Privacy Policy

We collect only the data needed to run Sorrel Hub, protect accounts, deliver digital access, support users, and prevent abuse.

• Account data: email, user ID, username, display name, avatar, bio, role, verification state, creation date, and profile settings
• Authentication and security data: session state, CSRF state, MFA status, trusted devices, recovery flow data, login signals, IP address, user agent, and security events
• Access data: subscriptions, keys, product access, activation dates, expiration dates, HWID binding, HWID reset history, loader validation events, and product usage signals
• Payment data: order ID, payment provider ID, product, plan, amount, status, contact email for receipt/key delivery, callback status, and provider metadata required to verify payment
• Community data: forum posts, comments, reactions, follows, notifications, moderation actions, reports, Discord-linked identity, and support context you provide
• Technical data: browser/device signals, error logs, rate-limit records, abuse-prevention records, and storage/upload metadata

We do not intentionally store full card numbers or private crypto wallet secrets. Payment details are handled by the payment provider.

We use collected data for:

• Creating accounts, signing users in, protecting sessions, and operating cabinet/profile features
• Creating, verifying, and fulfilling paid orders, subscriptions, keys, and loader access
• Detecting key sharing, HWID abuse, fraud, chargebacks, spam, automated abuse, attacks, and policy violations
• Providing support, investigating payment issues, moderation cases, security events, and delivery failures
• Operating the forum, notifications, profile pages, avatar uploads, connected services, and Discord integrations
• Maintaining service reliability, logs, analytics, backups, and legal/compliance records

We do not sell personal data and do not share it with third parties for advertising.

Account, profile, subscription, payment-order, forum, moderation, and security data is stored in our backend systems and database providers. Some file uploads, such as avatars or attachments, may be stored in configured storage buckets.

• Active account and access records are kept while the account or subscription exists
• Payment, fraud, moderation, loader, audit, and security records may be retained after deletion when needed for dispute handling, abuse prevention, accounting, legal obligations, or platform safety
• Backups and logs may persist for a limited period before automatic rotation or deletion
• Some public content may remain visible until removed through moderation, deletion tools, or support

Sorrel Hub uses third-party providers to operate the service:

• Supabase for authentication, database, and storage
• Cloudflare Turnstile for bot protection
• Discord for optional account linking, community support, and notifications
• Cloudflare Pages/Workers for frontend hosting
• Railway for backend hosting
• 2328.io or another configured payment provider for checkout, payment status, and webhook confirmation

Each provider processes data under its own policies. We share only what is reasonably needed for the relevant feature to work.

We may use cookies, session storage, or local storage to keep the website functional and secure.

• Authentication/session state and CSRF protection
• MFA or trusted-device flow state when applicable
• UI preferences and temporary frontend state
• OAuth return state and security checks

We do not use third-party advertising cookies.

We apply reasonable security controls, including HTTPS, Supabase Auth, backend-side access checks, CSRF protection for mutations, rate limiting, HWID checks, MFA-related features, moderation checks, and restricted admin actions.

No system is perfectly secure. You are responsible for keeping your email, password, Discord account, device, browser, and session private.

You may request account deletion, correction of inaccurate profile data, or a reasonable export of account data by contacting support.

• We may ask you to verify account ownership before processing a request
• Deletion may not remove records we must keep for payment disputes, abuse prevention, moderation, security, backups, or legal reasons
• Public forum/profile content may need a separate moderation or deletion request if it has been copied, quoted, or involved in moderation records

• Discord: sorrelhub.xyz/support
• Website: sorrelhub.xyz