Privacy Policy

1. Who we are

This Privacy Policy explains what personal data onlychams ("we", "us") collects, why, who we share it with, how long we keep it, and what choices you have.

onlychams is a sole proprietorship operated from the United States. We decide how your data is used. Contact us about privacy at [email protected] or through a support ticket at onlychams.pro/support.

This policy covers the website onlychams.pro, your account, the store, the loader, support, the reseller portal, and our Discord server as far as we control it.

2. What we collect

We collect only the data listed here.

Your account

• Your username.
• Your email address.
• Your account password, stored in a form we cannot read back.
• Login sessions, using a session cookie.
• If you enroll an authenticator: its secret (stored encrypted), your recovery codes (stored so we cannot read them) and when you set it up.
• If you link Discord: your Discord ID, username and avatar.

Connections and devices

• The IP addresses of your connections to our website, our API and the loader, and the country, region and city we derive from them (geoip), along with a flag showing whether the connection appears to come through a VPN or proxy.
• A history of the IP addresses used with your account.
• Your hardware ID and the device details the loader reports.
• Loader session records.
• Error and crash telemetry from the loader: the event name, error codes and details.

Purchases and payments

• Purchase and payment records, including PayPal order and capture IDs, Litecoin transaction IDs, addresses and amounts, and your store-credit history.
• Records of what you accepted: the legal document version, and the time and IP address of each acceptance, including the consent to immediate delivery that checkout asks EU and UK customers for.
• The tax location you state at checkout: country, US state, and for North Carolina, county and ZIP code.

We never see your card or bank details. PayPal collects them on its own payment page.

Things you post or upload

• Support tickets and their messages.
• Vouches (reviews) you post through Discord. These are public on our site.
• In-game configurations you upload to the cloud-config feature.

Resellers

• Reseller application details: username, email, contact handle and pitch.
• Reseller business and tax details, uploaded resale certificates and their verification history.

3. Where the data comes from

• From you, when you sign up, buy, open a ticket, upload a configuration, or apply to resell.
• From the loader, when it runs on your PC.
• From your browser or the loader connecting to us (IP addresses).
• From PayPal, when it confirms a payment (order and capture IDs).
• From the public Litecoin network, when we confirm a transaction.
• From Discord, if you link your account or post a vouch.

4. How we use it

• To run your account and deliver what you buy: sign-in, adding your time, delivering the software, checking your license, and binding it to one PC.
• To take and record payments: crediting PayPal and Litecoin payments, keeping your store-credit balance, and keeping the records tax law requires.
• To charge the right sales tax or VAT: using the tax location you state.
• To prevent fraud and abuse and keep the service secure: using IP addresses, geoip, the VPN or proxy flag, IP history, and hardware IDs to spot account sharing, key sharing, stolen payments, chargeback abuse and attacks.
• To fix problems: using loader session records and error and crash telemetry.
• To give support: reading and answering your tickets.
• To show vouches: displaying vouches publicly on the site.
• To store your configurations: keeping cloud configurations you upload so you can load them again.
• To run the reseller program: reviewing applications, and keeping reseller business and tax records, including resale certificates.
• To contact you: sending verification emails and messages about your account, purchases and these policies. We do not send marketing email. If we ever offer it, we will send it only to people who separately opt in, and you will be able to unsubscribe at any time.

We do not use your data for advertising. We do not sell your personal data, and we do not share it for targeted advertising.

5. Cookies

We use only the cookies the site needs to work, such as keeping you signed in. We do not use advertising, analytics or tracking cookies, and we do not load third-party analytics scripts.

6. Who we share it with

We share data only with these recipients, and only as needed:

• PayPal, to process PayPal payments. PayPal handles your payment details under its own privacy policy.
• Our hosting providers, which run our servers in the European Union. These servers store the service's data. We also run a server on our own equipment in the United States, which we use to build the software.
• Cloudflare, which provides our DNS, proxies connections to our website, and routes email sent to us. Your connections to the website, and email you send us, pass through Cloudflare.
• Resend, which sends our outgoing account email, such as verification codes.
• Discord, if you link your Discord account or post a vouch through Discord. Discord handles that data under its own privacy policy.
• The public Litecoin network. Litecoin transactions, including addresses and amounts, are public on the blockchain by nature. Anyone can see them, and they cannot be deleted.

We do not share your data with game publishers or anti-cheat vendors, except as described in section 7.

We may also share data with someone who takes over the service, for example if the business is sold. They would have to follow this policy or tell you about any change.

