Privacy Policy

We collect as little as we can to sell and deliver Flux, and we never sell your data. This policy explains what we collect, why, who receives it, how long we keep it and what rights you have.

1. Who is responsible

The seller below is the controller of your personal data: the one who decides how and why it is used. "We", "us" and "our" mean the seller.

2. What we collect and where it comes from

From Discord, when you log in. You can only log in with Discord. Discord gives us:

• your Discord user id, username, display name and avatar;
• your email address, if Discord has verified it.

We do not get your Discord password, messages or servers, and we do not keep the access token Discord gives us during login. Your profile is updated each time you log in.

When you use the site.

• Account records: your role, whether your account is banned and why, your referral code, who referred you, when you joined and last logged in.
• Sessions: while you are logged in, we keep a hash of your session token (never the token itself), when the session started, was last used and ends, a hashed IP address and your browser's user agent (the browser and system name your browser sends).
• Hashed IP addresses: we turn IP addresses into a one-way keyed hash straight away and store only the hash, never the address. We use it for security, rate limits and referral fraud checks (for example, whether a referral comes from the referrer's own connection). A hash like this can still count as personal data.
• Your cookie choice, in a cookie. See the Cookie Policy.

When you buy.

• Purchases in our store: you pay in our Flux store on SellAuth (sellauth.com). SellAuth collects what it needs for the checkout and the payment there (see section 4). In our SellAuth account we see the details of your order, such as the order number, the product, the price, the time, the payment method and status, and the email address and other details you give at checkout. We use them to deliver your license, to support you and to keep our records.
• Buying from this site: when you start a purchase here while logged in, we record the order (plan, price, time, status, and when you accepted the Terms and asked for immediate delivery) and send SellAuth what it needs to open your checkout: the product, your account id, the email address from your Discord account if you shared it with us, and your IP address and browser details for its fraud checks. When you have paid, SellAuth tells us the order number and the product, and we add the license to your account.
• Redeem keys: the store gives you a redeem key, which you redeem in our Discord server or in your dashboard. We store only a keyed hash of each key and its last 4 characters, and when it is redeemed, by which account, where (Discord or this site) and which license it gave.
• Orders on this site: the plan, price and currency, payment method, payment reference, status, order code, when the order was created, paid or refunded, which license it paid for and who referred you (if anyone).
• We never receive your card or bank details or the login of your payment account.

Licenses and the Flux client.

• Licenses: plan, status, end date, how many computers are allowed and, if a license was revoked, when and why. The license key is stored encrypted, together with a keyed hash of it and its last 4 characters.
• Computers (devices): when Flux activates or checks your license, it sends your license key, a hash of your computer's hardware id (not the hardware id itself), separate hashes of its hardware parts (machine id, SMBIOS UUID, board and CPU model, never the values themselves), your computer's name (its hostname, which often contains a real name) and the Flux version. We hash the hardware id hash and the part hashes again before storing them, so that a reinstall or one changed part still counts as the same computer. We keep them with the computer's name, the Flux version, when the computer was first and last seen, a hashed IP address and, for removed computers, when they were removed and whether by you or by staff.
• Launches: each time Flux starts or rechecks its license, we record the time, the license, the computer's name, the Flux version, a hashed IP address and the result (for example started, expired or used on another computer). A start refused because the license is full also keeps the computer's hashes, so that you can let that computer in from your dashboard. This helps us stop key sharing and answer support questions.
• Downloads: when you get a download link and download Flux. Your download is made for you, with your license key built in.
• Files on your account: the licensed Flux keeps its files on your account instead of in the game folder: configs, module settings, themes, HUD layout, macros and your friends list (the nicknames you add). The first time a computer starts this version, settings an older version left in the game folder are copied once to your account, if it has none yet. These files are encrypted at rest and limited to 2 MiB per file and 16 MiB in total. They are not shared with anyone and not shown on this site.

Referral program. Who referred whom, commissions (order or redeem key, amount, rate, status and when they become payable), payout requests and payouts (amount, method, the payout address you give us, reference and notes), visits to your referral link (time, a hashed IP address, whether it was a new visitor and the website the visit came from) and any referral settings on your account.

Suggestions and reviews. What you post, when, your rating, the votes you give, and whether you chose to post without your name. Posts without your name are shown as anonymous to everyone else, but staff can still see who wrote them. New posts are also shared in our Discord server (anonymous ones without your name).

Audit log. A record of important events: logins, orders and payments, license and computer changes, downloads, referral events and staff actions. Each entry has the time, the account involved, a hashed IP address and details such as the plan, amount, computer name or a reason.

Support and community. Support happens in our Discord server. What you post there is handled by Discord under its own terms and privacy policy, and our staff can read what you send them. When a ticket is deleted, our Discord bot saves a transcript of it in a staff-only Discord channel and sends you a copy by direct message, if your direct messages are open.

Stored only in your browser. The Effects setting is kept in your browser's local storage and is never sent to us.

Do you have to give us this data? You need a Discord account to log in, and we need the data described in this section to sell and deliver a license. Without it we cannot sell to you. The referral cookie is optional.

3. Why we use it and our legal bases

We rely on these legal bases, as defined in the EU and UK GDPR and in Georgia's Law on Personal Data Protection:

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (section 9). We do not use your data for advertising, we do not use analytics or tracking tools, and we do not sell your data.

