Effective 2026-08-15
We collect as little as possible and hold no email address, real name, or game credentials. This page explains exactly what we process.
A username and a hashed password (we never store your password in plain text). A machine identifier derived from your PC and hashed, used to lock a licence to one machine. Your IP address, used transiently to rate-limit abuse and to produce aggregate, bot-filtered visitor counts — not tied to your identity. Payment records — the amount, method, and the transaction hash you submit. If you enable two-factor, your authenticator secret. That is the full footprint.
To provide and secure the Service, verify payments, enforce one-licence-per-machine, prevent abuse, and understand aggregate traffic. We do not sell, rent, or share your personal data with advertisers or data brokers.
We set a strictly-necessary session cookie to keep you signed in (and a staff-only test-mode flag). Our visitor analytics is cookieless. We use no advertising or cross-site tracking cookies.
To confirm a crypto payment we look up the transaction hash you provide on public blockchain explorers. We never see your wallet keys and never move funds.
Account data is kept until you delete your account. Payment records are retained as a business/accounting record.
From your account page you can export all of your data at any time, and delete your account. Because we hold no email, these are the complete self-service controls.
Passwords are hashed with PBKDF2, optional TOTP two-factor is available, and the site is served over HTTPS with HSTS and a strict content-security policy. Collecting no email deliberately shrinks the attack surface.
The Service is not directed to anyone under the age of majority in their jurisdiction.
We may update this policy; changes take effect when posted here. Questions or requests: info@gameoverlay.net.