Privacy Policy

1. Summary

A licence key, a hashed hardware identifier, the email and Minecraft account you apply with, and order and consent records from earlier purchases. No advertising, no analytics, no trackers, and no reading of your files, chat or keystrokes.

2. Who is responsible

Valen is the controller of the data described here. Contact: support@valen.cx.

3. What we collect

If you bought a licence

Your email address, collected by Stripe at checkout.
A payment reference. We never received or stored your card number.
The order record: plan, amount, currency, time, and the key issued for it.
The policy version, consent timestamp, terms acceptance and immediate-supply acknowledgement recorded with the order.

When you use the client

Your licence key, sent on every launch to authenticate you.
A SHA-256 hash of your hardware identifier — see section 4.
Security records such as IP address, timestamp, route and outcome, with a masked licence reference rather than the full key.

If you apply for access

Your email address, the Minecraft account you verify (its username and account ID), your optional answer to why we should accept you, and when you applied. To verify the account you join our verification server, which asks Mojang to confirm it and sees your connection's IP address. We do not store that IP address, and the server never receives your password or login token.

We use your application to decide whether to give you access, which can include looking up the account's public statistics, and to email you if you are accepted. We delete each application 90 days after you last send it, or sooner if you ask.

If you asked to be told about the launch

Your email address and the date you gave it, used for one message about the launch and then deleted. It is never sold, shared or added to a newsletter. Ask and we will remove it sooner.

When you contact support

We receive the email address, message, attachments and any order, licence, device or troubleshooting details you choose to include, and use them to answer your request, investigate security issues and handle disputes.

4. Hardware identifiers

The loader reads a device value so one key runs on one machine. On Windows it reads the system MachineGuid; on other supported systems it uses a composite of account and system details. The loader hashes that value with SHA-256 before sending it, and our server hashes the received value with SHA-256 again before storing or comparing it. No separate salt is used. The raw system value is not stored in our database or logs.

The resulting binding hash is linked to your licence and kept for as long as the licence is bound to that machine. A hash is a persistent identifier here, not anonymous data, so it may be personal data under applicable law. Everything else identifying about an application request is deleted within 24 hours, subject to the limits in section 9.

5. What we do not collect

The client sends a licence key and a hardware identifier. That is all. It does not:

read, upload or scan files on your computer;
record keystrokes, screenshots or microphone input;
collect your Minecraft credentials or session token;
report the servers you play on, your chat, or your gameplay;
track you across other websites.

6. Why we collect it

To run your licence — authenticating your key. Legal basis: performance of our contract.
To stop piracy and abuse — machine binding, ban enforcement, rate limiting and service security. Legal basis: legitimate interest. We use a persistent binding because a licence key alone cannot reliably prevent sharing. The safeguards are that the raw device value is not retained, the stored value is hashed, logs use masked references, and account decisions can be reviewed through support. You can object to this processing by email, although we may then be unable to run a machine-bound licence.
To support you — answering tickets, resetting bindings. Legal basis: performance of our contract.
To keep order records — the consent and transaction records of earlier purchases, for tax and disputes. Legal basis: legal obligation and legitimate interest.
To review applications — confirming the account is yours, deciding who gets access, and emailing accepted applicants. Legal basis: steps you ask us to take before we issue a licence.
To tell you it launched — the one email you asked for. Legal basis: consent, which you can withdraw at any time.

7. Payments and Stripe

Earlier purchases were handled by Stripe. Card details went directly to them and never reached our servers. Stripe acts as an independent controller for the data it collects, under its own privacy policy.

We do not control or have complete visibility into what Stripe collects or how long it keeps it. Our service received only the email, payment reference, plan, amount, currency, purchase time, payment status and checkout consent fields needed to match and fulfil each order. See their Privacy Policy and their Terms of Service.

We do not sell personal data or share it for advertising. Our processors are:

Stripe — payment processing and receipts for earlier orders.
Railway — runs the API and website, and therefore stores the database and logs.
The support mailbox provider — receives messages sent to support.
Mojang — confirms the Minecraft account you verify when you apply.

We also disclose data where legally required, or where necessary to bring or defend a legal claim, including a payment dispute.

9. Retention

Application request records — identifying rate-limit and request data under our control is deleted within 24 hours. Hosting, network, security and backup logs may have separate retention periods set by their providers.
Hardware identifier hash — for as long as the licence is bound to that machine.
Licence and consent records (key, order, policy version, consent, ban status, expiry and creation date) — for the life of the licence, and afterwards where needed to enforce a ban, handle a dispute or meet a legal obligation.
Order and payment records — as long as tax law requires.
Applications — 90 days after your most recent application, then deleted.
Launch notification addresses — until the launch email is sent, then deleted.
Support correspondence — while needed to resolve the request, subject to legal, security and dispute records.

10. Cookies

This site sets no tracking or advertising cookies and runs no analytics. The only thing stored in your browser is a valen-theme entry remembering light or dark.

11. Your rights

If you are in the UK or EEA, and in many other places, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or port it elsewhere. Email support@valen.cx and say which of these you are asking for. We normally respond within one month where that legal deadline applies; it may be extended by up to two further months for complex or numerous requests where the law permits it.

We may ask for enough information to verify the request, such as the checkout email, order reference or licence key. Deleting your licence record ends your licence — we cannot authenticate a key we no longer hold. Banned keys, consent evidence and completed transactions may be retained after a deletion request to enforce bans, resolve disputes and meet tax or other legal obligations.

You may complain to your local data protection authority.

12. Security

Traffic between the client, the site and our servers is encrypted in transit, and the client payload is encrypted on top of that. Access to the licensing database is limited to the operators of the service. To report a suspected security issue, email support@valen.cx with “Security report” in the subject. If a breach affects your data we will notify you and the relevant authority as required.

13. Children

Valen is not intended for children under 13 and we do not knowingly collect their data. People aged 13–15 may use it only where a parent or guardian accepts the Terms of Service on their behalf. We do not collect age or parental-verification data. Email us if you believe we collected data from someone under 13, and we will delete it subject to any legal or security record we must retain.

14. Changes

The date at the top identifies this copy. We may update this policy as the service or law changes. The policy version recorded with an earlier order identifies the notice that applied to that purchase; ask support for a copy.

15. Contact

Privacy questions, data requests, security reports and complaints go to support@valen.cx. Never send passwords, session tokens or full payment-card numbers.