Privacy Policy

This policy explains what personal data we collect, why we collect it, how long we keep it and what rights you have over it. We collect as little as the service can work with.

1. Who is responsible

The data controller is NautiForge, EU. For any privacy question, contact us via discord.

2. What we collect

Data you give us

• Email address — needed to create an account, log in, and contact you about the service.
• Password — stored only as a bcrypt hash. We cannot read your password and could not tell it to you if asked.

Data created by using the service

• Account timestamps — when the account was created and when it last logged in.
• Licence information — which licence you hold, its key and its expiry date.
• Server logs — our web server records IP address, timestamp, requested page and browser user-agent, as web servers do.
• Failed login counters — to limit brute-force attempts we count recent attempts per network address. The address is stored as a one-way hash, not in readable form, and the counter is discarded after ten minutes.
• Your PC specifications

What we do not collect

• No card or bank details ever reach our servers — payments are processed entirely by our payment provider.
• No advertising or analytics trackers.

3. Cookies

We use exactly one cookie, nautiforge_sess. It holds a random session identifier so the site knows you are logged in. It contains no personal data, is marked HttpOnly, Secure and SameSite=Strict, and it expires when you close your browser.

It is strictly necessary for the service to function, so under the EU ePrivacy rules it does not require consent. We set no analytics, advertising or third-party cookies, which is why you see no cookie banner.

4. How we use this information

• For the purpose of making you a registered member
• We may use your email adress to inform you of activity on our site
• Your PC specifications may be used to link our products

5. Security

All traffic runs over HTTPS. Passwords are stored as bcrypt hashes with a per-password salt. Database access is restricted to the minimum privileges the application needs. Session identifiers are regenerated on login to prevent session fixation.

No system is perfectly secure. If a breach ever affects your rights and freedoms, we will notify you and the supervisory authority as the GDPR requires.

6. Acceptance of this policy

Continued use of our site signifies your acceptance of this policy. If you do not accept the policy thebn please do not use this site.

7. Changes

If we change this policy materially, you may be asked to review and re-accept the information that we collect. The date at the top always shows the current version.