4. Who receives it

• Discord, for login, for support and our community, and, if you are in our server, to give or remove the Customer role (we send Discord your Discord user id). Profile pictures on this site are loaded from Discord's servers, so your browser connects to Discord when it shows them.
• SellAuth (sellauth.com), which runs our store and its checkout. When you buy, you give your checkout details to SellAuth, and SellAuth and the payment provider you choose there handle your payment and send your receipt. SellAuth processes the checkout and order data for us as our processor and, for its own purposes, as an independent controller under its own terms and privacy policy. The payment provider you choose processes your payment as an independent controller under its own terms and privacy policy. If you open a dispute, we may give SellAuth or the payment provider your order, license and delivery records.
• Our hosting provider, which runs the site for us and stores its data on our behalf. The site, its database and its file storage run on a server we rent from exy.sh. Our hosting provider receives your IP address and the requests your browser sends when you use the site, and may keep them in short-lived technical logs. File storage holds the Flux files, not your personal data.
• LRCLIB (lrclib.net), if you use the lyrics of the Music HUD module. Flux asks LRCLIB directly for the lyrics of the song you are playing, so LRCLIB receives the song title, artist and length, and your IP address as with any web request. We do not receive any of this. You can turn Lyrics off in the settings of Music HUD.
• Authorities and advisers, when the law requires it, or when needed to establish, exercise or defend legal claims.
• A successor, if Flux is transferred to someone else, who would then be bound by this policy for the data they receive.

Inside our team, only staff who need it can see account and order data, depending on their role.

5. International transfers

We are based in Georgia, and our server runs in a data centre of our hosting provider in another country. You can ask us which one (section 12). Some of our providers, such as Discord and SellAuth, are based in or process data in the United States and other countries, where data protection law may differ from yours. Where the law requires it, these transfers rely on appropriate safeguards, such as the standard contractual clauses our providers offer.

6. How long we keep it

• Sessions end 30 days after you log in, or earlier when you log out. Logging out deletes the session, and ended sessions are deleted by a daily cleanup.
• The Discord login cookie lasts 10 minutes. Rate-limit records are deleted by the daily cleanup once their time window has passed.
• Launch records are deleted by the daily cleanup after 90 days.
• Referral link visits are deleted after one year.
• Your account, licenses, computers and their hashes, orders, referral records and the audit log are kept while your account exists. Our system does not delete them automatically. Records of removed computers are kept too, because they count towards your computer (HWID) changes.
• Files on your account are kept until you use Reset settings on your dashboard, or until your account is deleted on request.
• Ticket transcripts stay in our staff-only Discord channel, for support and to deal with disputes. They are not deleted automatically: ask us if you want yours removed.
• If you ask us to delete your account, we delete or anonymise your personal data: your name, avatar, email address and Discord id, your sessions, computers, launch records, files on your account and votes. Your licenses end, unpaid commission lapses, and your reviews and suggestions stay without your name. We keep what we must or may keep: orders and payment records are kept for as long as tax and accounting law requires, and records needed to prevent fraud, enforce a ban or deal with a legal claim (for example a chargeback) are kept for as long as they are needed for that.
• Deleted data may stay in our own backups for about two weeks, and in our providers' backups for a limited time, until it is overwritten.
• Data held by Discord, SellAuth, LRCLIB or your payment provider follows their own policies.

7. Security

• The site is served over HTTPS only.
• Session tokens are stored only as hashes, so a copy of our database cannot be used to log in as you.
• License keys and files on your account are encrypted at rest, and keys are looked up by a keyed hash. IP addresses, hardware ids and hardware parts are stored only as one-way hashes.
• Downloads use short-lived signed links, and the Flux files are kept in private storage.
• Staff access depends on their role, and important actions are recorded in the audit log.

No system is perfectly secure, but we work to protect your data and will act quickly if something goes wrong.

8. Automated checks

Some checks run automatically: rate limits, and referral checks such as same-connection detection. They do not make decisions with legal or similarly significant effects on their own, and you can ask us to look at any result again.

9. Your rights

Depending on where you live, you have the right to:

• access your data and get a copy of it;
• have it corrected (your Discord profile data is also updated each time you log in);
• have it deleted;
• restrict how we use it;
• receive it in a portable format (data portability);
• object to uses based on legitimate interests;
• withdraw your consent at any time (for the referral cookie, use Cookie settings), without affecting what happened before;
• complain to a data protection authority: in Georgia, the State Audit Office of Georgia (which took over the work of the former Personal Data Protection Service on 2 March 2026); in the EU, the authority in the country where you live or work; in the UK, the Information Commissioner's Office.

To use these rights, contact us through our Discord server. We may ask you to confirm that the account is yours, for example by writing to us from the Discord account it belongs to. We answer within the time limits the law sets. Some rights have limits, for example we cannot delete records that the law requires us to keep.

10. Children

Discord requires its users to be at least 13 (or older in some countries), so we do not knowingly collect data from younger children. Buyers under 18 need a parent or guardian to agree to the Terms and to make or approve the purchase. If you think a child has given us personal data, contact us and we will delete it, except records we must keep.

11. Changes

We may update this policy. The new version is published on this page with a new "Last updated" date, and for important changes we also post a notice on the site or in our Discord server.

12. Contact

For privacy questions and requests, contact us through our Discord server.