Privacy Policyyour data/and what we do with it

1. What we collect

Only what the service needs to work:

• Account: your username, and your password stored only as a salted hash. We never know your password itself.
• License: your key, when it was activated and when it ends.
• Device: a fingerprint computed from an identifier of your Windows installation, used to tie a key to one computer. It cannot be turned back into the original identifier.
• Connections: IP address, date and time, version of the program and outcome of each sign-in.
• Usage: number of attacks, gold and elixir earned, walls upgraded, time in use.
• Payments: the order (plan, amount, date, IP address, username if you give one) and the transaction hash you paste. A blockchain transaction is public by nature: it shows the sending address, ours and the amount.
• Website: like any web server, ours keeps technical logs (IP address, page requested, date).

2. What we do not collect

• your Supercell ID or your game password: the program never asks for them;
• the content of your screen or your files: the captures the program takes of the emulator stay on your computer;
• card or bank details: payments are cryptocurrency transfers and never pass through us;
• tracking cookies, analytics or advertising: the website uses none. Your choice of language is kept in your own browser and is not sent to us.

3. How we use it

• to deliver the service: sign you in, check your license, show your statistics, deliver what you paid for;
• to keep it secure: prevent key sharing, detect fraud, abuse and intrusion attempts;
• to support you when you contact us;
• to improve the software, using figures that do not single you out;
• to comply with the law when it requires it.

We do not sell your data and we do not use it for advertising.

4. Legal bases (GDPR)

If you are in the European Economic Area or the United Kingdom, we rely on:

• performance of the contract: what is needed to provide Broke Bot to you;
• our legitimate interests: security, prevention of abuse and improvement of the product, where your rights do not override them;
• legal obligation, where the law requires us to keep or disclose something.

5. Who we share it with

• Our hosting providers, for technical operation: Cloudflare, which protects and delivers the pages of the website, and Zeabur, on Tencent Cloud servers in Frankfurt, Germany, for accounts and licenses.
• Public blockchain and price services (TronGrid, Litecoin Space, CoinGecko), which our server asks to check a payment. They receive a transaction hash or our own address, never your identity.
• Discord, if you contact us there: your messages are handled under Discord's own policy.
• Authorities, when the law compels us.

Nobody else. If the project were ever handed over to someone else, your data would move with it under this same policy, and you would be told.

The website shows totals across all users (gold and elixir looted, walls upgraded, hours of use). They are sums and say nothing about any one user.

6. How long we keep it

Account, license and usage data are kept while your account exists and for up to 12 months after your last key ends. Connection logs and payment records are kept for up to 12 months, longer where the law requires. Backups are overwritten within 30 days. After that, data is deleted or made anonymous.

7. Security

Traffic between the program, the website and our servers is encrypted (TLS). Passwords are hashed. Requests are rate-limited. Each update of the program is signed and verified before it is installed. No system is perfectly secure: keep your password and your key to yourself.

8. Your rights

Depending on where you live, you can ask us to:

• give you a copy of the data we hold about you;
• correct what is inaccurate;
• delete your data, unless the law requires us to keep it. Deleting your account ends your access to the software;
• give it to you in a structured, machine-readable form;
• restrict or stop a use of it that rests on our legitimate interests.

Write to [email protected]. We answer within 30 days. If you are in the EEA or the UK, you may also complain to your data protection authority.

9. International transfers

Your data is stored on a server located in Frankfurt, Germany, inside the European Union. The public services named above, and Discord if you contact us there, may process what they receive in other countries, whose data protection laws may differ.

10. Children

Broke Bot is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

11. Changes

We may update this policy. The date at the top of the page shows the latest version.

12. Contact

Questions about your data: [email protected].