Privacy Policy

What we collect

The minimum required to deliver and protect the product:

• Account: the email address you register with and (if you link it) your Discord ID.
• Hardware ID (HWID): a derived fingerprint of the machine running the loader, used to bind your key to one set of hardware and to enforce HWID-reset cooldowns.
• Payments: for crypto, the public transaction id and the wallet you paid from. For PayPal, the transaction reference from the merchant who processed it (we don't receive your PayPal login or card details). Retained for billing reconciliation and dispute protection.
• Operational logs: server-side request logs (IP, user-agent, timestamp) retained no longer than 30 days for abuse and fraud prevention.
• Optional analytics: if you accept analytics cookies via the cookie banner, we load Google Analytics 4 (measurement ID configured for whyper.ac) under Google Consent Mode. Until you Accept, analytics_storage stays denied and the Analytics script is not loaded. After Accept, Analytics may record: SPA page views (path, page title, and URL), product or game hub views when you open those pages, traffic source or referrer when the browser provides it, and standard UTM campaign parameters from the URL when present (utm_source, utm_medium, utm_campaign, utm_content, utm_term). Approximate region and device or browser details may also be available through Google Analytics. We do not use advertising, remarketing, or ad personalization cookies on this site.

What we don't collect

• No KYC. No legal name, no government ID, no address.
• No advertising, remarketing, or ad personalization cookies. Optional Google Analytics runs only after you opt in on the cookie banner.
• No telemetry from the loader beyond what is needed to enforce HWID binding and serve updates.
• No game-side data, chat, or screenshots.

How long we keep it

Account data is kept while your account exists. Payment records are retained for as long as required to handle billing disputes (a minimum of 12 months from the transaction). Operational request logs are rotated at 30 days. You can delete your account from the dashboard, which removes account data and unbinds active keys; we retain payment transaction records as required for accounting.

Who we share it with

We don't sell data. Limited disclosure is made only to:

• Infrastructure providers strictly required to deliver the product (hosting, content delivery, transactional email). These see request-level data, never your payment data.
• Google Analytics (Google Ireland / Google LLC), only if you accepted analytics cookies. We use Consent Mode so analytics_storage stays denied until you Accept.
• Crypto on-chain data (public by design) is observable by anyone on the relevant chain. Whyper records only the transaction id and paying address.
• Legal compulsion: if a valid legal order from a jurisdiction we are subject to demands disclosure, we comply with the minimum data required and notify the affected user where the order permits.

Cookies

Essential: first-party cookies and similar storage needed for site function (for example login and session). These still apply if you reject analytics and are not used for advertising.

Analytics (optional): Google Analytics cookies load only after you click Accept on the cookie banner. We use Consent Mode so analytics stays denied until then. Reject keeps analytics denied and does not load those cookies. Your choice is stored in localStorage so the banner does not reappear every visit. You can change it with the control below.

When analytics is accepted, events may include page_view on route changes, product_page_view on catalog game pages, acquisition context (referrer and UTM parameters when available), and registration funnel events that do not include your password or other login secrets.

Your controls

• Cookie preferences: use the button above, or clear site data for whyper.ac, to see the banner again and change Accept / Reject.
• Access & export: request a copy of the account and payment data tied to your email through Discord support.
• Correction: update email or Discord linkage directly in your dashboard.
• Deletion: deleting your account in the dashboard erases account data and unbinds active keys. Payment transaction records are retained per the section above.

Security

Site traffic is HTTPS-only with HSTS preload. Sessions are short-lived and bound to the device that signed in. We don't store plaintext passwords. We don't store payment card data, since we don't accept cards.

Changes

Material changes are announced in the customer Discord at least seven days before they take effect.

Contact

Privacy questions or requests: open a ticket in the customer Discord. Link your account on the Connections page after you have an active subscription.