Privacy Policy

This Privacy Policy explains how SpoofHWID handles personal data when you visit the website, create an account, buy or redeem access, manage a subscription, use referrals or store credit, contact support, or use our licensing and download services.

SpoofHWID operates the Service and is responsible for the processing described here. For privacy questions and rights requests, use Support or [email protected]. Do not include passwords, verification codes, session cookies, full license keys, or full card numbers.

1. The information involved

Accounts and authentication

We handle your email address, website and application usernames, internal account identifiers, account creation and sign-in times, verification and recovery status, sign-in method, and session state. Application credential operations can involve password-derived hashes or the credentials needed to authenticate with the licensing service. Passwords and one-time codes should never be included in support messages.

Verification codes are short-lived and limited-use. The website validates a protected representation of the code. Where an older application account is linked, access or refresh credentials may be used to perform licensing operations; they are not ordinary public profile information.

When you agree to the Terms and acknowledge this Privacy Policy during registration or in your account, we record the verified account identifier, the document versions and cryptographic digests, the time of submission and acceptance, and the acceptance context. Verification lets us associate the record with the account that made the choice. This is evidence of the account agreement, not blanket consent to optional tracking, marketing, or recurring payments.

Licenses and devices

Licensing data can include key identifiers, entitlement types, start and expiry dates, redemption and status records, application account identifiers, reset history, and a device-binding value used to prevent sharing or unauthorized access.

We exchange relevant information with the licensing infrastructure at reseller.tateware.com to verify access, connect application accounts, redeem eligible keys, grant or revoke entitlements, and process authorized resets. The temporary hardware profile applied locally by the Windows client is separate from the website account. It does not make your account anonymous to us or a payment provider.

Purchases, subscriptions, and credit

We record the selected plan, billing model, amount, currency, payment and access states, checkout time, account and email association, and provider identifiers for customers, sessions, subscriptions, invoices, payments, refunds, disputes, and delivery. Subscription records also include billing periods, renewal and cancellation state, and service-notification history.

A purchase retains the applicable legal-document versions and cryptographic digests, together with the acceptance evidence associated with the verified account. We separately record the subscription confirmation, including its price, interval, and disclosure wording, to explain the billing agreement made for that purchase.

Stripe processes payment-method information and can retain payment details needed to collect an authorized subscription renewal. We receive transaction information and references needed to deliver access, manage billing, reconcile payments, and address disputes. We do not receive or store your full card number or security code. Stripe's own privacy information applies to its processing.

Store-credit records include earned, pending, held, reserved, spent, restored, and adjusted amounts and the corresponding order references. These records let us prevent the same credit being spent twice and explain a refund or balance adjustment.

Referrals

A referral link contains a random code associated with the referrer's account. Referral attribution may record that code, a randomly generated visitor identifier protected with an authentication code, the visit time, attribution and expiry times, and the account that later signs in and claims the referral. We do not use a visitor's IP address or email as the referral-cookie identifier.

After an eligible account is attached, we match its qualifying purchase to the referrer for reward calculation, fraud prevention, and refund or dispute adjustments. This creates a private link between the referred account, referrer account, and relevant order. A referrer's customer dashboard shows counts, credit amounts, dates, and labels such as “Referral 001”; it does not show the referred customer's email, license key, card information, or support messages.

Support and service messages

Support records include the subject, messages, account or guest reference, timestamps, conversation state, replies, and any information you choose to send. Read receipts and email-notification state help us avoid repeated alerts. An authorized support adjustment can create an audit record showing what time or entitlement was changed and why.

Email records can include the recipient, message type, provider response, and delivery state. Service emails cover verification, recovery, security, purchases, billing, cancellation, and support. Receiving a service message does not by itself enroll you in unrelated marketing.

Downloads and security

An authenticated download can create a record of the account or application username, time, tracking reference, and file metadata such as filename or digest. Limited download details may be sent to a configured team-notification provider, including Discord.

