Privacy policy

This policy explains what personal data , run by Brian Clark in the United Kingdom (“we”), collects when you use this site, why, and what your rights are. Brian Clark is the controller for the data described here. To ask anything about it, email our support address.

What we collect

• Your account: email address, display name, a hash of your password (never the password itself), when you verified your email, and the IP address of your last sign-in.
• Steam, if you link it: your SteamID, Steam name and avatar, as returned by Steam.
• Orders: what you bought, the price, the name and email given at checkout, and the receipt link. We receive this from LemonSqueezy; we never see your card or bank details.
• Downloads: each download’s time, IP address and browser user-agent, and the file’s fingerprint (see below).
• Checkout confirmations: when you agree to the terms before paying, the time, your IP address and which version of the terms you accepted.
• Support tickets: what you write to us and which plugin it is about.
• Security records: sign-in attempts and account changes, with the IP address, used for rate limiting and to investigate abuse.

Download watermarking

Every plugin file you download is stamped with a unique identifier, visibly and in ways hidden in the code, that links that copy to your account and that download. If a copy is published or shared without permission, we use it to find out whose licence it came from and may suspend that licence. We do this under our legitimate interest in protecting our work; the watermark does not change how the plugin runs and is not sent anywhere by the plugin.

Why we use it (lawful basis)

• Contract — creating your account, delivering what you bought, updates, invoices and support.
• Legal obligation — keeping order records for tax and accounting.
• Legitimate interests — watermarking and leak tracing, preventing fraud and abuse of the site, and keeping it secure.

We do not sell your data, use it for advertising, or send marketing email. Account emails (verification, password reset, order and support replies) are part of the service.

Who we share it with

• LemonSqueezy — our merchant of record. They take payment, handle tax and receipts, and are responsible for the data you give them at checkout under their own privacy policy.
• Steam (Valve) — only if you choose to link your account; you sign in on Steam’s own site.
• Our hosting and email providers — who store the site and deliver its email on our behalf.
• YouTube (Google) — some product pages show video previews. The preview image loads from Google’s servers; the video itself only loads, from youtube-nocookie.com, if you click play.

We may also disclose data where the law requires it, or to enforce a licence against someone who leaked a file.

Cookies and storage

We set one cookie, a session cookie, and only once you sign in or submit a form. It keeps you signed in and protects forms against cross-site request forgery, and it is deleted when you close your browser or sign out. The site also briefly uses your browser’s session storage to show a confirmation message after a page change. We use no analytics, advertising or tracking cookies, so there is nothing to opt out of. The checkout page is run by LemonSqueezy on their own site.

How long we keep it

• Account data: until you ask us to delete your account.
• Orders and invoices: six years after the purchase, as UK tax rules require.
• Download and watermark records: as long as the plugin is sold and for six years after, because they are the evidence if a copy leaks.
• Support tickets and security records: up to two years.

If you delete your account, we keep only what the lines above require and remove the rest.

Your rights

Under UK and EU data protection law you can ask for a copy of your data, have it corrected, have it deleted or restricted, object to processing based on legitimate interests, and receive the data you gave us in a portable format. To do any of this, email our support address; we will reply within one month. Some of it (order records, download records) we may have to keep for the reasons above, and we will tell you if so.

If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office, or the data protection authority where you live.

Security and transfers

The site is served only over HTTPS, passwords are stored as one-way hashes, and plugin files are never publicly reachable. LemonSqueezy and some service providers may process data outside the UK; where they do, they rely on recognised safeguards such as adequacy decisions or standard contractual clauses.

Changes

If this policy changes we will update the date at the top, and tell account holders by email about any significant change.