Privacy Policy

This policy describes what hooked.ac actually collects, why, who else touches it, and what you can do about it. It is written against the running code rather than from a template.

Who we are

hooked.ac operates this site and the member portal, and is the controller of the data below. For access, correction, objection or a complaint, email support@hooked.ac or open a ticket from the portal. For account or data deletion, email business@hooked.ac. That one is handled by hand rather than by a button. If you are in the EU/EEA or UK you also have the right to complain to your national data protection authority.

What we collect

• Account: username, password (stored only as a salted PBKDF2 hash with a server-side pepper, never in plain text), and an email address. Registration requires one: we send a six-digit confirmation code to it, and your licence stays locked until you enter that code. Accounts made before we required an address still have none and keep working; on those, a linked Discord account's address stands in as the place the code goes.
• Profile, if you set it: display name, "about me", theme colour, and your choice of profile picture and banner.
• Security: your IP address and browser user-agent at sign-up, sign-in and other significant actions; session records; your two-factor secret and backup codes if you enable 2FA; and an append-only audit log of privileged actions. Where Cloudflare tells us, we also store the country and network (ASN) an IP belongs to.
• Licences: your licence keys, their status and expiry, the hardware identifier (HWID) a key is bound to, and the last IP that used it.
• Things you write: support tickets and their messages, forum threads and posts, chat messages and reactions. Email you send to business@hooked.ac is stored as well: the sender, the subject and the plain-text body, so staff can read it and reply. The HTML version of a message is never kept.
• Discord, only if you link it: your Discord user ID, username, avatar reference and, when Discord reports the address as verified, the email address on your Discord account. That address is what we send your confirmation code to if your account has no other. Your Discord roles are read live from Discord when needed and are not stored. Your Discord ID is never published: profile pictures are streamed through our own server precisely so that the CDN URL, which contains that ID, never reaches another visitor.
• Purchases: the email address used at checkout, the amount, and the payment platform's reference for the order. We never see or store card numbers.
• Consent records: which choices you made, when, against which version of this policy, plus the IP and user-agent that made them. This is the evidence that the consent was given, so it is kept even after an account is deleted.

We do not run analytics, advertising, tracking pixels, profiling or automated decision-making, and we do not sell or rent data to anyone.

Why, and on what legal basis

• Contract: running your account, delivering and managing licences, and answering support.
• Legitimate interests: keeping the service secure (rate limiting, bot checks, IP and audit logging, fraud and licence-sharing prevention). We keep these records minimal and never use them for marketing.
• Consent: the optional checkout script covered by the cookie banner, and the optional product-news email you can tick at registration. Both can be withdrawn at any time, in the ways set out under Your rights below, and withdrawing changes nothing else about your account. It does not stop the messages we owe you either way: your key, a reply to your ticket, a notice about your licence.
• Legal obligation: keeping records we are required to keep, such as those relating to payments.

Who processes it

• Cloudflare: hosting (Workers), our database (D1), CDN, DNS and network security, request logs, and the Turnstile bot check shown on the sign-in and registration forms. Turnstile receives your IP and a challenge token when you use those forms. Cloudflare also carries our email both ways. Everything we send you goes out through Cloudflare Email Sending: your licence key, your confirmation code, the welcome note, account and moderation notices, and product news if you asked for it. Everything you send to business@hooked.ac comes in through Cloudflare Email Routing, which hands it to a worker of ours that files it in the same database.
• SellStein: the checkout. Their embedded checkout script loads on our product pages only if you accept it in the cookie banner; if you decline, the buy buttons take you to SellStein's own hosted checkout page instead. Either way, what you type at checkout goes to SellStein, and they notify us of the order.
• KeyAuth: licence keys and loader accounts. Your loader username, your licence key, the HWID it binds to and the IP that activated it are processed there. Your loader account is a separate account in KeyAuth's system, not a copy of ours.
• Discord: only if you choose to link your Discord account or use "Continue with Discord". We request two scopes, identify and email, and nothing else.

These providers operate outside the EU/EEA, so some data is transferred internationally under their standard contractual clauses. Email is no exception: there is no separate mail company in the picture, because the messages we send you and the messages you send us both pass through Cloudflare.

Cookies

Strictly necessary, always on. hooked_session keeps you signedin (HttpOnly, so scripts cannot read it); four short-lived hooked_discord_* cookies exist only for the ten minutes of a Discord link; hac_consent remembers the answer you give below, for six months. Cloudflare may also set its own cookies when it challenges a request, as part of protecting the site.

Optional, off until you say yes. The only non-essential thing this site loads is SellStein's checkout script. Until you accept, the tag is not put on the page at all: nothing is requested from them and no cookie of theirs can be set. Declining is one click, exactly like accepting, and costs you nothing but the in-page checkout window.

How long we keep it

• Account, profile, licence and support records: while your account exists.
• Sessions expire after 30 days; password-reset tokens after 1 hour; the six-digit email confirmation code after 15 minutes.
• Security records (IP log, audit log, security events) are kept while the account exists and are removed with it, except the audit entries that record an action was taken: those keep only an internal identifier, not your name or address. We do not currently run an automatic purge on these; we would rather say so than claim a schedule we do not have.
• Consent records outlive the account on purpose. When an account is deleted the link to it is removed, leaving a dated record that a consent was given, with no name attached.

Your rights

• Get a copy. Account → Your data → Export my data gives you a JSON file of everything on your account, immediately and without asking anyone.
• Delete it. Email business@hooked.ac from the address on your account, saying whether you want the whole account removed or only specific data. We action it by hand: there is no self-service delete button, so nobody loses an account to a mis-click or a borrowed session. Expect a reply within 30 days, the statutory limit.
• What deletion does and does not reach. Your posts stay up with your name removed, so conversations other members took part in are not gutted. Consent records survive with the link to you removed: a dated record that a consent was given, with no name attached, because that record is itself the proof we are obliged to keep. Your KeyAuth loader account and the licence key live in an external system and are your proof of purchase; say in the same email if you want those gone too, and be aware that removing them voids the licence.
• Correct it. Most of it is editable on the account page; for the rest, contact support.
• Withdraw consent: the control above for cookies, and the marketing preference by contacting support until an unsubscribe link exists to point you at.
• Object or restrict, and complain to your data protection authority.

Security

Everything is served over HTTPS with a strict Content-Security-Policy and a per-request nonce. Passwords are stored as PBKDF2 hashes with a server-side pepper that never touches the database, so a database copy alone is not enough to sign in as you. Session cookies hold an opaque token; only its SHA-256 is stored, so the same is true there. Two-factor authentication is available and privileged actions are audit-logged. No system is perfect, and we will tell you if something goes wrong that affects you.

Children

This service is not intended for anyone under 16. We do not knowingly collect data from children; if you believe we have, contact us and we will remove it.

Changes

Material changes bump the version shown at the top of this page. When that happens the cookie banner asks again rather than assuming your previous answer still applies, and every consent we hold records the version it was given against.