The website and its infrastructure can process IP addresses, request times, URLs, methods, response states, user agents, referring pages, proxy/network signals, rate-limit events, security-rule results, and errors. These records help protect the Service and investigate access, delivery, and payment problems.

Some fonts and interface assets are served by external content-delivery providers. They receive ordinary request metadata when your browser requests an asset. Referral attribution described above is separate from essential sign-in and support operations.

2. Purposes and legal bases

Where data-protection law requires a legal basis, the relevant purpose determines the basis:

Purpose	Basis relied on where applicable
Create and authenticate accounts; supply purchased access; manage requested billing and support	Performance of our contract with you or steps you request before purchase
Deliver verification, security, purchase, renewal, and cancellation messages	Contract, or legitimate interests in reliable and secure service, as appropriate
Operate requested referrals and store-credit accounting	Contract for the requested program features; consent for optional attribution technology where required
Prevent sharing, payment fraud, attacks, referral abuse, or unauthorized downloads	Legitimate interests in protecting customers and the Service, balanced against individual rights
Keep transaction evidence and resolve complaints or claims	Legitimate interests and applicable legal obligations
Meet tax, accounting, consumer, court, or regulatory requirements	Legal obligation where the requirement applies
Optional communications or storage that legally require consent	Your specific consent, which can be withdrawn for future processing

We do not treat acceptance of the Terms as blanket consent to optional tracking or unrelated marketing. Withdrawing consent does not invalidate earlier lawful processing or remove a record we need for another lawful purpose.

3. Cookies and similar storage

The following describes the principal website storage. Provider-controlled pages or services can use their own cookies under their notices.

Storage	Purpose	Usual duration and controls
Customer session, spoof.sid	Keep you signed in and protect account operations	Configured for up to 24 hours, subject to session activity, sign-out, expiry, and security invalidation
Separate staff session, spoof.staff.sid	Protect staff access separately from customer access	A protected session with its own expiry and sign-out controls
Guest support cookie	Keep an anonymous support conversation associated with its browser	Up to 30 days; clearing it can remove browser access to that guest conversation
Referral attribution, spoof.referral	Remember the first eligible referral while you return and sign in	Up to 30 days; the browser cookie is cleared after the attribution is processed for the signed-in account

The referral cookie is signed with HMAC, marked HttpOnly, and sent securely in production. It contains a referral code, random visitor token, and timestamps, not an email address or payment details. Opening an eligible referral link shows a choice. The referral cookie is set only when you choose “Continue with referral”. You can choose “Continue without referral” and purchase normally without this attribution. Accepting an eligible referral can provide the first-payment discount described in the Terms; that optional discount is not applied when you continue without a referral. The product remains available without accepting referral attribution. No referral cookie is set just because you open the choice page. The choice and consent version are recorded with the attribution.

Use Referral privacy controls to remove an unclaimed referral cookie. You can also remove it through your browser's site-data controls and visit the site directly without a referral link. If the referral has already been attached to an account or used for a purchase, removing the browser cookie does not erase the related accounting record; contact us to request review or deletion of data that is no longer needed. You can withdraw optional browser attribution through the same referral privacy controls, or contact Support where processing relies on consent.

Essential sign-in and security storage is needed for the requested account functions. Blocking all cookies can affect sign-in, checkout association, and support access. Cookie expiry does not necessarily mean that associated transaction or security records have also been deleted.

4. Recipients and providers

We do not sell personal data. Relevant information is shared as needed with:

• Stripe, for website payments, authorized subscription billing, payment security, refunds, and disputes;
• Licensing infrastructure, including reseller.tateware.com, for accounts, entitlements, redemption, device binding, and resets;
• Email delivery providers, including SendGrid when configured, for requested account and service communications;
• Hosting, network, and security providers, including our Plesk-managed infrastructure and Cloudflare when enabled;
• Asset providers, such as Google Fonts and cdnjs, when their resources are requested by your browser;
• Team-notification services, including Discord where configured, for limited operational alerts; and
• Professional advisers, authorities, or relevant parties, where needed for a lawful request, fraud investigation, legal claim, or protected business transfer.

