This policy explains what PeekCheats (“we”) collects on peekcheats.com, why, and how you control it. The short version: we collect the minimum needed to sell you a license key and support it afterwards. We run no advertising trackers and no analytics cookies, and we never sell your data.
1. What we collect
Provided by you
- Account — email address, a salted bcrypt hash of your password (never the password itself), an optional display name, and sign-in timestamps. An account is optional: purchases, downloads and HWID resets work without one.
- Sign-in with Discord or Google — if you choose one, the provider sends us your verified email, your name and your avatar URL, and nothing else (Discord scopes:
identify email). We never see your password for those services and cannot act on your behalf there. - Orders — the email you enter at checkout, the items and prices, and the payment details: the receiving address, the expected amount and the transaction ID once it confirms.
- Support messages — whatever you send through the contact form, with the email you provide there.
- Status alerts — your email, only if you subscribe. Every alert carries an unsubscribe link.
Collected automatically
- Order IP address — the IP an order is placed from, kept for fraud prevention.
- Session cookie — set only when you sign in. See the Cookie Policy for the full list.
- Bot check — sign-in, registration and password-reset forms run Cloudflare Turnstile, which processes your IP and browser signals to tell people from bots, under Cloudflare’s privacy policy.
- License state — whether a key is activated, when it expires and how many HWID resets it used. We don’t collect hardware identifiers on the Site; binding happens inside the loader.
2. What we deliberately don’t collect
- No card numbers, CVVs or bank details — we accept cryptocurrency only, so that data never exists on our side.
- No advertising or analytics cookies, no Facebook/TikTok pixels, no session-replay recorders.
- No wallet credentials. We only see the public transaction that pays an order.
3. How we use it
- Process orders and deliver license keys.
- Authenticate you and protect your account.
- Detect and prevent fraud and abuse (rate limits, order IP, bot checks).
- Send transactional email — your keys and password resets. Status alerts only if you opted in.
- Answer support requests.
4. Who processes it for us
The list is short, and each party sees only what its job requires:
| Processor | Job | Sees |
|---|---|---|
| Vercel | Hosts the website | Traffic to the Site |
| Supabase | Hosts the database | Accounts, orders, licenses |
| Cloudflare | Bot protection on auth forms | IP and browser signals |
| Brevo | Sends transactional email | Your email and the message |
| Discord / Google | Sign-in, only if you choose it | That you authorized us |
We do not sell personal data, and we share it with authorities only when compelled by valid legal process.
5. Crypto & the blockchain
Payments settle on public blockchains. A transaction you send is public, permanent and outside anyone’s control — we cannot edit or delete on-chain data, for you or for ourselves. We never connect your wallet address to your identity beyond matching a payment to its order.
6. How long we keep it
- Account data: until you ask for deletion.
- Order and license records: for as long as the license could need support, then for basic bookkeeping and fraud prevention.
- Password-reset links: 30 minutes, single use, stored only as SHA-256 hashes.
7. Your rights
Wherever you live, we honor the same set of requests:
- See a copy of the data we hold on you.
- Correct it, or delete it (deletion doesn’t revoke keys already issued to you).
- Object to a use of it, or withdraw a consent you gave.
Send any of these through the contact page from the email on the account, so we can confirm it’s you. If you are in the EEA or UK you can also complain to your data-protection authority.
8. Security
TLS everywhere, bcrypt password hashing, single-use hashed reset tokens, rate limits on every auth endpoint, and least-privilege access to the database. No system is perfect: if a breach ever affects your data, we will tell you what happened and what was taken, promptly and plainly.
9. Children
The Site is for adults and is not directed at minors. If you believe a child has provided personal data, contact us and we will delete it.
10. Changes
When our practices change, this page changes with them and the date at the top moves. Questions go to support.