Privacy notice

Accounts and authentication

Account records include email, name, language preference, email confirmation status and marketing choice. Password authentication stores password hashes; the authentication system stores sessions and temporary confirmation or reset credentials. Sessions may record IP addresses and browser information, and rate limit records help prevent abuse. Sign-in does not require prior email confirmation and sends no email code. Sign-up does send one: a one-time code is mailed to the address, and the new account cannot be used until that code is entered. Email confirmation, password reset and email change depend on optional transactional email configuration. These messages contain temporary links and use a separate channel from marketing email.

Payments, subscriptions and referrals

When payments are enabled, this site sends the personal billing identifier, payer identifier, product and payment method to Payment Center. It retains order, amount and currency records, payment evidence mirrors, entitlement periods and recovery task status. Payment provider credentials, original payment proof, approval and external settlement are handled by Payment Center. This site updates entitlements from verified settlement facts. When referrals are enabled, this site records invitation codes and the first valid attribution, then synchronizes the user and attribution with Payment Center. That center is authoritative for referral rules, balances, ledgers and withdrawal status. A withdrawal involves a Binance UID or wallet address. This site currently encrypts the payout account at rest, shows masked values in ordinary views, and sends the information needed for settlement to the center.

Contacts, marketing choice and unsubscribe

When Email Center integration is enabled, this site synchronizes user identifier, email, name, language and its source, event time and marketing choice. An opt in remains pending locally until email ownership is confirmed; marketing consent sent to the center is false before confirmation. Declining marketing does not prevent a basic account from being created. Email Center manages contacts, campaigns, unsubscribe, bounces, complaints and delivery suppression. Profile changes, old task retries and Widget requests cannot override its unsubscribe or suppression state. The optional Widget uses a public application identifier and allowed site domains to process a subscription request the user submits. Transactional messages use a separate Resend adapter and are separate from Email Center marketing consent.

Browser storage and security challenges

Sign in uses session cookies, language uses a preference cookie, and theme uses browser local storage. Payment and withdrawal pages keep request identifiers in session storage to recover the same request. When referrals are enabled, a signed invitation cookie supports registration attribution. These records serve their respective features. When Cloudflare Turnstile is enabled, the browser runs its security challenge. Cloudflare may process IP addresses, browser information and security signals used to distinguish people from bots. This site validates the challenge on the server. Turnstile does not establish email ownership or mark an email as confirmed.

Cloudflare Turnstile privacy notice

Account controls currently available

Account settings support changes to name, language and marketing choice. An email change requires approval through the old address and confirmation through the new one. Until confirmation, the original account email and contact binding remain in place. Actions that depend on email confirmation are unavailable when transactional email is not configured. The current template has no self service account deletion or full personal data export screen. Privacy, deletion or correction requests should use the operator's actual contact channel; this page identifies when that channel has not been configured. This site also cannot promise deletion of records held by the two independent centers or removal of delivery suppression on their behalf.

Retention, security and deployment facts

Business records include accounts, payment and entitlement facts, invitation attribution, and synchronization and recovery task status. Retention settings and automatic cleanup are not yet fully implemented. This page does not promise an actual deletion deadline; the handling of financial records and removable personal information still needs operator review. Encryption of withdrawal accounts does not mean all data is encrypted or guarantee that security incidents cannot occur. Actual service provider identities, storage regions, transfers between regions, backups and request handling rules must be verified for the deployment. Local validation does not establish that production has completed these steps.

Actual policies the operator must supply

The actual data recipients and their identities, hosting and storage regions, retention and deletion rules, and privacy request process are not configured. The operator must supply and review both translations against the actual deployment. This template does not determine the applicable jurisdiction or claim regulatory compliance.