Payment and network providers may act as independent controllers for parts of their processing. A purchase made directly from an independent reseller is also subject to that reseller's own data practices. Referral participants do not receive access to each other's private account or support information through the program.

5. International processing

The Service and its providers may process information outside the country where you live. The applicable transfer requirements depend on the data, destination, and provider. Where a transfer needs a safeguard or other lawful mechanism, it must be in place for that transfer. Contact us for the relevant details and how to obtain information about any applicable safeguards. We do not claim that all service data stays in one country.

6. Retention

Different records serve different purposes. We use the following criteria rather than treating all information as having one deletion date:

• Verification codes and live sessions: validity is limited by the authentication process. Used or expired codes cannot be reused. Revoked session records may be retained to prevent an old request recreating access.
• Account and entitlement records: retained while needed to maintain access, recovery, linking, and account history, and then assessed for remaining legal, security, or dispute needs.
• Purchase, subscription, accepted terms, and credit records: retained for billing reconciliation, applicable accounting obligations, refunds, disputes, and the establishment or defence of claims. Cancelling renewal does not immediately erase those records.
• Referral records: browser attribution lasts no more than the disclosed cookie period. Account attribution and reward records can remain longer to explain earned credit, detect repeated claims, and handle later refunds or disputes.
• Support and access/security records: retained for resolving the issue, protecting accounts, investigating delivery or abuse, and supporting a relevant claim, with the needed period depending on the record and any open investigation.
• Backups: may continue to contain older records until the relevant backup cycle replaces them; they are not ordinary public account data.

You can ask us to review or delete records that are no longer needed. We may retain a limited record where a legal obligation, active dispute, security concern, or other applicable basis requires it. We will explain a material reason for refusing a deletion request where required. A retention criterion is not a promise that every record is automatically erased when a cookie or entitlement expires.

7. Security and account choices

We use HTTPS, protected session cookies, short-lived verification codes, request-origin checks, rate limits, restricted data files, verified payment webhooks, and access controls intended to protect account and transaction data. No service can guarantee perfect security.

Protect your email and application credentials, keep verification codes private, sign out on shared devices, and report suspicious activity. Do not put sensitive secrets or complete payment details in tickets. We may ask for proportionate verification before a sensitive account or privacy action.

8. Your rights

Depending on your location, you can request access, correction, deletion, restriction, portability, or object to certain processing. You may withdraw consent where it is the legal basis and complain to the relevant privacy regulator. For people covered by UK data-protection law, the regulator is the Information Commissioner's Office.

Send requests through Support or our support email with the account address and enough information to understand the request. We may verify identity before returning or changing data. We protect other people's information and may withhold information where a lawful restriction applies.

Some account, payment, and device information is necessary to deliver the Service. Deleting or disconnecting it can make the related feature unavailable; we will explain the practical consequences where relevant. You can stop future subscription renewals through the account billing controls without requesting deletion of the entire account.

Automated checks can reject an invalid sign-in, hold a payment or referral, or prevent a duplicate credit claim. Contact Support if you think a decision is incorrect and want it reviewed. We do not represent those checks as infallible.

9. Children

The Service is not directed to children. A person who cannot legally agree to the Terms may use it only with authorization and supervision from a parent or legal guardian, who must complete the purchase. Contact us if you believe a child provided personal information without appropriate authorization.

10. Changes and contact

This page shows its effective date and version. Account acceptance and new purchase records identify the applicable legal documents. We communicate material changes through an appropriate notice when needed. A new purpose requiring consent will not be treated as authorized merely because this page changes.

For a privacy question, withdrawal, or rights request, use Support or [email protected]. The Terms of Service explain purchases, renewals, cancellation, refunds, and referral credit.