Privacy Policy | CODCheats

1. Who we are

The operator identified at the top of this page runs CODCheats and decides how the data described here is used. Questions about this policy go through a support ticket, the only way to reach us.

2. Built to hold as little as possible

CODCheats is designed to work without knowing who you are. We never ask for your name, email address, phone number, postal address, date of birth or any card or bank details, and there is no field for them anywhere in the Services. We do not run advertising, sell data or use third-party trackers in the dashboard.

3. What we hold

Your account

Your username and an account number we generate (ACC- followed by eight characters).
Your password, stored only as a one-way hash by our sign-in system. We cannot read it.
If you turn on two-factor sign-in, the secret your authenticator app uses.
Your recovery code, stored only as a one-way hash. We cannot read it or send it to you again.
Sign-in sessions. Our sign-in system records when each session started and the IP address and browser it came from, to keep accounts secure.

Abuse protection

To limit repeated sign-in, sign-up and ticket attempts, we turn your IP address into a keyed one-way hash. Neither the hash nor the address it came from is stored with your account, and the records are deleted after about two days.

Orders, payments and your wallet

What you bought, when, and the price.
For each crypto payment: the invoice reference, the asset, the amount, the exchange rate used and the blockchain transaction ID. We do not store the wallet you paid from.
Your wallet balance, kept as a list of credits and debits.
Payments are handled by our own crypto payment server. Blockchain transactions are public and permanent by nature; nobody, including us, can change or delete them.

Support

The messages you write in a ticket, and its category and status.
For a ticket opened without an account: the ticket code and a one-way hash of its secret key. No contact details are asked for.

Records of account activity

A log of important events on your account, such as purchases, payments, wallet changes, password changes, recoveries and two-factor changes, with the time each happened. This log does not include IP addresses.

The website

Like any web server, ours receives your IP address, browser type, the page requested and the time of the request, and may keep them in short-lived server logs.
When website analytics is on, the website uses Google Analytics on every page. It records the pages you view, the site that sent you, your browser and device type, and your approximate location, which Google works out from your IP address and does not store. It tells us how the website is used, not who you are. Google receives this data and may process it outside the country you live in.

4. Why we use it

To run your account, deliver what you paid for and keep it working.
To secure accounts and payments, and to stop fraud, account sharing and abuse.
To answer your support tickets.
To keep the financial records we need.
When website analytics is on, to see how the website is used and improve it.

5. Who can see it

Our staff see only what they need to run the Services and answer tickets. The hosting, database and network providers we run on store and process data on our behalf and see no more than that requires. When website analytics is on, Google receives the analytics data described in section 3. We do not sell, rent or trade personal data. We disclose it only where we are legally compelled to.

6. Where it is

CODCheats is managed from Russia. The servers that store and process your data are run by our infrastructure providers and may be located outside Russia and outside the country you live in.

7. How long we keep it

Account data: while your account exists.
Orders, payments, wallet entries and account activity records: kept permanently. They are our financial and security record and cannot be edited or removed.
Support tickets: while the account or ticket exists.
Abuse-protection hashes: about two days.
Website server logs: a short period, for security and troubleshooting.

You can ask, through a support ticket, for your account to be closed. Closing an account does not remove the order, payment, wallet and activity records tied to it.

8. Cookies and browser storage

The dashboard uses your browser’s storage to keep you signed in, to count failed sign-in attempts, and, for a ticket opened without an account, to remember its code and key while the tab is open. While you are signed in it also sets one cookie, cc_account, that the website can read: it holds only the first letter of your username, so the website can show your account menu instead of “Sign in”. It is not used to sign you in or to track you, and it is removed when you sign out or a week after your last visit. The website sets no cookies of its own. When analytics is on, Google Analytics sets two cookies on the website: _ga, a random ID that recognises your browser when you come back, and _ga_ followed by an ID, which keeps track of the current visit. By default both expire after two years. Neither is used for advertising, and the website turns on no advertising cookies.

To stop Google Analytics, block or delete cookies for this website in your browser’s settings, use a content blocker, or install Google’s Analytics opt-out add-on.

9. Your choices

Because we hold no contact details, we can only act on requests made through a support ticket from the account concerned, or with that ticket’s code and key. Depending on where you live, you may have rights to see, correct or object to how your data is used; raise them the same way. We hold no name or email address, so we cannot look anyone up by either.

10. Age

The Services are only for people aged 18 or over.

11. Changes

We may change this policy at any time. Changes take effect when they are published here. The date at the top of this page shows the latest version.