Privacy policy

What we collect

Only what is needed to issue and check licences, and to help you when something breaks.

• Account: email, full name, and a password hashed with PBKDF2-SHA256. We do not store and cannot recover the original password. Phone number and company appear only if you enter them.
• Licences and devices: licence key, machine name and a machine fingerprint generated by the software, plus the last sign-in time. This is how the per-device limit works.
• System log: IP address, time and event type for important actions — sign-in, licence issued, device released, admin changes. Used to trace disputes and suspected unauthorised access.
• Orders: order code, product, plan, amount and payment status. We never receive or store card numbers — card entry happens entirely on the payment gateway.
• What you send us: support email or messages, and screenshots you attach to a bug report.

Cookies

• Session — required, so you are not asked to sign in on every page.
• Light/dark theme and language — remembers your choice; not tied to your identity.
• One-off notices — the green or red line after you save something; deleted as soon as it is shown.
• We set no behavioural tracking cookies for advertising of our own.

The wait page before a download carries Google AdSense. Google and its partners may set their own cookies on that page to choose ads. That falls under Google policies rather than ours; you can turn off personalised ads in your Google account ad settings.

Where the data goes

We do not sell or rent data. The parties below receive data because the system needs them to run:

• Cloudflare — servers, database and file storage. The whole system runs on their infrastructure.
• VNPay and MoMo — only when you pay, and only the order code and amount.
• Resend — sends verification and notification email. They see the address and the message.
• Google AdSense — on the download wait page only, to show ads.
• img.vietqr.io — renders the coffee QR image. They receive our bank account number, not your data.

How long we keep it

• Account and licences: for as long as the account exists.
• System log: kept for tracing; we clear records that are no longer needed on a regular schedule.
• Orders: kept for accounting requirements and for later disputes.
• Delete your account and its licences and devices go with it, with no way back.

Your rights

• View and edit your account details from the dashboard.
• Ask for a copy of your data, or ask us to delete the account — email us from the registered address.
• Release any device at any time without asking us.
• Complain about how we handle your data: email us and we answer during office hours.

Security

Passwords are hashed with PBKDF2-SHA256 and never stored in the clear. Payment gateway keys are encrypted with AES-GCM before being written to the database, using a key that lives only in the server environment — a leaked copy of the database would not carry the payment keys. The whole site runs over HTTPS and blocks third-party scripts, except on the download wait page where the ads sit.

Children

The service is not aimed at children under 16. If we find an account was created for someone younger without a guardian consenting, we delete it.

When this policy changes

Small changes are made here with the date at the top of the page. Changes that alter the nature of the processing are emailed to active accounts before they take effect.

Privacy questions

Email our support address with "privacy" in the subject line.