Privacy Policy
This page explains what personal data XeScripts collects when you visit the site or buy a Supporter Pass, why we collect it, and how long we keep it. Plain language; no dark patterns.
1. Data we collect
| Data | Why | Retention |
|---|---|---|
| Receipt email | Send purchase confirmation; reconcile support tickets | Indefinite while account active; deleted on request |
| Hardware ID (HWID) | Lock free script keys to one device; prevent sharing | While the key is active |
| IP address | Rate limiting; abuse prevention; HWID-key issuance | 30 days for rate-limit logs; longer if tied to active key |
| Discord ID (when you open a ticket) | Grant supporter role tied to the right account | While role is granted |
| Payment reference (pay_ref) | Match payment to support ticket; chargeback evidence | 7 years for accounting / dispute compliance |
| Webhook delivery metadata (event id, timestamps) | Replay-protection; fraud forensics | 7 years |
We do not collect, store, or transmit: card numbers, CVVs, wallet seeds, full names, postal addresses, or government IDs. Card and crypto payment details are handled exclusively by our checkout infrastructure; XeScripts never sees them.
2. Third parties
- Payment Processor — hosted payment processing. The processor handles card/crypto data and sends confirmation webhooks to our server.
- Cloudflare — CDN, DDoS protection, rate limiting at the edge. May log IP + request metadata transiently.
- Discord — community platform. Supporter roles are assigned via Discord; their handling of your account data is governed by Discord's own privacy policy.
- Linkvertise — only when generating a free 24-hour script key. Their privacy policy applies during that flow.
- Google Fonts — loads the page typeface from
fonts.googleapis.com. May log IP per Google's policy.
3. How we use the data
- Issue and rebind script keys (HWID + IP)
- Confirm Supporter Pass purchases (email + pay_ref)
- Grant Discord roles to verified buyers (Discord ID + pay_ref)
- Detect and block abuse (IP rate limits, HWID blacklists)
- Defend against chargebacks (purchase metadata + consent timestamps)
We do not sell, rent, or trade your data. We do not run advertising trackers on the site.
4. Cookies
The site sets a session cookie on authenticated pages (/auth/*) for rate-limit and CSRF infrastructure. HttpOnly, Secure, SameSite=Lax. No marketing or analytics cookies.
5. Refund-related data
We retain payment metadata (pay_ref, invoice_id, paid_at, amount, terms-acceptance timestamp) for 7 years for chargeback defence and accounting. This retention applies even if your purchase is fully refunded by the payment processor, since refund-related disputes can surface up to 540 days after the original transaction. See our no-refund terms — we do not issue refunds, but the data retention applies regardless.
6. Your rights (GDPR / CCPA)
If you live in the EU, UK, or California, you can request:
- Access: a copy of the data we hold about you
- Deletion: removal of personal data (subject to retention obligations above)
- Correction: fix inaccurate data
- Portability: export of your data in machine-readable form
- Objection: withdraw consent for processing
To exercise any of these rights, open a Discord ticket. We respond within 30 days.
7. Security
Webhook payloads are HMAC-SHA256 verified before any DB write. Personal data in error logs is automatically redacted. API keys live outside the webroot, chmod 600. HTTPS is forced site-wide via HSTS. Rate-limit files are sandboxed to the OS temp dir.
8. Children
The site is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has submitted personal data, contact us via Discord ticket and we will delete it.
9. Changes to this policy
We may update this policy. The "Last updated" date at the top reflects the current version. Material changes will be announced in Discord.
10. Contact
Privacy questions: open a ticket in the XeScripts Discord with subject "Privacy Request".