Privacy Policy

1. Overview

This policy explains what personal data Astral Scripts collects when you use astralscripts.xyz and our related services, why we collect it, who processes it on our behalf, how long we keep it, and what you can ask us to do with it. It applies to everyone who visits the site or holds an account.

The short version: we collect the minimum needed to run an account-based script library. We do not sell your data, we do not share it with advertisers, we run no advertising or analytics trackers, and we never see your payment card details.

2. Information We Collect

Account information. When you register we collect your email address, a username of your choosing, and a password. Passwords are hashed by our authentication provider and are never visible to us in readable form.

Profile information. You may optionally add an avatar image, a short bio, and your favourite games. These appear on your public profile page. Anything you add here is visible to other users, so treat those fields as public.

Discord identifier. If you choose to connect Discord, we receive and store your Discord user ID so we can link your membership to your Discord account and add you to our server. This is described in more detail in section 5.

Order and subscription records. When you purchase Pro we record the order: the plan and billing period, the amount, the order status, any promotional code applied, the timestamps, and the gift card redemption code you submitted through checkout. We keep the submitted code because it is the evidence of payment behind your subscription and we need it to verify the order and to resolve disputes.

Download history. Each time you download a script we record which script it was, which account requested it, and when. We use this to enforce subscription access, to detect account sharing and bulk extraction, and to show you what you have downloaded.

Content you submit. Ratings, reviews, and support messages you send us are stored along with the account that submitted them.

Technical data. Our hosting and security providers process standard server data such as IP address, browser user agent, and request timestamps, in order to deliver the site and protect it from abuse. We do not combine this into behavioural profiles.

What we never collect. We do not collect credit card numbers, bank details, billing addresses, government identification, or any special category data such as health, biometric, or political information. We do not ask for your real name. We do not collect data from your Cronus Zen device, your console, or your games — nothing on this site reads your gameplay.

3. How We Use Your Information

We use the data described above only to:

• create and maintain your account, and authenticate you when you sign in;
• verify payments and grant, extend, or expire your Pro access;
• deliver script downloads and confirm you are entitled to the script requested;
• display your profile, your download history, and your order history back to you;
• send service messages such as order confirmations, subscription expiry notices, and password resets;
• publish in-app notifications and announcements about releases and outages;
• detect and prevent fraud, account sharing, script redistribution, and abuse of the Service;
• provide support when you contact us; and
• comply with legal obligations.

The legal bases we rely on, where that concept applies to you, are performance of our contract with you (running your account and subscription), our legitimate interests (security, fraud prevention, and improving the Service), your consent (connecting Discord, which is entirely optional), and compliance with legal obligations.

4. We Do Not Sell Your Data

We do not sell, rent, trade, or otherwise disclose your personal data to third parties for their own marketing, advertising, or commercial purposes. We do not operate an advertising network, we do not run advertising pixels or third-party analytics on this site, and we do not participate in data broking of any kind.

The only parties who handle your data are the service providers listed in section 5, who process it strictly on our instructions to operate the Service. The only other circumstances in which we would disclose data are where we are legally required to do so by a valid legal process, where disclosure is necessary to protect our rights or the safety of others, or in connection with a transfer of the Service to a new operator — in which case the recipient would remain bound by this policy.

5. Service Providers

Running the Service requires a small number of processors. Each handles only what it needs to:

• Supabase — our database, authentication, and file storage provider. Supabase stores your account record, profile, orders, and download history, and holds the script files themselves. It is our primary data processor.
• Vercel — hosts the website and serves it to your browser.
• Railway — hosts our application programming interface, which handles downloads, orders, and account operations.
• Cloudflare — provides domain routing and the Turnstile challenge shown on the sign-in and registration forms, which distinguishes real users from bots.
• Discord — provides our community server and the optional account connection described below.

Discord connection.Connecting Discord is optional and you can use the Service fully without it. If you do connect it, you are sent to Discord to authorise the connection; Discord then tells us your Discord user ID, which we store on your profile, and we use the authorisation to add you to our server. We do not receive your Discord password, your direct messages, or your activity in other servers. Your use of Discord itself is governed by Discord's own privacy policy, not this one.

Payment marketplaces. Payment happens off our site. When you buy a gift card from a third-party marketplace, that purchase is between you and them, under their privacy policy, and we receive none of the information you give them. All that reaches us is the redemption code you choose to paste into our checkout page.

6. Cookies and Local Storage

We use cookies and browser local storage only for functional purposes. Specifically:

• Authentication cookies keep you signed in between page loads and visits. Without them you would have to sign in on every request. These are set by our authentication provider.
• Local storage entries remember which site announcements you have dismissed, so a banner you have closed does not reappear.
• Cloudflare Turnstile may set a short-lived token while it verifies that a sign-in or registration attempt is not automated.

We set no advertising, marketing, profiling, or third-party analytics cookies. You can clear or block cookies in your browser settings; if you block the authentication cookies you will not be able to stay signed in.

7. Data Retention

We keep your account data for as long as your account is open. If you ask us to delete your account, we remove your profile, your email address, your Discord identifier, and your download history.

We retain order records — including the amount, date, and payment code — after account deletion where we need them for fraud prevention, dispute resolution, accounting, or another legal obligation. Where we do, the records are disassociated from your profile and kept no longer than necessary for that purpose. Inactive accounts with no subscription history may be removed at our discretion.

8. Security

Data is transmitted over encrypted connections and stored with our providers using encryption at rest. Database access is governed by row-level security rules so that an account can reach only its own records. Script downloads are served through short-lived signed links that expire within a minute of being issued, rather than through public file URLs. Administrative functions are restricted to a small number of accounts.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data we will notify you and any competent authority as required by applicable law. Choosing a strong, unique password and keeping it to yourself is the single most useful thing you can do on your side.

9. Your Rights

Subject to the law that applies to you, you may ask us to do any of the following, free of charge:

• Access — receive a copy of the personal data we hold about you.
• Correct — fix data that is inaccurate or incomplete. Your username, bio, avatar, and favourite games can be edited yourself at any time from your account settings.
• Delete — have your account and associated personal data erased, within the retention limits described in section 7.
• Export — receive your data in a portable, machine-readable format.
• Object or restrict — object to a particular use of your data, or ask us to limit how we process it.
• Withdraw consent — disconnect Discord at any time from your account settings, which removes the stored Discord identifier.

How to make a request. Email [email protected] from the address registered to your account and tell us what you want done. We will verify that the request comes from the account holder and respond within thirty days. If we cannot act on a request, we will explain why.

Deleting your account does not refund an active subscription. As set out in our Terms of Service, all sales are final, and requesting deletion mid-term forfeits the remainder of that term.

If you are in a jurisdiction with a data protection authority and you believe we have mishandled your data, you have the right to lodge a complaint with that authority. We would appreciate the chance to resolve it with you first.

10. International Transfers

Our providers operate infrastructure in several countries, so your data may be stored or processed outside the country you live in, including in jurisdictions whose data protection laws differ from your own. Where such a transfer takes place, we rely on our providers' standard contractual protections to keep your data covered by safeguards comparable to those described in this policy.

11. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a minor has created an account, contact [email protected] and we will delete the account and its data.

12. Changes to This Policy

We may update this policy as the Service changes. The date at the top of this page always reflects the current version, and where a change materially affects how we handle your data we will make reasonable efforts to notify you through the Service or our Discord before it takes effect.

13. Contact

For any privacy question, request, or complaint, write to [email protected]. Privacy requests are handled by email rather than through Discord, so that we can verify the account holder properly.