Privacy Policy

• Your account. Your name, email address and password - stored only as a one-way hash, so nobody can read it back - a profile picture if you upload one, whether your email is verified, and when the account was made.
• Purchases. Your invoices: what was bought, prices, coupon, totals, status and when it was paid. From the payment provider we keep each payment's status, amount, the method or currency it was paid with and the notice they send us about it. When you check out we also record details of the connection and browser the order was placed from, such as its IP address, to check orders for fraud.
• Licences. Each licence's key, product, dates and the hardware IDs it is bound to. Each time a tool checks its licence, we record the hardware ID and the IP address the check came from, and when that pair was first and last seen.
• Nitro Claims. The Discord token you give us for an order - kept, encrypted, only while the order is in the queue, and not stored at all once it leaves - and the Discord account ID it belongs to; your orders, places in the queue and credit history; and every claim attempt for your orders - whether it landed, what type it was, how long it took and what the claims service reported.
• Support. Your tickets: subjects, messages, attachments, reactions and pins.
• Telegram. If you link Telegram, the chat ID and username the bot sees, so it can send you notifications.
• Activity. Some actions - joining or leaving the queue, changing a token, opening a ticket, a licence being bound to a device - are written to an activity log with the IP address they came from, as are changes staff make to your account. While you have the site open, staff can see that you are online.
• Notifications we show you in the dashboard.

• To run your account and provide what you bought: signing in, issuing licences, working the claim queue, invoices and support. This is what our agreement with you needs.
• To keep the service secure and stop fraud and abuse: the checkout details, the licence check records, the activity log and the bot check on sign-up and sign-in. This is our legitimate interest in a service that is not abused.
• To tell you what is happening with your account: verification and password emails, dashboard notifications, and Telegram messages if you turned them on. Telegram is yours to turn off at any time, from the Account page or by sending /stop to the bot.

We do not sell personal data, and do not use it for advertising.

A token opens a whole Discord account, so it is handled apart from everything else:

• It is encrypted (AES-256-GCM) before it is stored, and never shown again - not to you, not to staff, and not in any log.
• It is only decrypted to be sent to Discord, to check that it still works, and to our claims service when your account's turn in the queue comes.
• It is deleted when your order leaves the queue - finished, left or removed. The Discord account ID stays on the order and its claim records.

• Payment providers, who process payments. We send them what a payment needs: the amount, the currency and the invoice number, and your email address or username for a provider that asks for them. What you enter on their pages is covered by their own privacy policies.
• Cloudflare, which sits in front of the site: every request passes through it, and its Turnstile bot check runs on the sign-up, sign-in and forgot-password forms.
• Discord and our claims service, which receive your token as section 3 describes.
• Telegram, which carries notifications to you if you link it.
• Our email provider, which delivers account emails: verification, password reset and password changed.
• Our hosting and storage providers, who keep the database, profile pictures and ticket attachments.
• Our staff, each seeing only the parts of the admin their permissions open.

Some of these providers may handle data outside your country. The claim figures shown on the site are rounded totals that identify nobody.

We use cookies only to keep you signed in and to protect forms against requests from other sites. There are no advertising or analytics cookies and no tracking scripts. Cloudflare may set cookies of its own that it needs for security. Your browser also keeps a few interface preferences in local storage, such as how many rows a table shows; they stay on your device.

• Your account and everything on it: for as long as the account exists.
• Discord tokens: until the order leaves the queue.
• Sign-in sessions: until you sign out or they expire. Changing or resetting your password ends every other one.
• Verification and password reset links: until they are used or expire.

When an account is deleted, its invoices, licences and their device records, orders, claims, notifications and sign-in sessions are deleted with it, and so are the tickets it opened - every message in them, and the files attached to them - and its profile picture. Messages it wrote in somebody else's ticket, such as a member of staff's replies, stay in that conversation under “Deleted user”. The activity log keeps its entries, including a record of the deletion with the account's name and email, so that what was done on the service stays accountable.

Passwords are hashed, Discord tokens are encrypted, and the site is served over HTTPS. Staff reach only what their permissions allow, and what they change is logged.

If we change this policy, the date at the top changes with it.

Open a ticket from Support in the dashboard. If you cannot sign in, use Forgot password to get back in first.