Privacy Policy

Last updated 8 September 2026.

Who this covers

This policy applies to xyphros.net and its subdomains (including portal.xyphros.net and staff.xyphros.net), operated by Xyphros Studios ("we", "us"). If you have questions about anything here, email hello@xyphros.net.

What we collect

• Account details: name, email address, and a bcrypt-hashed password. We never store your password in plain text and can't recover it for you (only reset it).
• Discord details, if you link your account: your Discord user ID, username, and avatar. This is optional, but required if you want to buy a store item that grants a Discord role, since that's the only reliable way we've found to hand the role to the right person.
• Purchase records: which package you bought, when, and the order status. Card and payment details are never sent to or stored by us: our payment processor, Tebex, handles those directly and we only ever see the result.
• Contact form submissions: your name, email, and message, so we can reply.
• Basic security logs: IP address and timestamp on account signup and failed login attempts, kept only to detect abuse and enforce the login rate-limit described in our Terms.

We don't run analytics, ad tracking, or behavioural profiling on this site. There's no tracking pixel or third-party analytics script anywhere on xyphros.net.

Why we collect it

• To create and secure your account, and keep you signed in across our products.
• To deliver what you paid for: including granting a Discord role through our store, or generating a license key for a Portal purchase.
• To reply to messages you send us.
• To keep the site secure (rate-limiting logins, spotting abuse).

Who we share it with

We don't sell your data. It's shared only with the third parties that make the site actually work:

• Tebex: our payment processor and store platform. Buying something sends your email and order details to Tebex; for a purchase that grants a Discord role, we also pass along your already-linked Discord ID so Tebex's Discord integration can grant it.
• Discord: if you choose to link your account, Discord's OAuth login tells us your Discord ID, username, and avatar. Our bot uses your Discord ID only to grant the role your purchase paid for.
• Google Fonts: this site loads webfonts from Google's servers, which can see the requesting IP address as part of a normal font request.
• Our email provider: used to send account verification codes and contact-form replies.

Cookies

We only set cookies that are strictly necessary for the site to function. See the full list on our Cookies Policy. There are no advertising or analytics cookies.

How long we keep it

Account data is kept for as long as your account exists. Contact-form messages and security logs are kept only as long as needed to act on them or investigate abuse, and are periodically cleared out.

Your rights

You can review and update most of your account details yourself from Account settings, including unlinking Discord at any time. To access, correct, or delete data we hold about you (including closing your account entirely), email hello@xyphros.net and we'll action it. We don't currently have a fully self-service "delete my account" button; requests are handled by a real person, by email.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page.