Legal
Privacy policy
Last updated 24 October 2026
PWF Auth (pwfauth.com) is a licence-key service for developers who sell software. This page says what we collect, why, who helps us run the service, how long we keep it and what you can ask of us. Questions: support@pwfauth.com
Two kinds of people
- Developers (and their resellers) who have an account on pwfauth.com. For their data, we decide how it is used
- Their customers, the people who use a program protected by PWF Auth. The developer decides what their program sends; we store and process it for the developer, on their behalf. Developers must tell their own customers about it, for example in their program's privacy notice
What we collect about developers and resellers
- Your account: name, email address, a hash of your password (never the password itself), your profile picture if you add one, and the time zone you pick
- Sign-in with Google or Telegram, when you use it: your Google account id and email address, or your Telegram id, name and username
- Security: two-step sign-in settings (the secret is stored encrypted), the browsers you are signed in on with their IP address, and a record of security events such as sign-ins and password changes
- How you found us: the page or site you came from when you signed up
- What you put in the panel: your applications and their settings, licence keys, resellers, texts, slides and update files
- Support: messages and pictures you send us, and messages sent through the contact form
- Live chat: the name, the optional email and the messages you write in the chat on the home page, with your network address and country to stop abuse. A closed chat is deleted 90 days after it closes
What we count about visitors of this website
When anyone opens a page of pwfauth.com (signed in or not), we note the page, the site that linked to it, the country (as Cloudflare reports it) and whether it is a phone or a computer. On a blog post we also note how long it was read and how far down the article you got. When you are signed in, we also count the minutes you spend on the site while one of its pages is in front of you, so we can see how the panel is used. To count one person once, we keep a keyed fingerprint made from the address and browser, not the address itself. No cookie is used for this, robots are not counted, and nothing is shared with anyone
What we process for developers about their customers
- The licence key or account (username, email address and a password hash) the customer signs in with
- A hash of the machine id the program sends (we keep the hash, not the id itself), the IP address and its rough location (country and city), and when each session started and last checked in
- A record of sign-ins, refusals and other events, so the developer can see what happened to a key
We use this only to run the service for that developer: to check keys, enforce machine limits, end sessions and show the developer their activity
Why
To provide the service you asked for (your account, the panel and the licence checks), to keep it secure (stopping abuse, password guessing and stolen keys), to answer you when you write to us, and to send the emails the service needs, such as password resets and security notices. We do not sell personal data, we do not show ads, and we do not use advertising trackers
Who helps us run it
| Service | What for |
|---|---|
| Namecheap | The server the service and its database run on |
| Cloudflare | Delivers the site, protects it from attacks, checks that the sign-in, sign-up and contact forms are sent by people (Turnstile), and stores our encrypted backups (in Europe) |
| Brevo | Sends our emails |
| "Continue with Google", when you use it, and the fonts of the site | |
| Telegram | Sign-in, approvals and notices through our bot and developers' bots, when you connect Telegram |
| ip-api.com | Turns an IP address into a country and city for the activity pages |
Each of them receives only what its job needs
Cookies
Only the cookies the site needs to work: pwfauth_sid keeps you signed in during a visit, pwfauth_rm keeps you signed in for 30 days when you tick "Keep me signed in", and pwf_src remembers which page you came from, for up to 60 days or until you sign up. There are no advertising or analytics cookies
How long we keep it
- Your account and what you put in the panel: until you delete it (Profile → Delete account) or ask us to. Backups that still hold it are overwritten within 30 days
- Activity of keys and accounts: 180 days. Ended sessions: 90 days. Update downloads: 365 days
- Your sign-in history and security events: 90 to 365 days. Location lookups: 30 days
- Visits to this website and time spent on it: 400 days
- Backups: daily, encrypted, kept for 30 days, then overwritten
Security
All traffic is encrypted (HTTPS), and the requests and replies of protected programs are encrypted and signed on top of that. Passwords are stored as hashes, two-step sign-in is available to every account, access to the server is limited to people who need it, and backups are encrypted before they leave the server
Your rights
You can see and change most of your data in the panel. Write to support@pwfauth.com to get a copy of your data or to have something corrected; we answer within 30 days. You can delete your account and everything in it yourself, at the bottom of your profile, or ask us to. Customers of a developer should write to that developer first, since the developer decides what their program collects; we help the developer answer
Children
PWF Auth is a tool for developers and is not meant for children under 16
Changes
When this policy changes, we update this page and its date; important changes are also announced on our Telegram channel
See also the terms of service