Privacy notice

Information we use

MCPlugs stores your display name, email, administrator approval status, identity-provider verification status, sign-in identities and server-managed sessions. Password authentication stores a slow password hash rather than a readable password. If you connect an identity provider, the service receives the profile/identity information required for that connection.

Orders and product access

We record order snapshots, payment provider references, amounts/currencies, entitlements and download requests so we can deliver purchases and investigate problems. Licensed products record a generated installation identifier, user-provided server label and validation times. A changing IP address is not treated as a server identity.

Content and support

We store creator listings, uploaded files, processed images, reviews, favorites, notifications and support conversations. The relevant creator can access conversations and order/access information for their own store. Raw license keys and payment secrets are not exposed to creators.

Service providers

The deployment uses Railway for application hosting and PostgreSQL, S3-compatible object storage for files, and Resend for seller purchase notifications. Account approval and recovery requests are reviewed by administrators; reset links are encrypted until explicitly released after an identity check. Stripe processes payments under its applicable arrangements. The final privacy notice must name the actual providers, processing locations and transfer safeguards before production data is collected.

Cookies and retention

Essential cookies maintain secure sessions and sign-in flows. A device-local preference remembers your chosen color theme. No advertising analytics is included by default. Account deletion revokes sessions and anonymizes the profile. Some order/audit records remain where necessary to preserve customer rights, accounting and security evidence. Exact retention periods and lawful bases must be specified by the operator.

Your choices

Use account settings to manage connected identities, revoke sessions or request account deletion. Contact the operator for access, correction, portability or other applicable data rights. Controller identity, privacy contact, supervisory authority and the final retention schedule remain required owner inputs.