zArrowTan Resources
Privacy
What this store keeps about you, why it keeps it, and how to take it back. Written from what the site actually does, not from a template.
Last updated September 14, 2026
The short version
An account, what you bought, and what is needed to deliver it and keep the rewards programme honest. No advertising cookies, no third party trackers, no analytics scripts, and nothing sold to anyone. Your whole record downloads from your profile in one file, and the same page deletes the account.
What an account holds
Signing up stores your name, email address, a hashed password, and the date the address was confirmed. Anything you add later sits beside it: an avatar, your light or dark preference, two factor settings, passkeys, your points balance and the code behind your referral links. Passwords are hashed, never readable, and two factor secrets and passkeys are stored in the form their standards require.
What buying records
An order keeps who placed it, what was in it, the currency, any coupon or store credit used, the payment status, and the IP address the order was placed from. The last one is kept for fraud and chargeback questions, nothing else. Buying also creates a licence row, which is what gives your account access to the files afterwards. No card or wallet details ever reach this store.
Payments
Payment happens on the provider you pick, and only what that provider needs is sent. PayPal receives the amount, the currency and the order number. Plisio, for crypto, receives the order number, the amount and your email address, which is what their invoice notice is sent to. Both send back a status, which is all that is stored here. Their own handling of your data is covered by their policies, not this one.
Cookies
The store sets a session cookie and a form security token, both needed to stay signed in, and a small cookie remembering whether you chose light or dark. Arriving through someone's referral link adds two more: the referrer, for 30 days, and a random id for the browser, for 400 days, which is how a commission is matched to the right person later. That is the whole list. There are no advertising cookies, no third party trackers and no analytics scripts running on this site today. If site analytics is ever switched on, the cookie notice asks first and nothing loads until you agree.
Keeping the referral programme honest
While you are signed in, four signals are noted so a second account can be told apart from a real referral: your address, the network it belongs to, the browser id cookie above, and a rough browser fingerprint. Each one is stored only as a keyed hash, so the table cannot be read back into an address or a browsing history, and it is used for exactly one thing: deciding whether a referral commission is genuine. When a referred order arrives, the address it came from is checked against proxycheck.io, a VPN and proxy lookup service, which receives the address and nothing else. Your active sign in sessions also record the address and browser they were started from, as any login system does.
Discord
Linking Discord stores your Discord user id and the access tokens that link needs. It is what lets the bot hand you the roles your purchases come with, and send you a direct message when something happens on your account. Every notification type has its own switch in your notification preferences, and unlinking Discord from your profile removes the link and the tokens with it.
BuiltByBit
Many of these products are also sold on BuiltByBit, and buyers there get the same Discord roles here. To do that, the store reads the list of licence holders for its own products from BuiltByBit once a day, and keeps their member id and their linked Discord id. Roles are only ever given to people who linked Discord to an account on this store; a BuiltByBit purchase is a reason to give a role, never a way in on its own.
Email is used for the things an account needs: confirming the address, resetting a password, order and download notices, licence expiry reminders, a nudge about a cart left behind, and a note when something on your wishlist goes on sale. Each of those is a switch you control in your notification preferences. A record of what was sent, to which address, is kept so a missing email can be traced.
What is measured
Product pages count views, listing appearances, cart clicks, wishlist adds and downloads as plain daily numbers per product. They are totals, not profiles: no account or address is attached to them, and they cannot be traced back to a person.
Where it is kept, and for how long
Everything runs on our own rented server, with uploads and product files on object storage. The database is backed up daily, and those backups are thinned out over time rather than kept forever. Points expire after 12 months and store credit a year after it is made, both of which the rewards page states. Order and payment records are kept for as long as accounting and dispute handling need them.
Your copy, and deleting your account
Your profile has a button that downloads everything the store holds about you as a single file: account, linked accounts, orders, licences, reviews, wishlist, cart, notifications and preferences, emails sent to you, and API tokens. The same page deletes the account. Deleting takes the account with its orders, licences, reviews, wishlist, cart, points, store credit, payout requests, passkeys, linked accounts, notifications and the anti abuse signals above. Two things outlive it, on purpose: the log of emails the store sent, which keeps the address it went to, and the admin action log, which records what was changed with the account link removed. Deleting also ends access to anything bought, and deleting an account is not a reason for a refund, so download your files first.
Sharing
Your data is not sold, rented or handed to anyone for marketing. It leaves this store only for the payment provider you choose, Discord when you link it, the VPN lookup described above, and the services that host the server, the storage and the email, all of which are used to run the store and nothing else. It may also be handed over where the law requires it.
Age
Accounts are meant for people old enough to buy software on their own. If you are under that age where you live, ask whoever is responsible for you to buy on your behalf.
Changes and questions
This page changes when the store does, and the date at the top says when it last did. Anything unclear, or a request about your data, goes to Discord and is answered there.
Asking about your data
Discord at discord.arrowtan.cc. The download and delete buttons are under your profile.
