Privacy Policy

This Privacy Policy describes how Pufus collects, uses, and safeguards information across our website, workstation dashboard, script delivery endpoints, proxy relays, and APIs.

• Account Credentials: Your username, email address, hashed password, two-factor authentication status, and OAuth profile identifier if you sign in with Google.
• Billing Records: Transaction status, balance history, and plan tier. Payment card details are processed directly by Stripe and are never stored on Pufus servers.
• Workspace Activity: Repository metadata, license key configurations, team member roles, and proxy relay settings.

Scripts and modules uploaded to Pufus are compressed and encrypted prior to remote storage. When a client executes your loader URL, the script is processed in volatile memory to synthesize a protected build and is never exposed publicly in plaintext.

To protect the platform against credential stuffing, multi-account abuse, unauthorized account sharing, and denial-of-service attacks, we collect device and browser signals, network IP addresses, and request rate metrics. These signals are used exclusively for platform security and compliance enforcement.

When licensing is enabled on a repository, our runtime gateway processes session heartbeats containing the player's in-game user ID, username, place ID, and a one-way hashed hardware identifier (when HWID verification or lock is used). Active session data is held in temporary memory so repository owners can view live connected players and manage access slots, expiring automatically shortly after a player disconnects.

Uploaded scripts and proxy configurations remain stored only while active in your workstation. When you delete a script or repository, it is removed from storage immediately. For permanently suspended accounts, repositories are retained for 15 days to allow local backup export (.zip), after which all associated files are permanently purged.