1. What we collect
From the website
- Email address — you give it to us at checkout. We use it to deliver the Key, send sign-in codes, and answer support requests. Nothing else.
- Authentication cookies — short-lived, HMAC-signed cookies that remember you signed in. These are essential and are not used for tracking. See our cookie consent banner.
- Server logs — standard request logs (IP, user agent, path, status code) kept for at most 30 days for security and debugging. Aggregated and never sold.
From Stripe Checkout
Card details, billing address, and any tax data go directly to Stripe — they never touch our servers. We only receive the Stripe Checkout Session id, the customer email, and the payment status, which we use to mint the right Key for the right buyer.
From the Catalog app
The Catalog app needs to verify your Key against KeyAuth. Doing so sends a minimal payload: your Key, the catalog app version, and a hardware ID used by KeyAuth to detect duplicate activations. We do not currently enable HWID-locking, but the verification call itself is handled by KeyAuth as a sub-processor (see below).
2. What we do NOT collect
- Names, real-world addresses, or phone numbers.
- Card numbers or any payment instrument data.
- Browser fingerprints, third-party advertising cookies, ad IDs.
- Game-time telemetry, achievements, or play history.
3. Sub-processors
To run MaveGames we share the bare minimum with:
- Stripe — payment processing.
- Resend — transactional email (Key delivery, sign-in codes).
- KeyAuth — license issuance and validation.
- GoFile — Catalog app download distribution.
- Vercel — website hosting and serverless functions.
Each sub-processor has its own privacy policy. We do not sell or rent personal data to anyone.
4. Retention
- Key records (email + Key + Stripe session id) are kept for the lifetime of the Key plus 12 months for support.
- Server logs rotate within 30 days.
- Sign-in challenges are stateless — they live only in a 10-minute cookie and are never written to disk.
5. Your rights
Depending on where you live (EU, UK, California, etc.) you may have the right to access, correct, export, or delete your data. To exercise any of these rights, email aileymM191pp@gmail.com with the email address you used at checkout. We process verified requests within 30 days.
6. Children
MaveGames is not directed at children under 16. If you believe a child has given us personal information, contact us and we will delete it.
7. Security
Traffic is served over HTTPS. Sign-in codes are HMAC-signed and short-lived. We do not store passwords. We do, however, run a small operation — we cannot promise unbreakable security, only best practices and prompt reaction. See the Disclaimer.
8. Contact
Privacy questions: aileymM191pp@gmail.com or our Discord.