litecoin payments. They receive the amount, currency and order reference, and generate the address you send to.
Discord — for sign-in, and to grant the premium role while your licence is active.
Resend — to send receipts and expiry reminders, if email is configured.

We do not sell your data, we do not run advertising trackers, and there is no analytics script on this site.

Cookies

Two, both strictly necessary and neither used for tracking: a session cookie that keeps you signed in, and a short-lived signed cookie holding your pending basket so it survives the login step. That is the entire list, which is why there is no consent banner in your way.

How long we keep it

Account and licence records: while your account exists
Order records: seven years after purchase, for tax purposes
Webhook payloads and audit logs: two years
Rate-limit counters: minutes

Your rights

You can ask for a copy of your data, ask us to correct it, or ask for deletion. Deletion removes your account, profile and licences; order records tied to completed payments are retained where the law requires it, reduced to what that requires. Ask in Discord or email support@example.com. We aim to respond within 30 days.

Security

Traffic is served over HTTPS. Licence keys are never written to logs in full — only the last four characters, enough to match a support ticket and useless to anyone who obtains the logs. Administrative actions are recorded in an append-only audit log.