ShaiyaPrivacy Policy
Effective 2026-05-28 · Version 1.0
1. Who controls your data
The data controller is loaded11, operator of Shaiya Bot.
Contact via Discord at loaded11 or in our
Discord server.
Servers are hosted by Hetzner Online GmbH in Germany.
2. What we collect
| Data | Purpose | Source | Retention |
|---|---|---|---|
| License key | Identify your subscription, enforce single-PC use | Generated server-side at purchase | Life of license + 12 months |
| HWID hash (SHA-256) | Bind license to one PC | Computed locally, sent at activation; we never see raw HWID | Until rebind / license deleted |
| In-game username + Shaiya server | Show "who's online" on the admin panel for support | Sent on login + heartbeat | Most-recent value only (overwritten) |
| Bot version + session timestamps | Detect stale sessions, debug version-specific issues | Sent on login + heartbeat | Session lifetime + 90s stale window |
| IP address (auth server access) | Audit logs (login attempts, rebinds, etc.) | Server-side from network connection | 30 days in access logs, then rotated |
| Email address (buyer) | License delivery + support contact | Provided to Whop at checkout | Life of license + 24 months for tax records |
| Telemetry events (opt-in) | Aggregate usage patterns, crash detection | Bot sends if you enabled telemetry — OFF by default | 30 days, anonymised after 7 |
3. What we never collect
- Your Shaiya account password. The bot encrypts it locally with Windows DPAPI (tied to your Windows user account). It's stored on your machine; the cipher cannot be decrypted on any other PC.
- Raw HWID values. Only the SHA-256 hash (mixed with our server salt) ever leaves your PC.
- Game memory contents. The bot reads game memory only to see your own HP/MP/SP/position values — that data stays local and is never transmitted.
- Screenshots, screen recordings, keystrokes. None.
- Browsing history, files, or anything outside the game process. None.
4. Payment data
Payments are processed by Whop (via Stripe). We never see your card details. Whop shares with us:
- Buyer email
- Order ID + amount paid
- Subscription status (active / cancelled / refunded)
Whop has its own privacy policy at whop.com/privacy; Stripe's is at stripe.com/privacy. Both are GDPR-compliant.
5. Cookies & tracking on shaiyabot.com
The marketing site uses Cloudflare Web Analytics — a privacy-friendly visitor counter. No cookies are set, no cross-site tracking, no IP addresses logged. We see aggregate counts (pageviews, top countries, browser/device stats) only.
There are no advertising cookies, no Facebook pixel, no Google Analytics. We don't use Discord embeds, Twitter widgets, or any other third-party tracking script.
6. Who we share data with
Only with the providers needed to deliver the service:
- Whop — payment processing, license delivery emails
- Hetzner — server hosting (EU/Germany)
- Backblaze B2 — encrypted nightly database backups (EU)
- Cloudflare — DNS + TLS for the website + auth server
We do not sell, rent, or trade your data with anyone else. Law-enforcement requests are handled per the relevant jurisdiction (Germany / EU); we comply when legally required and notify you when permitted to.
7. Your rights (GDPR)
If you're in the EU/EEA/UK, you have the right to:
- Access the data we hold about you
- Correct inaccurate data
- Delete your account + associated data ("right to be forgotten")
- Export your data in a portable format
- Object to processing or withdraw consent (telemetry)
To exercise any of these, open a ticket in our
Discord
or DM loaded11. We respond within 7 days. Note that
deleting your data also voids your license — we keep order records
in tax-compliant accounting form for the legally-required
retention period regardless.
8. Children
Shaiya Bot is not directed at children under 16. If you're under 16 in the EU (or under whatever age applies in your country), do not purchase or use the bot.
9. Changes to this policy
We may update this policy over time. Material changes will be announced on our Discord server. Continued use of the bot after a change means you accept the updated policy.
10. Contact
All privacy questions, data requests, complaints, or corrections —
DM loaded11 on Discord or open a ticket in our
Discord server.