Privacy Policy

We collect the minimum data necessary to provide and improve our Service:

Account Information (via Discord OAuth)

• Discord user ID
• Discord username
• Discord avatar URL

We do not request access to your email address, friend list, or Discord messages.

Purchase Information

• Order ID, product purchased, tier, and amount paid
• Email address (provided to SellAuth at time of purchase)
• Country code (from payment provider)
• Date of purchase

Service Usage Data

• Account generation history (type, count, timestamps)
• Generated account details (usernames, passwords, display names, avatar URLs)
• Cooldown timers and usage counts
• Rewards activity (daily logins, achievements, referrals, tier changes)

User Settings (Optional)

• Display preferences (theme, items per page, auto-copy, show passwords)
• Notification preferences
• Webhook URL (if configured)
• Privacy preferences (e.g., data encryption toggle)

Data You Voluntarily Provide

• Roblox security cookies (if using the cookie checker feature) — validated in real time and may be stored with your generated accounts
• Notes added to generated accounts

• Discord OAuth: When you log in, Discord provides your user ID, username, and avatar. No additional permissions are requested.
• SellAuth Webhooks: When you make a purchase, our payment provider (SellAuth) sends order details to our server via authenticated webhooks.
• Cloudflare Turnstile: Bot verification may process your IP address through Cloudflare to validate requests. We do not store your IP address.
• Analytics: We use Google Analytics and Vercel Analytics to collect anonymized usage data such as page views, feature usage, and session duration. User tier may be associated with analytics events.
• Direct Input: Any data you enter into the dashboard (settings, notes, cookies) is collected when you submit it.

• Authenticate you and manage your session
• Determine your tier and feature access
• Deliver purchased products and upgrades
• Enforce rate limits, cooldowns, and usage quotas
• Store and display your generated accounts and history
• Power the rewards, referral, and achievement systems
• Persist your preferences and dashboard settings
• Improve the Service through aggregated analytics
• Detect and prevent abuse, fraud, and unauthorized access

We integrate with the following third-party services, each with their own privacy policies:

• We do not sell your personal data to any third party.
• We do not share your data with third parties except as necessary to operate the Service (e.g., Discord for authentication, SellAuth for payment processing).
• We may disclose data if required by law, legal process, or to protect the rights and safety of AltGenator and its users.
• Aggregated, anonymized data (which cannot identify you) may be used for analytics and service improvement.

We use the following browser storage mechanisms:

• Session Cookies: HTTP-only cookies (user_session and auth_token) to maintain your authenticated session. These expire after 7 days.
• Analytics Cookies: Google Analytics may set cookies to track anonymized usage patterns.
• Cloudflare Cookies: Cloudflare may set cookies for bot protection and performance optimization.

You can manage or delete cookies through your browser settings. Disabling session cookies will prevent you from logging into the dashboard.

• Authentication tokens (JWTs) are signed and validated on every request. Session cookies are HTTP-only to prevent client-side access.
• Payment webhooks are verified using HMAC signatures to ensure authenticity.
• Cloudflare Turnstile is used on sensitive endpoints to prevent automated abuse.
• The dashboard offers an optional data encryption setting for additional privacy.
• While we take reasonable measures to protect your data, no system is 100% secure. We cannot guarantee absolute security of data transmitted over the internet.

• Account data (Discord ID, username, avatar) is retained for as long as you use the Service.
• Generated account data and usage history are retained until you delete them or your account is terminated.
• Purchase records are retained for as long as needed for verification and dispute resolution.
• Cooldown and session data expires automatically based on their configured time-to-live values.
• If your account is terminated, we may delete your data at our discretion.

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your personal data. You can delete your generated accounts directly from the dashboard, or contact us for full account data removal.
• Portability: Request your data in a portable format.
• Opt-out: Manage your privacy settings from the dashboard settings page, including the data encryption toggle.

To exercise these rights, contact us through Discord or email. We will respond to requests within a reasonable timeframe.

• We may update this Privacy Policy from time to time.
• Material changes will be communicated through our Discord server or dashboard. The "Last Updated" date at the top of this page reflects the most recent revision.
• Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or want to exercise your data rights, contact us through our Discord server or by emailing support@altgenator.com.