7. Legal requests

We may disclose your data when we believe in good faith that the law requires it, for example in response to a subpoena, court order or other valid legal process. This includes legal process in a civil lawsuit, including one brought by a game publisher. We may also disclose data where needed to protect someone's safety or to stop fraud.

Before we disclose your data in response to a legal request, we will tell you, so that you have a chance to object, unless the law or a court order forbids us to.

8. What is public

• Vouches are public on our site, with the Discord name and avatar of the person who posted them.
• Litecoin transactions are public on the blockchain.
• Anything you post in public Discord channels is visible to that server's members.

9. How long we keep it

When a period ends, we delete the data or make it anonymous. Data that is also in a backup is deleted when that backup is overwritten.

Where the table says "7 years after the purchase", records of sales to customers in the European Union are kept for 10 years after the end of the year of the sale, because EU VAT law requires it.

We may keep data longer if the law requires it, or if we need it for an open dispute, chargeback, fraud investigation or legal claim, and only until that is resolved.

10. How we protect it

Account passwords are stored in a form we cannot read back. Authenticator secrets and private resale-certificate files are encrypted separately. The site never receives your card or bank details. No system is perfectly secure, so we cannot promise that data will never be exposed. If a security breach affects your personal data, we will notify you and any authorities as the law requires.

11. Your choices and rights

You can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong;
• delete your data, or close your account; and
• give you your data in a portable format.

You can also unlink Discord, remove your email, delete your cloud configurations, and ask us to remove your vouch.

To make a request, open a support ticket while signed in, or email [email protected]. We may need to confirm the request comes from the account owner. We will answer within 30 days. If a request is complex, we may need up to 60 more days, and if so we will tell you within the first 30. We will not treat you differently for using these rights.

Some data we cannot delete right away, such as purchase records we must keep for tax law, data needed for an open dispute, and copies on the public Litecoin blockchain or on Discord. We will tell you if that applies.

12. If you are in the EEA, the UK or Switzerland

If you are in the European Economic Area (EEA), which includes the European Union, the General Data Protection Regulation (GDPR) applies to our handling of your personal data. If you are in the United Kingdom, the UK GDPR applies. If you are in Switzerland, the Swiss Federal Act on Data Protection gives you equivalent rights, and this section applies to you too.

Legal bases

• Performance of a contract: to run your account, deliver your time and the software, check your license and bind it to one PC, take payments, store your configurations, show the vouches you post, run the reseller program, and give support.
• Legal obligation: to keep tax and accounting records, including sales tax and VAT records and resale certificates, and to respond to lawful requests.
• Legitimate interests: to prevent fraud and abuse, including account sharing, key sharing, stolen payments and chargeback abuse; to keep the service secure; and to fix problems. Our interest is in protecting the service, our customers and our business.
• Consent: where we ask for it, such as any optional marketing email you opt in to. You can withdraw consent at any time. Withdrawing it does not affect what we did before.

Your rights

You have the right to:

• access your personal data and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use your data;
• receive the data you gave us in a portable format;
• object to our use of your data based on legitimate interests; and
• withdraw consent where we rely on consent.

These rights have limits set by law. For example, we must keep tax records even if you ask us to delete them, as section 11 explains.

To use any of these rights, open a support ticket while signed in, or email [email protected]. Send every request and question from the EEA, the UK or Switzerland to [email protected]. We answer within the times in section 11.

Complaints

You have the right to complain to a data protection supervisory authority, in particular in the country where you live or work, or where you believe the law was broken. In the UK, this is the Information Commissioner's Office (ICO). You do not have to contact us first, but we would welcome the chance to put things right.

Transfers outside your region

The servers that store the service's data are in the European Union. We are based in the United States and process the data from there, so your personal data is transferred from the European Union to the United States. The service providers in section 6 may also process it in the United States or in other countries. Where a service provider that processes data for us is involved in transferring EEA, UK or Swiss personal data to the United States, or to another country without an adequacy decision, we rely on the standard contractual clauses approved by the European Commission, with the UK addendum or Swiss amendments where they apply, or on that provider's equivalent safeguards. You can ask for more information about these safeguards at [email protected].

13. Age

The service is for adults 18 and over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its data, except records the law requires us to keep.

14. Changes to this policy

If we make a material change, we will post the new policy on the site and tell you by email if you gave us one, or on Discord, before it takes effect.

15. Contact

onlychams is a sole proprietorship operated from the United States. Email: [email protected]. Support: onlychams.pro/support.