Privacy
What we store, why, and who else handles it. Last updated: October 2026.
When you sign in with Discord
Your Discord id, username, display name, avatar, and your email only if Discord says it is verified. We use them to show your purchases, give your Discord role and, for creators, run the creator program. We never post anything for you.
When you buy
Stripe processes the payment; we never see your card. From Stripe we keep the order: product, amount, currency, date, email, Stripe's payment id and its status (paid, refunded, disputed). We keep orders for accounting and to deliver and verify licenses.
Creators
Applications store the name, contact email, links and audience you give. Click counts are stored per day; to count unique visitors we store a keyed hash of the visitor's IP address, never the address itself. Creators never see buyers' data.
Cookies
crimson_session keeps you signed in (7 days, cannot be read by scripts). crimson_oauth protects the sign-in (10 minutes). crimson_hint tells the page you are signed in (holds nothing). crimson_ref remembers which creator link you came from, for the creator program's cookie window. No advertising or tracking cookies.
Security logs
To stop abuse we count requests per keyed hash of the IP address for short windows, and keep an audit log of team actions. License keys are never written to logs.
Who processes data for us
Stripe (payments), Discord (sign-in, roles, support), Netlify (website functions and storage), Cloudflare (website hosting) and, if email delivery is switched on, Resend (order emails).
Your choices
Ask for a copy of your data, a correction or deletion in a ticket on our Discord. We keep what the law requires for accounting.