Privacy Policy

Short version: we keep the minimum data needed to sell you scripts, flash them to your device, and stop people from cheating the licence system. We don’t sell data, run third-party tracking pixels, or retain anything longer than we need.

What we collect

• Discord account data: your Discord ID, username, email, and avatar URL, shared by Discord when you sign in via OAuth
• Purchase data: Whop sends us the product you bought, the plan, the timestamps. We don’t see your payment method
• Flash logs: timestamp, your IP, browser user-agent, Zen device ID (not a hardware fingerprint of your PC), script slot. Used to investigate leaks and ban abusers
• Watermark ledger: the 64-bit drift seed issued to your scripts, linked to your Discord ID. This is how we trace leaks
• Server logs: standard Caddy access logs (IP, URL, referrer, UA). Rotated weekly

What we don’t collect

• Google Analytics, Facebook Pixel, Meta Advantage, or any third-party tracking
• Your IP geolocation beyond country level (and only to decide if you see the EU cookie prompt)
• Any data about your gameplay, K/D, ranking. The scripts run on the Zen, not on your console or PC, so we have no access to any of that
• Keystrokes, mouse movement, session replays. Our analytics layer is minimal and custom-built on our servers

How long we keep it

• Purchase / licence data: for the life of your account. If you ask us to delete, we delete within 30 days (legal exceptions: tax records kept 7 years per IRS)
• Flash logs: 90 days
• Watermark ledger: indefinitely (essential to anti-leak enforcement)
• Server logs: 30 days

Who sees your data

• Us (the two-person team): yes
• Whop (our billing processor): they see purchase data by necessity
• Discord (OAuth provider): they see that you signed in, not what you did after
• Nobody else. We don’t run a data sales business.

Your rights

Request deletion, access, or a copy of your data: email support@verascripts.com with "Privacy" in the subject. We respond within 30 days. EU / UK residents have GDPR rights; California residents have CCPA rights; we honour both regardless of residency.

Cookies

We set one essential cookie (vs_session) signed with HMAC to keep you logged in. Expires in 30 days of inactivity. No analytics cookies, no ad cookies, no third-party cookies.

Changes

If we materially change this policy, we post a note in Discord #announcements and update the date above. If you disagree with a change, email us for a data export and deletion.