Privacy Policy

1. Who we are

CTY Software operates CTY Auth and is responsible for the personal data described in this policy, except where section 3 says we handle it on behalf of a seller.

You can reach us at [email protected] with any privacy question or request.

2. The data we collect

• Account data: your name, email address, password (stored only as a one-way hash), two-step verification settings, avatar, and the time and IP address of your last sign-in.
• Workspace data: your applications, license keys, prices, team members, balances, payout requests, the resources you upload and the settings you choose.
• Security and usage data: IP addresses, browser details, the activity log of actions taken in the panel, and trusted-device records.
• Data about the users of your apps: license key, device identifier, IP address, approximate location (country and city), app version and times, collected when your app checks a key.
• Messages: what you send us on Telegram or by email and, if you use the in-panel AI assistant, your conversations with it.
• Website visits: our marketing and documentation pages set no cookies and use no analytics. Like any website, our servers and network provider see your IP address and browser details when you load a page.

Our Data We Collect page lists each category with its purpose and how long we keep it.

3. When we act for a seller

When a seller's app checks a license key, we process data about that app's users on behalf of the seller. That data belongs to the seller, and we handle it only on the seller's behalf. We use it only to provide the Service to that seller: verifying keys, enforcing device limits and bans, showing live sessions and statistics, and sending the login alerts the seller turned on.

Sellers are responsible for informing the users of their apps about this data. App users with a request about their data should contact the seller first; we will help the seller respond.

4. How we use personal data

• To create and run your account and workspace and provide the features of your plan.
• To keep the Service secure, prevent abuse and fraud, investigate problems and keep an audit trail.
• To answer your messages and support requests.
• To meet our legal obligations and to protect our rights.

We do not sell personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing.

5. Who we share data with

We share personal data only with the service providers we need to run the Service, and only as much as each of them needs:

• Cloudflare, Inc. (United States): network protection, content delivery, DNS, custom domains and encrypted backup storage.
• Our server hosting provider: the servers that run the Service and its database.
• Google LLC (United States): web fonts loaded by our pages, and the Gemini AI model when you use the in-panel assistant.
• Telegram: login alerts are delivered to the Telegram channel you choose, and support conversations take place there.
• ip-api.com: we send the IP address of an app user to look up its approximate country and city.
• Our email delivery provider: account emails such as address verification and password resets.

We may also disclose data when the law requires it, to protect our rights, or as part of a transfer of the business, in which case this policy continues to apply.

6. Where data is stored

Some of these providers store or process data in other countries, including the United States.

7. How long we keep data

We keep personal data only as long as we need it for the purposes above:

• Account and workspace data: while your account is open. When you ask us to close it, we delete or anonymise it, unless the law requires us to keep part of it longer.
• Key verification history: 90 days.
• Activity log: 90 days.
• AI assistant conversations: 3 days.
• Trusted devices: 30 days.
• Panel sessions: they end after 2 hours without activity.
• Device and session records of app users: as long as the license key exists in the seller's workspace. Location lookups are cached for 7 days.
• Backups: up to 14 days on our servers and up to 35 days in encrypted off-site storage, after which they are deleted automatically.

8. Security

We protect data with encryption in transit (HTTPS), passwords stored only as one-way hashes, optional two-step verification, encrypted off-site backups, servers reachable only through our network provider, and audit logs. No system is perfectly secure, so please use a strong password and turn on two-step verification.

9. Your choices

You can ask us what personal data we hold about you, and ask us to correct it, give you a copy of it or delete it.

To do so, email [email protected] from the address registered on your account. We answer within 30 days.

10. Cookies

Our marketing and documentation pages set no cookies. The panel sets only the cookies it needs to work: a session cookie that keeps you signed in, a security token that protects your forms and, if you choose to trust a device during two-step verification, a cookie that remembers that device for 30 days. We use no advertising or analytics cookies.

11. Children

The Service is meant for people aged 18 and over. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy. The date at the top shows the current version. If a change is significant, we will tell you in the panel or by email before it applies.