Privacy Policy

What we collect, why we collect it, and how long we keep it.

What we collect

  • Your email — for verification, license delivery, and password resets.
  • A password hash — PBKDF2-SHA256 with a per-user random salt. We never store your plaintext password and cannot recover it if you forget it.
  • Your hardware identifier (HWID) — derived by the loader on first boot; used only to lock your license to one machine at a time.
  • Your session cookie (hax_ses) — 32 bytes of random data, sent with every request while signed in.
  • Your currency preference (hax_cur) — a 3-letter code so prices show in USD/EUR/GBP without asking every time.
  • Payment metadata — handled by Fungies, our payment processor. We do not see card numbers.

Why we collect it

  • Authentication (sign you in).
  • License management (know which key belongs to which HWID).
  • Fraud prevention (spot shared or leaked keys).
  • Email delivery (verify you own the address; send you a password reset).

How long we keep it

  • Account data: for the life of your account. Deleted on request.
  • Session cookies: 30 days from your last sign-in on this device.
  • Verify and reset tokens: 24 hours (verify) / 1 hour (reset). Deleted the moment they’re used.
  • Payment records: as long as Fungies is legally required to hold them (typically 5–7 years for tax law).

Who else touches your data

  • Brevo — transactional email delivery (verify and reset emails). GDPR-compliant.
  • Fungies — payment processing. GDPR-compliant.
  • Cloudflare — hosting, DDoS protection, and the D1 database that stores your account row.

Your rights

  • Access: request a copy of everything we hold on you.
  • Delete: request full account deletion. Irreversible.
  • Export: request a portable JSON dump.
  • Correction: update your email or password anytime from your account page.

Email contact@mw4-hacks.com for any of the above; response within 30 days.

Cookies

Two cookies only:

  • hax_ses — session identifier. HttpOnly, Secure, SameSite=Lax, 30-day max-age.
  • hax_cur — currency preference. 30-day max-age.

We don’t use tracking pixels, analytics beacons, or third-party advertising cookies.

Contact

Privacy inquiries: contact@mw4-hacks.com.

Last updated: 22 August 2026.