Effective 2026-08-15
We collect as little as possible: no real name or game credentials, and an email only if you optionally provide one for account recovery. This page explains exactly what we process.
A username and a hashed password (we never store your password in plain text). A machine identifier derived from your PC and hashed, used to lock a licence to one machine. Your IP address, used transiently to rate-limit abuse and to produce aggregate, bot-filtered visitor counts — and to derive an approximate country for those non-identifying statistics. While the app is running it sends a periodic liveness ping (about every 15 minutes) so your licence shows as online; this records the app version plus your most recent IP address and country on that licence, and a short recent sign-in IP history for account-security review. Payment records — the amount, method, and your PayPal subscription / transaction reference. If you enable two-factor, your authenticator secret. That is the full footprint.
To provide and secure the Service, verify payments, enforce one-licence-per-machine, prevent abuse, and understand aggregate traffic. We do not sell, rent, or share your personal data with advertisers or data brokers.
While you are signed in we keep a short-lived per-account activity log (which pages you viewed, when, device type and country) for support and to understand how features are used. It is retained for about 3 days, then automatically deleted, and is visible only to our staff — never sold or shared.
We set a strictly-necessary session cookie to keep you signed in (and a staff-only test-mode flag). Our visitor analytics is cookieless. We use no advertising or cross-site tracking cookies.
Payments are processed by PayPal. Each payment is verified directly with PayPal (Payment Data Transfer) before access is granted; we never see your card or bank details.
Account data is kept until you delete your account. Payment records are retained as a business/accounting record.
From your account page you can export all of your data at any time, and delete your account — the complete self-service controls.
Passwords are hashed with PBKDF2, optional TOTP two-factor is available, and the site is served over HTTPS with HSTS and a strict content-security policy. Keeping email optional and collecting minimal data deliberately shrinks the attack surface.
The Service is not directed to anyone under the age of majority in their jurisdiction.
We may update this policy; changes take effect when posted here. Questions or requests: info@gameoverlay.net.