Privacy Policy
Last updated
This policy explains what Boros does with your personal data. It covers this website, our software and our Discord bot.
We collect as little as we can get away with. There are no advertising trackers or analytics scripts on this site.
1. What we collect
Depending on how you use Boros, we may hold:
- Email address — when you buy a key, so we can deliver it and send a receipt.
- Payment details — handled entirely by Stripe or PayPal. We receive confirmation that a payment succeeded and a reference number; we never see your card number.
- Hardware identifier (HWID) — a fingerprint of the device a key is used on, so keys can't be shared. It does not identify you personally on its own.
- IP address — used to rate-limit free keys and to detect abuse. It is stored hashed, not in the clear.
- Device identifier — a random string kept in your browser's local storage, so a returning visitor can see the free key they already hold. It contains nothing about you.
- Discord account — if you join our server or link your account, the bot sees your Discord ID and roles.
- In-game identifiers — if you use our software, the loader reports which game you are running so we can show live usage and support you.
2. Why we hold it
To deliver what you bought, and to prove you're entitled to it.
To stop one key being shared among many people, and to stop free keys being farmed.
To provide support, which usually means matching a key to the person asking about it.
To meet our accounting and tax obligations on sales.
3. Who else processes your data
We use a small number of third parties. Each one only receives what it needs:
- Stripe and PayPal — payment processing. Their own privacy policies apply to the card and account details you give them.
- work.ink — free-key offers. If you complete one, work.ink and its advertisers handle that interaction under their own policies. We receive only a token confirming completion.
- Discord — our community and support, and our bot. Discord holds your account data under its own policy.
- Our hosting provider — runs the servers this site and our API sit on.
4. TikTok content
The videos shown on our home page are our own public TikTok posts, pulled through TikTok's official API. We do not receive anything about who views them here, and viewing this site does not send anything to TikTok.
6. How long we keep it
Key and licence records are kept while the key is valid and for a reasonable period afterwards, so we can handle support and disputes.
Payment records are kept as long as tax law requires — typically several years.
Hashed IP addresses used for free-key limits are kept only as long as the limit window they enforce.
Everything else is deleted when it stops being useful.
7. Your rights
You can ask us for a copy of the data we hold about you, to correct it, or to delete it. Email [email protected] and we will respond within a month.
Deleting your data will usually mean revoking any active key, because the key record is the data. We will tell you before we do that.
We may need to keep some records after a deletion request where the law requires it — payment records, for example.
If you think we have handled your data badly, you can complain to the data protection authority where you live.
8. Security
Traffic to this site and our API is encrypted in transit. Payment details never touch our servers. Administrator access is restricted and session-based.
No system is perfectly secure. If we ever suffer a breach affecting your data, we will tell you and the relevant authority as required.
9. Age
Boros is not intended for children. You must be old enough to enter a contract where you live in order to buy a key. If we learn we hold data about a child, we delete it.
10. Changes
We may update this policy. The date at the top shows when it last changed. If a change materially affects how we use your data, we will say so rather than quietly updating the page.
11. Contact
Privacy questions and requests: [email protected].