Privacy Policy
Last updated August 13, 2026
This Privacy Policy explains what information Murlocs ("Murlocs", "we", "us", or "our") collects, how we use it, and the choices you have. It applies to our website, accounts, marketplace, loaders, and related software. By using the Service you agree to this policy.
1.Information we collect
We collect what we need to run the Service:
- Account data: username, email address, password hash, email-verification and password-reset tokens, preferred locale, and account standing.
- Discord account data: when you sign in with Discord or link Discord, we receive your Discord ID, username, avatar, and email address. We may also read your membership and roles in our Discord server to assign access.
- Hardware signals: certain unlockers supply a hardware identifier. We store a derived form of those signals to license access, enforce session limits, apply bans, and prevent trial abuse. We do not ask you to type a hardware ID into the website.
- Purchase and credit data: records of top-ups, credit balance, orders, entitlements, renewals, refunds, and related receipts. Payments are processed in cryptocurrency through our payment processor. We do not collect or store card numbers or bank details.
- Usage data: limited technical data such as connection timestamps, session activity, and loader-host type.
- Game data: information is collected from the in-game client and related software.
- Support data: messages and files you send in support or refund cases.
- Seller data: if you apply as a seller, organization details, legal-contact email, listings, source-repository metadata, compliance evidence, and payout-destination evidence.
- Security data: IP address and related request metadata used for rate limiting, fraud prevention, and abuse detection.
We do not run third-party advertising trackers. When the website is hosted on Vercel, Vercel Analytics, Speed Insights, and BotID may collect limited technical telemetry and bot-detection signals to operate and protect the site.
2.How we use information
- Provide, maintain, and deliver your access, downloads, and entitlements.
- Authenticate your account and assign roles and entitlements.
- Process top-ups, purchases, renewals, refunds, and seller payout records.
- Enforce session limits, prevent fraud and abuse, apply bans, and limit trials to one per person.
- Provide support and respond to your requests.
- Operate seller applications, catalog review, and product delivery.
- Understand product usage in aggregate so we can operate and support the Service.
- Comply with legal obligations.
3.Legal basis for processing
Where data protection law such as the GDPR applies, we process your information on the following bases:
- Performance of our contract with you, to provide the access you purchased or requested.
- Our legitimate interests in securing the Service, preventing fraud and abuse, and enforcing bans.
- Your consent, where we ask for it.
- Compliance with our legal obligations.
6.Data retention
We keep your information for as long as your account is active and as needed to provide the Service. We may retain certain data, including derived hardware identifiers associated with bans, trial-abuse claims, legal acceptances, and commerce evidence, for longer where needed to enforce bans, prevent fraud and abuse, resolve disputes, and comply with legal obligations. Account deletion removes member-profile data we are permitted to erase; required evidence may be retained or tombstoned under the active retention policy.
7.Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion of your data.
- Restrict or object to certain processing.
- Receive your data in a portable format.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with your local data protection authority.
To make a request, contact us through our Discord. Some data may be retained as described in "Data retention" even after a deletion request, where we have a legal basis or legitimate need, such as enforcing bans or preventing fraud.
8.Security
We take reasonable measures to protect your information, including hashed passwords, signed session cookies, and derived rather than raw hardware-ban matching where an unlocker supplies a signal. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9.Age requirement
The Service is intended only for users who are at least 18 years old. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will remove it.
10.International users
We may process and store information in countries other than where you live. By using the Service, you consent to the transfer of your information to those locations, which may have different data protection laws than your own.
11.Changes to this policy
We may update this Privacy Policy from time to time. Changes take effect when posted on this page, and the "Last updated" date will reflect the latest version.
12.Contact
Privacy requests should be sent through our Discord.