zArrowTan Resources
Privacy
What this store keeps about you, why it keeps it, and how to take it back. Written from what the site actually does, not from a template.
Last updated September 29, 2026
The short version
An account, what you bought, and what is needed to deliver it and keep the rewards programme honest. Visits are counted by analytics that run on our own server with no cookies and no link to your account. When you are signed in, the store remembers which products you look at so it can put what you like first. No advertising cookies, no third party trackers, and nothing sold to anyone. Your whole record downloads from your profile in one file, and the same page deletes the account.
What an account holds
Signing up stores your name, email address, a hashed password, and the date the address was confirmed. Anything you add later sits beside it: an avatar, your light or dark preference, two factor settings, passkeys, your points balance and the code behind your referral links. Passwords are hashed, never readable, and two factor secrets and passkeys are stored in the form their standards require.
What buying records
An order keeps who placed it, what was in it, the currency, any coupon or store credit used, the payment status, and the IP address the order was placed from. The address is kept for fraud and chargeback questions, nothing else. The order also notes where the visit that led to it came from: the site that linked here, any campaign tags in that link, and the first page you landed on. That rides the session you already have, with no extra cookie, and tells us which links bring buyers. Buying creates a licence row, which is what gives your account access to the files afterwards. No card or wallet details ever reach this store.
Payments
Payment happens on the provider you pick, and only what that provider needs is sent. PayPal receives the amount, the currency and the order number. Creem, for card and wallet payments, receives the amount, the order number and your email address, and collects your billing country itself to work out the tax it owes as merchant of record. Plisio, for crypto, receives the order number, the amount and your email address, which is what their invoice notice is sent to. Each sends back a status, which is all that is stored here. Their own handling of your data is covered by their policies, not this one.
Cookies
The store sets a session cookie and a form security token, both needed to stay signed in, and a small cookie remembering whether you chose light or dark. A cookie that lasts one hour lists the product pages you opened in that hour, so refreshing a page does not count as a second view. Arriving through someone's referral link adds two more: the referrer, for 30 days, and a random id for the browser, for 400 days, which is how a commission is matched to the right person later. That is the whole list. There are no advertising cookies and no third party tracking cookies.
Visit analytics
Visits are counted with Umami, which runs on our own server and is loaded from this site's own address. It sets no cookies and stores nothing on your device. For each page view it records the page, the site that linked to it, your browser, operating system, device type, screen size and language, and your country and rough location as worked out from your IP address; the address itself is not kept. Visits are grouped under an anonymous id that changes over time and is never linked to your account, your orders or anything else in this policy. Only our team sees the results, and they are used to understand which pages and links work.
“For you”, the personal product order
When you are signed in, the store remembers which product pages you open: the product, how many times, and when you first and last looked. Together with your wishlist, your cart and what you have bought, that is used for one thing: the “For you” order of the product list, which puts what you seem most interested in first. Older activity counts for less as it ages and is forgotten after 120 days, so the order follows your taste as it changes. It is not used for advertising, not shared, and not used to decide what we email you. Guests are not tracked this way at all, and you can pick any other order from the sort menu. These views are in your data download and are deleted with your account.
Keeping the referral programme honest
While you are signed in, four signals are noted so a second account can be told apart from a real referral: your address, the network it belongs to, the browser id cookie above, and a rough browser fingerprint. Each one is stored only as a keyed hash, so the table cannot be read back into an address or a browsing history, and it is used for exactly one thing: deciding whether a referral commission is genuine. When a referred order arrives, the address it came from is checked against proxycheck.io, a VPN and proxy lookup service, which receives the address and nothing else. Your active sign in sessions also record the address and browser they were started from, as any login system does.
Test servers
Starting a free test server records your account, the product, the location you picked, the Minecraft name you gave, any friends you added as operators, and, for cracked clients, the join code. To suggest the nearest location, the store works out your country from your IP address, using the same proxycheck.io lookup (which also warns when a VPN is in the way), or from your browser's time zone. That country is kept in your session and saved with each test server you start, for our statistics on where testers come from. Test servers run on machines rented from hosting partners, named on the test server tab, and your game connects straight to that machine, which sees your IP address as any Minecraft server does. The server's console output is kept for 30 days to look into problems, then deleted. It contains the names of the players who joined and, as Minecraft logs by default, the addresses they joined from. Your test server history is deleted with your account.
