Data & Privacy

An overview of what information Sorrel Hub collects from accounts and how it is handled.

What Is Stored

Account Data

When you create an account:

• Email address.
• Hashed password (plain text is never stored).
• Username and display name.
• Account creation date.

Profile Data

Optional information you can set from the dashboard:

• Avatar image.
• Display name.
• Bio text.
• Status (text and state).

Product & Subscription Data

• Active subscriptions per product.
• Sub ID per product.
• HWID bound to your account.
• Key redemption history.

Session & Auth Data

• Active sessions.
• Linked OAuth providers (Discord, Google, GitHub) — only the account ID and username from the provider, no tokens.
• TOTP 2FA state (secret stored encrypted, recovery codes stored as hashes).
• Trusted device records (14-day duration, revokable from dashboard).

Loader Events

Every loader authentication attempt is logged — successful or failed. This is used for security auditing, not analytics. Logs are not shared publicly.

Forum & Chat

Forum posts, comments, and reactions are stored and associated with your account. Chat messages in product channels are stored and periodically pruned (only recent messages are kept).

What Is Not Stored

• Plain text passwords.
• OAuth tokens from linked providers.
• Script payloads — these are generated on demand and never persisted per-request.
• Payment card details — payments are processed by the payment provider.

Data Access

• Your account data is accessible only to you from the dashboard.
• Administrators can access account data for moderation purposes.
• No account data is sold or shared with third parties.

Moderation

Accounts can be suspended or banned for violating the platform rules. Moderation actions are logged internally for audit purposes. HWID bans may be applied in cases of serious abuse.

Data Deletion

To request account deletion, contact Winner through Discord. Account deletion removes your profile, linked data, and subscriptions.