Privacy Policy

1. Who is responsible

[LEGAL ENTITY NAME] (ABN [ABN]) of [BUSINESS ADDRESS] is responsible for the personal information described here. Contact us at [CONTACT EMAIL].

We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

2. What we collect

From your Discord sign-in: your Discord user ID, username, avatar URL, and the email address associated with your Discord account.

When you use the site: your IP address, browser user-agent string, and the time of each significant action (signing in, redeeming a key, placing an order, admin actions).

When you buy: your order details, the reference code, and the licence keys issued to you.

Your Macho Authentication Key: the identifier you choose, which is stored against your account permanently.

We do not collect or store payment card numbers. Payment is arranged separately and no card data passes through this site.

3. Why we collect it

• To create and run your account, and to sign you in.
• To issue licence keys and bind them to you, which is what stops key sharing and resale.
• To provide support and answer questions about your orders.
• To detect and investigate fraud, key sharing, and abuse of the licensing system.
• To keep security and audit records, which we are entitled to keep to protect the service.

4. The audit log

Significant actions are recorded in an audit log with a timestamp, the account involved, and the IP address the action came from. These records are also mirrored to a private channel in our Discord server that only administrators can read.

Licence keys are masked in these records — only the last part of a key is stored — and secrets, tokens and passwords are never written to them.

5. Who we share it with

We share personal information only:

• with Discord, because signing in and receiving your key by direct message requires it;
• with our hosting and infrastructure providers, who store data on our behalf;
• where we are required or permitted by law;
• where you ask us to.

We do not sell personal information, and we do not use it for advertising.

6. Where it is stored

Data is stored on servers operated by our hosting provider. Depending on the provider’s region this may be outside Australia. Where information is disclosed overseas we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

7. How long we keep it

• Account records: while your account exists, and for a reasonable period afterwards.
• Order and licence records: for at least seven years, to meet record-keeping and tax obligations.
• Security and audit records: for as long as they remain useful for detecting and investigating abuse.

8. Cookies

We use cookies that are necessary for the site to work:

• a session cookie, so you stay signed in;
• a CSRF token, to protect forms from cross-site abuse;
• a theme preference, remembering light or dark mode.

We do not use advertising or third-party tracking cookies.

9. Security

We use HTTPS, store secrets outside the codebase, hash and mask sensitive values, rate-limit sensitive endpoints, and restrict administrative access. No system is perfectly secure, but we take reasonable steps to protect your information.

10. Your rights

You can ask us to access the personal information we hold about you, correct it if it is wrong, or delete your account. Contact [CONTACT EMAIL].

Some information cannot be deleted on request — in particular order records we must keep for tax purposes, and audit records needed to protect the service against fraud.

If you are not satisfied with how we handle a privacy complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

11. Children

This service is not intended for anyone under 16, and we do not knowingly collect their personal information.

12. Changes

We may update this policy. The “last updated” date shows when it last changed.