Privacy Policy

01Information We Collect

Two different things: what an account holds, and what a visit records.

• Email address — sign-in by one-time code, and order notifications.
• Display name and avatar — shown on your profile. If you sign in with Google or Discord, they come from that account.
• What you bought — an order has to stay on record for you to be able to download the file again.
• A visit records the page, the day, whether you are on a phone, tablet or desktop, and which of the twelve languages you are reading. Not who you are.
• Instead of your address, a visit stores a mark: your address and today's date passed through a one-way function. It tells one visitor from another within a day, it is unrelated to tomorrow's mark for the same person, and it cannot be turned back into an address without the server's secret key.
• Signing in records the device: the address it signed in from, the city and country that address resolves to, and the browser's own description of itself. All of it is on your devices page, where you can end any session you do not recognise.

02How Your Data Is Used

For running the shop, and for nothing else:

• Signing you in, by one-time code or through Google or Discord.
• Attaching a purchase to your account and delivering the file you paid for.
• Sending the mail the purchase itself requires — a code, a receipt.
• Counting how many people opened which page, in which language, on what kind of device — so the shop can be built for the people who actually use it.

03Payment Data

Your card never touches this site. Every payment is handled by the provider itself:

• monobank (plata by mono) — card payments, carried out by the bank.
• PayPal, Patreon and NowPayments (cryptocurrency) — each under its own terms.
• All this site receives back is a reference number and a status — never the card. The order itself also records the country your address resolves to, and for a card payment the address; how long each is kept is below.

04Data Storage & Security

The database is Supabase. Two things about it are worth stating plainly rather than glossing:

• The site is served over HTTPS and moves everything else onto it. The very first request from a browser that has never been here can still go out in the clear — which is exactly why the session cookie carries Secure and is never sent over a plain connection.
• The session cookie is readable by scripts on this page, and that is not an oversight — the page reads it to know you are signed in. It is SameSite=Lax, which limits when another site can cause it to be sent, and does not make it unreadable.
• Row Level Security means one account cannot read another's rows, and the browser's public key sees almost nothing at all.
• There are no passwords here to lose. A sign-in code works once and expires.

05How Long We Keep Data

Every term below is a rule in the database that runs nightly, not a promise:

• Your profile and your purchases — for as long as the account exists.
• Visit statistics — 12 months, so one September can be compared with the next.
• The address of a paid order — 12 months. Kept not for the site to work, but for one case: a dispute about the payment. A card dispute can be filed for 120 days and reviewed for three months more.
• Your signed-in devices — 90 days after that device was last seen. The address, the city and country, and the browser string all go with the record.
• Notifications — 90 days. The download log, which records an address so that one file being pulled from a hundred places can be spotted — one month.
• Payment providers keep their own records under their own obligations, and those are not ours to delete.
• Records made before September 2026 still contain addresses that are no longer collected. They are due to be deleted, and this line goes when they do.

06Cookies and Browser Storage

Three things need a cookie, and none of them is advertising:

• Staying signed in.
• Remembering which language you chose — the address of a page is the same in all twelve.
• Telling your devices apart, so "sign out everywhere" can end the others and leave this one.
• One thing is stored outside cookies: a random identifier in your browser's storage, so the admin page can show how many people are on the site right now. It is tied to the browser, not to you, and clearing site data ends it.
• Video is embedded through youtube-nocookie.com. Opening a product page sets no cookie from it — measured, not assumed. Playing a video may; that is YouTube's to describe, and we do not promise otherwise.

07Children's Data

This site is not intended for children under 16, and we do not knowingly collect personal data from anyone under that age without the consent of a parent or legal guardian.

• An account holds an email address, a display name and a list of purchases.
• If you are a parent or guardian and believe a child has given us data, open a ticket or write to support@scar52uefn.com and it will be deleted.

08Third-Party Services

These services see something, and each under its own policy: Supabase (database and sign-in), monobank (card payments), PayPal, Patreon and NowPayments (other ways to pay), Google and Discord (optional sign-in), Cloudflare (the check that tells a person from a script), YouTube (video, through youtube-nocookie.com), Vercel (hosting — it derives the city and country from your address at its edge, before this site's code runs, and that city and country is what gets stored with a sign-in), and Sentry (crash reports). Sentry's events are stored in Germany for 90 days, and this site sets the address field to null on every report it sends. Nothing here is sold, to advertisers or to anyone.

09Your Rights

To delete your account and all associated data, open a ticket on Discord or email support@scar52uefn.com. Deletion is handled manually — usually within a day or two, and never later than 30 days.

11Contact

For anything about this policy, or to ask for a copy of your data or for its deletion: support@scar52uefn.com, or a ticket on the Discord server.