Privacy policy

KeyScope runs this store and is the controller of the personal data described below: it decides what is collected and why. For anything in this policy, contact support on Discord.

When you place an order: the products and variants ordered, the amount, the coin you chose, the payment address the order was given and the transactions that paid it, and your email address if you choose to give one. An order placed while signed in is linked to your account. Crypto payments are public on their network by design.

When you make an account: your email address, a salted hash of your password (never the password itself), when the account was made and last signed in, the browsers signed in to it, your balance with every change to it, and the top-ups you start, with their payment addresses and transactions.

When you contact support: the content of your message, your contact handle, and the order it relates to.

When you use the KeyScope Loader: the licence key, a fingerprint of the computer it runs on, which binds the licence to that computer, the device name and Loader version it sends, whether the account signed in or failed and the reason given, and, if you sign in to the Loader, which account it is signed in to, from which computer, and when it was last used.

Automatically: each request's IP address and browser reach the server, which uses them to slow down abuse. To see where buyers stop on the way to an order, the store records the pages and products viewed, items added to the cart, checkouts, order attempts, sign-ins and codes applied, linked to the order or account where there is one, under a visitor key made from the IP address and browser with a salt that is deleted at the end of each day, so the key cannot be worked out again afterwards. With them go the device type, the country Cloudflare reports, the name of the referring site and the campaign tags of the link you arrived by. No IP address is stored with them.

In your browser only: your cart, your currency preference and links to the orders you placed are stored in your browser's local storage. They stay on your device; the cart reaches us only when you place an order with it.

• Card or bank details. The store takes crypto only, sent from your own wallet, so there are none to collect.
• Government identification. We do not ask for passports, national IDs or proof of address.
• Your gameplay. Once an account is delivered we do not see what you do with it; the Loader tells us only whether it signed in.
• Special category data. No health, biometric, political or religious data is collected or requested.

• To fulfil your order: performance of a contract
• To provide support and honour warranties: performance of a contract
• To prevent fraud and chargeback abuse: legitimate interest
• To see where buyers stop on the way to an order: legitimate interest
• To keep records of orders, payments and balances: performance of a contract, because warranties, store credit and your balance rest on them

We do not sell personal data, and we do not share it with advertisers or data brokers.

The table below is the full list. Local storage entries are included because they behave the same way from your point of view, even though they are not technically cookies.

The two sign-in cookies are set only when you sign in, because staying signed in needs them, and the language cookie only when you choose a language with the switcher. We use no advertising or cross-site tracking cookies. If that changes, a consent banner will appear before any such cookie is set.

Only the processors needed to run the store:

• SHKeeper, the payment software we run ourselves: gives each order and top-up its payment address and watches the network for the payment
• Our account supplier: buys and issues the accounts, and is told what was ordered, never who ordered it
• Cloudflare: sits in front of the store's own server, where the site runs and the order records are kept. Every request to the site passes through its network, which delivers the pages and shields the site from attacks, and its Web Analytics counts page views without setting a cookie
• Discord: hosts the server where support tickets are opened, and keeps what is written in them. The store also posts notices to its staff's own Discord channel: when an order changes state, naming the order ID, what was ordered, the amount and the email given with the order; when a top-up reaches a balance; and when a Loader licence is used or reported as failing, with the licence key and the reason given
• Telegram: carries the same notices to the owners' own chats, except for an order that has been placed and not yet paid

We may also disclose data where legally required, or to establish or defend a legal claim.

• Order and transaction records: kept with no set end date, because warranty claims, store credit and your balance are checked against them. Balance statements and top-ups count as transaction records
• Accounts: kept with the transaction records. If you ask support to close yours, it is disabled and every browser and Loader signed in to it is signed out; the email and the password's salted hash stay with those records, as above
• Delivered accounts: kept on your order page for as long as the order record is kept
• Loader history: 180 days. The fingerprint of the computer a licence is bound to stays with its order record, as above
• Loader sign-ins: until they expire, 90 days after signing in
• Visitor steps: 90 days
• Support conversations: 24 months
• Server and access logs: 30 days

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or hand it to another provider. You can object to processing based on legitimate interest.

Ask through support on Discord. We respond within 30 days. Exercising these rights costs nothing and we will not treat you differently for doing so.

Deletion has a limit: order and transaction records, and the account they belong to, stay, as the section above says, because your balance and any claim on an order rest on them.

If you are in the EEA or UK, the GDPR applies and the legal bases are listed in section 4. The processors listed in section 6 may handle your data outside the EEA or UK. You have the right to complain to your national supervisory authority, which in the UK is the Information Commissioner's Office, and you may do so without contacting us first.

Under the CCPA and CPRA, California residents may request the categories and specific pieces of personal information collected, request deletion or correction, and opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA, and we do not use it for cross-context behavioural advertising. Requests go to support on Discord. We will not discriminate against you for making one.

This site is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, tell support on Discord and the account will be closed.

Traffic is encrypted in transit with TLS. Access to order data is limited to staff who need it. The store takes no card details at all. No system is perfectly secure, and if a breach affects your data we will say so on this site and in our Discord within 72 hours.

We will update this page when our practices change and move the date at the top.

Privacy enquiries and rights requests go to support on Discord: open a ticket there. The support page has the same link.