Discord
Linking Discord stores your Discord user id and the access tokens that link needs. It is what lets the bot hand you the roles your purchases come with, add you to our Discord server (Discord's own authorise screen asks for this when you link), and send you a direct message when something happens on your account. The server itself greets members by name when they join and notes when they leave, and purchase and review announcements there show the buyer's or reviewer's name on this store, or “Someone” where buyer names are hidden. Every notification type has its own switch in your notification preferences, and unlinking Discord from your profile removes the link and the tokens with it.
BuiltByBit
Many of these products are also sold on BuiltByBit, and buyers there get the same Discord roles here. To do that, the store reads the list of licence holders for its own products from BuiltByBit once a day, and keeps their member id and their linked Discord id. Roles are only ever given to people who linked Discord to an account on this store; a BuiltByBit purchase is a reason to give a role, never a way in on its own.
Email, and the contact form
Email is used for the things an account needs: confirming the address, resetting a password, order and download notices, licence expiry reminders, a nudge about a cart left behind, and a note when something on your wishlist goes on sale. Each of those is a switch you control in your notification preferences. A record of what was sent, to which address, is kept so a missing email can be traced. The contact form keeps your name, email address, topic, any order number, your message, and the IP address and browser it was sent from, so we can answer and spot abuse. Messages are archived once they have been dealt with and deleted 30 days after that.
Reviews
A review is public: it shows your name, your rating, what you wrote and the version you reviewed. Screenshots or videos attached as proof, which low ratings need, are stored with it. Deleting your account deletes your reviews.
Product numbers
Separately from all of the above, product pages count views, listing appearances, cart clicks, wishlist adds and downloads as plain daily numbers per product. They are totals, not profiles: no account or address is attached to them.
What other services load
Some product pages show things hosted elsewhere, and loading them means your browser asks that service for them, which lets it see your IP address like any website would. Product videos come from YouTube in its privacy enhanced mode, which sets no cookies until you press play; 3D models from Sketchfab; the odd video that could not be copied here from Google Drive; and flag images on the test server tab from flagcdn.com. Product images are served through Cloudflare. If the sign in or sign up form shows a captcha, it is Cloudflare Turnstile, which checks the visit is not a bot.
Where it is kept, and for how long
Everything runs on our own rented server, with uploads and product files on object storage. The database is backed up daily, and those backups are thinned out over time rather than kept forever. Points expire after 12 months and store credit a year after it is made, both of which the rewards page states. Product views for “For you” are forgotten after 120 days, test server console logs after 30, and archived contact messages 30 days after they are archived. Order and payment records are kept for as long as accounting and dispute handling need them.
Your copy, and deleting your account
Your profile has a button that downloads everything the store holds about you as a single file: account, linked accounts, orders, licences, reviews, wishlist, the product views behind “For you”, cart, notifications and preferences, emails sent to you, and API tokens. The same page deletes the account. Deleting takes the account with its orders, licences, reviews, wishlist, product views, cart, test servers, points, store credit, payout requests, passkeys, linked accounts, notifications and the anti abuse signals above. A few things outlive it, on purpose: the log of emails the store sent, which keeps the address it went to; the admin action log, which records what was changed with the account link removed; and contact form messages, which lose their link to the account and are deleted on their own schedule. Deleting also ends access to anything bought, and deleting an account is not a reason for a refund, so download your files first.
Sharing
Your data is not sold, rented or handed to anyone for marketing. It leaves this store only for the payment provider you choose, Discord when you link it, proxycheck.io for the address checks described above, the hosting partner running a test server you start, the services that load content on product pages, and the services that host the server, the storage and the email, all of which are used to run the store and nothing else. It may also be handed over where the law requires it.
Age
Accounts are meant for people old enough to buy software on their own. If you are under that age where you live, ask whoever is responsible for you to buy on your behalf.
Changes and questions
This page changes when the store does, and the date at the top says when it last did. Anything unclear, or a request about your data, can be sent to us through the options below.
Asking about your data
Discord at discord.arrowtan.cc. The download and delete buttons are under your profile.
Or write to contact@arrowtan.store, which reaches our team directly.
