Privacy Policy

• Account: email address, username, and (if linked) Discord ID and Discord username.
• Orders: order ID, plan purchased, status (paid / refunded / revoked), the email you enter at checkout, and the license key we issue for your account. For crypto payments we also record the coin, the amount and the transaction ID — information that is already public on the blockchain.
• Support & reviews: the reason you give when requesting a key reset, and any review you choose to post.
• Error reports: if a page crashes, the error message, the page address and your browser type, so we can fix it.
• Session: an HMAC-signed, httpOnly session cookie (spiritx_session) with a short-lived expiry.
• Admin: an admin gate cookie (spiritx_admin_gate) that is only set for staff accounts.
• OAuth: short-lived cookies used only during a Discord login flow (spiritx_oauth_state, spiritx_oauth_next, spiritx_oauth_verifier).
• Request metadata: IP address at the time of a request, used for rate-limiting and fraud prevention; retained only as long as needed to serve that purpose.
• Discord presence: if the Discord widget is enabled on our server, we display aggregate counts fetched from Discord. We do not store individual presence data.

• Your wallet’s private keys or seed phrase — never ask for or enter them anywhere on this site.
• Credit card numbers or bank details. Card payments, once available, are handled entirely by Mysellauth.
• Your Riot ID, Valorant username, in-game stats, or any game telemetry.
• Keystrokes, screen captures, microphone, or camera data.
• Browsing history outside the SPIRITX website.

• Issue, deliver, verify, and revoke licenses.
• Fulfil orders and handle refund-eligible disputes.
• Provide support in the SPIRITX Discord.
• Prevent fraud, abuse, and automated attacks (rate-limiting, bot detection).
• Produce aggregate, non-identifying operational metrics.

• Public blockchain services (block explorers / RPC providers for Bitcoin, Litecoin and Solana) — used to detect payments. Only our own receiving address is sent to them, never your personal data.
• Email provider — delivers receipts and sign-in links to the address you give us.
• Mysellauth — card payment processing, once card checkout launches. Mysellauth’s own privacy policy applies to card payments.
• Discord — OAuth login, server membership, and (if enabled) admin role sync.
• Netlify — hosting of the SPIRITX website.

We do not sell personal data and we do not share it for advertising.

We use the minimum cookies required to run the Service, listed in §1 above. We do not use third-party advertising cookies. If your browser blocks our cookies, sign-in and checkout flows will not function.

Account and license records are retained for as long as your account exists. Request logs are rotated and retained only as long as needed for fraud prevention. On account deletion, your account record and attached license history are deleted; audit entries related to actions you took may be retained in anonymised form.

You can request export or deletion of your account data by opening a ticket in the SPIRITX Discord. We will respond within a reasonable period and may require reasonable verification that you are the account holder.

The Service is not directed at children. We do not knowingly collect data from anyone under 18.

Passwords are stored as scrypt hashes. Session cookies are HMAC-signed and httpOnly. All connections to the SPIRITX website are served over HTTPS. No system is perfectly secure; you accept this residual risk.

SPIRITX may update this Privacy Policy at any time. The “Last updated” date above is the effective date. Continued use of the Service after an update means acceptance.