Privacy Policy

BadPing is responsible for the personal data described here. For anything on this page, write to [email protected].

This policy covers our website, our loader and the accounts behind them. It does not cover the games you play or any third-party site we link to.

Account data — your username, email address and a hashed password. If you sign in with a passkey or enable two-factor authentication, we store the credential or secret needed to verify it. We never store your password in readable form.

Order data — the email address you enter at checkout, what you bought, the amount, the currency, how you paid and the status of the payment, with the payment provider's reference for it. For crypto payments that includes the coin and amount sent. Card numbers go straight to Stripe and never reach us, and we never have access to your wallet.

License data — the keys on your account, when they were redeemed, when they expire, and the hardware identifier a key is locked to.

Technical data — IP address, country, browser or loader user agent, and the time of each login. We keep a login history so you can spot access you do not recognize.

Usage data — which product was launched and when, and errors reported by the loader, so we can tell whether a build is working.

Support data — whatever you send us by email, on Discord or through the live chat when you ask for help.

• To create and secure your account, and to sign you in.
• To take payment, deliver your key and keep a record of the sale, including for tax and accounting.
• To enforce the hardware lock and stop keys being shared or resold.
• To detect fraud, chargeback abuse, bans and attacks on our systems.
• To fix bugs, monitor whether builds are healthy and improve the products.
• To answer support requests and send service notices such as maintenance and key delivery.

Where the law requires a legal basis, we rely on performing our contract with you (account, delivery, licensing), our legitimate interests (security, anti-fraud, improving the products), our legal obligations (accounting records), and your consent for analytics and live chat, which you can withdraw at any time.

• We do not sell your personal data.
• We do not read the contents of your files, your messages or your game accounts.
• We do not send marketing email unless you asked for it; service emails about your orders and licenses are not marketing.

Only the providers we need to run the service, and only what they need:

• Stripe — to take card payments and handle refunds and disputes. Stripe receives your email address, what you bought and its price, and your card and billing details, which it uses to prevent fraud and acts as its own controller for.
• VeliraPay — to take crypto payments and issue refunds. They receive what you bought, its price, your email address and, when your account has one, your name. If you open their payment page, they also record the IP address and browser you use there and anything you enter on it. They act as their own controller for that data.
• Cloudflare — to serve the site and keep bots and attacks out. Every request passes through Cloudflare, which sees your IP address and browser details and sets a few security cookies.
• Hosting and storage providers — to run the site and store builds.
• Email provider — to deliver your keys and account notices.
• Google Analytics — only if you allow analytics: which pages are visited, from which kind of device and browser, and roughly from where. Addresses that carry personal or secret details, such as password reset links, are never sent, and advertising features are switched off.
• Crisp — only if you turn on live chat: your messages, the page you write from, your browser details and, when you are signed in, your email address and username, so support knows who they are talking to.
• Discord — when you contact us there. Discord handles that conversation under its own privacy policy.

We also disclose data where the law requires it, or where it is necessary to protect our rights, our customers or our systems.

Our providers operate servers in several countries, so your data may be processed outside the country you live in. Where that involves a transfer out of the EEA or the UK, it is covered by standard contractual clauses or an equivalent safeguard.

• Account and license data: while your account exists, and for 24 months after it goes inactive.
• Order and payment records: as long as tax and accounting law requires, usually longer than your account.
• Login and technical logs: a rolling window, typically no more than 12 months.
• Support conversations: until they are resolved and long enough afterwards to handle follow-ups.

Records tied to fraud, chargebacks or bans are kept for as long as needed to stop the same abuse recurring.

Passwords are hashed, traffic is encrypted in transit, access to production data is limited to staff who need it, and two-factor authentication and passkeys are available on your account. No system is perfectly secure, so use a unique password and turn on two-factor authentication.

Depending on where you live, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete your account and the data we are not required to keep;
• restrict or object to a particular use;
• export your data in a portable format;
• withdraw consent where we relied on it.

Email [email protected] from the address on your account and we will respond within 30 days. You can also complain to your local data protection authority.

The first time you visit, we ask before setting anything optional. Necessary cookies are always on, because the site cannot work without them; analytics and live chat stay off until you allow them. Change your mind at any time with Cookie settings at the bottom of every page, and anything you switch off is deleted from your browser. We do not use advertising cookies.

Card payments finish on Stripe's payment page, and crypto payments can use VeliraPay's. Each sets the cookies it needs to process the payment and prevent fraud under its own policy.

Our services are not for children. We do not knowingly collect data from anyone under the minimum age in our Terms of Service, and we delete such accounts when we find them.

We update this policy when what we do with data changes. The effective date at the top of the page shows the current version, and material changes are announced on our Discord.

Email [email protected], or reach our staff on the BadPing Discord.