Privacy Policy

This Privacy Policy explains how PPUSSH LTD ("PPUSSH", "we", "us", or "our") collects, uses, discloses, and protects your personal information when you use the PPUSSH Accounts service, our website, and related products (collectively, the "Service").

By creating an account or using the Service, you agree to the collection and use of information in accordance with this policy. If you have questions, contact us at support@ppussh.com.

We collect information you provide directly and information generated when you use the Service:

• Account information — your full name and email address, plus a password hashed with Argon2id.
• Risk-based authentication signals — a SHA-256 device fingerprint derived from your browser's User-Agent and language settings, and a one-time 6-digit code emailed to you when we verify a new device.
• Approximate location — a country/region resolved from your IP address via GeoIP (MaxMind) for security and fraud prevention; we do not collect precise location.
• OAuth profile data — your name and email when you sign in with Google or GitHub.
• Billing information — handled by our payment processors (Paddle/Dodo); we store account-level details such as subscriptions and invoices, not your full card number.
• Usage and security logs — IP address, user-agent, timestamps, and session metadata to secure your account.

We use the information we collect to:

• Create and authenticate your account, verify your email, and keep you signed in.
• Provide, maintain, and improve the Service.
• Detect and prevent fraud, abuse, and unauthorized access (including risk-based authentication and rate limiting).
• Process payments, send receipts, and manage subscriptions.
• Respond to support requests and communicate important service updates.
• Comply with legal obligations and enforce our Terms of Service.

Where applicable law requires, we process personal information on the following bases: (1) performance of a contract — to provide the Service you request; (2) legitimate interests — security, fraud prevention, and service improvement; (3) legal obligation; and (4) consent — where you have opted in, including for marketing where offered.

We use cookies to keep you signed in and remember your session so you don't have to log in repeatedly. You can clear or block cookies through your browser settings, though some parts of the Service may not work as expected.

We do not sell your personal information. We share data only with trusted processors who help us operate the Service:

• Database hosting (e.g., Neon / managed PostgreSQL) and Redis for caching.
• Payment processors (Paddle, Dodo) for billing and subscription management.
• Email delivery providers for verification, password reset, and security notifications.
• Analytics and monitoring providers used to operate and secure the platform.

Your information may be processed in countries other than the one where you reside. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses to protect transferred data.

We retain account data for as long as your account is active. Access tokens expire after 15 minutes and refresh tokens after 7 days server-side (rotated on use). Security and audit logs are retained for a limited period for fraud prevention and compliance. When you delete your account, active sessions are revoked and personal data is removed or pseudonymized as required by law.

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You can exercise most of these directly from your account settings.

To request account access, correction, or deletion, contact us at support@ppussh.com. Our administrators may soft-delete an account; the account is then permanently removed in accordance with our retention policy.

We protect your data using industry-standard measures, including Argon2id password hashing, AES-256-GCM encryption for sensitive tokens, and short-lived JWTs. No method of transmission or storage is 100% secure, but we work hard to protect your information.

The Service is not intended for individuals under the minimum age required by applicable law. We do not knowingly collect personal information from children. If you believe a child has provided us their data, contact us at support@ppussh.com.

We may update this policy from time to time. When we make material changes, we will update the "Effective" date above and, where appropriate, notify you by email or in-product notice. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy, contact us at support@ppussh.com.