Privacy policy

Privacy Policy

Last updated: October 10, 2026

At ZCraft Studios, we respect your privacy and only collect information that is reasonably necessary to operate our website, provide our products and services, process purchases, and communicate with you.

This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices available to you.

1. Information We Collect

Depending on how you use ZCraft Studios, we may collect:

Account information

When you create an account or sign in, we may collect your email address and authentication-related information required to maintain your account.

When you sign in using Discord, Supabase handles authentication and we receive the account identifiers, email address and profile information needed to connect your purchases to your customer account. We use the account and Discord user ID to verify purchase support eligibility. Where you use a subscription that includes a Discord role or server membership, we process the identifiers and permissions needed to provide that feature. We do not receive your Discord password.

We use this information to:

• Create and maintain your account
• Authenticate your identity
• Provide access to your library, purchases, licenses, and downloads
• Verify eligibility for purchase support and subscription features
• Send important account and security notifications

We do not ask you to provide information that is unnecessary for these purposes.

Purchase information

Our direct store uses Creem and/or Ziina for checkout, depending on the options available for the product. The provider processes payment information. We retain purchase references, purchased products, amounts and currencies, payment status, provider and customer identifiers, license records, and refund or dispute events so we can fulfill orders and manage access. We do not store full card numbers or card security codes.

If you choose BuiltByBit, checkout and files purchased there are handled in your BuiltByBit account under that provider's policies.

Subscriptions and plan features

If you subscribe to a plan or tier, we retain the subscription status, plan, billing provider references and events, and any Discord identifiers needed to grant or remove the role or access included in that plan. Subscription features may change as we add or update plans; the information we process for a feature is limited to what that feature needs.

Newsletter information

If you subscribe to our newsletter, we collect your email address and may record the source through which you subscribed.

Newsletter emails may include new releases, meaningful updates, announcements, new plan or tier announcements, or promotions. They are sent through SendPulse.

You can unsubscribe from marketing emails at any time.

Downloads and purchase support

We record requests for protected download links, including the account, purchase, product, release version and time of the request. These records help us provide support, measure product activity and investigate misuse; they do not confirm that a file transfer completed. Authorized staff can review customer purchase and download records and may pause new download links while investigating an access issue. Access changes and their reasons are logged.

Purchase support tickets and replies are stored with the account and purchase reference. We send purchase confirmations and staff support replies by email through SendPulse. These emails may contain product names, purchase or ticket references, and the staff reply. The reply button opens the signed-in ticket page; replying directly to the sender email does not automatically add a message to a ticket.

Support and custom requests

If you contact us for support or submit a custom request, we may receive information you choose to provide, including your name, email address, project details, technical information, screenshots, logs, or other information necessary to respond to your request.

Please avoid sending passwords, API keys, authentication tokens, payment credentials, or other secrets when contacting support.

Technical information

When you use our website, certain technical information may be processed automatically by our hosting, security, authentication, analytics, or infrastructure providers. This may include information such as IP address, browser type, device information, request information, and basic usage data.

We use this information where necessary to operate, secure, troubleshoot, and improve the website.

2. How We Use Your Information

We use personal information only for legitimate purposes connected with operating ZCraft Studios, including:

• Providing and maintaining accounts
• Processing and fulfilling purchases and subscriptions
• Providing downloads, licenses, and subscription features
• Responding to support requests
• Delivering authentication and security emails
• Sending newsletters when you have subscribed
• Processing custom service requests
• Preventing fraud, abuse, and unauthorized access
• Maintaining the security and reliability of our services
• Improving our website and resources
• Meeting applicable legal or regulatory obligations

We do not sell your personal information.

3. Authentication and Account Security

ZCraft Studios uses third-party infrastructure to provide authentication and account services.

Security-related emails may be sent when actions occur on your account, such as signing in, changing your password, changing your email address, or modifying available sign-in methods.

These messages are considered important service communications and may be sent regardless of whether you have opted out of promotional emails.

We use account-based and request-based limits to protect sign-in, checkout, support and download-link requests. For the website's sign-in attempt limit, we store a daily keyed hash derived from the platform-provided IP address, a counter and an expiry time, rather than the raw IP in that limit table. Infrastructure providers may separately process IP addresses and request logs for security and reliability.

You are responsible for keeping your account credentials and devices secure. Never share passwords, verification codes, recovery links, or authentication tokens with anyone.

4. Service Providers

We use trusted third-party services where necessary to operate parts of ZCraft Studios:

• Supabase for authentication, database and private file storage
• Vercel and/or Cloudflare for hosting, delivery and security
• Discord for Discord sign-in and applicable subscription features
• Creem and Ziina for direct checkout
• SendPulse for service emails and opted-in newsletters

BuiltByBit is an optional external marketplace with its own account, payment and privacy practices.

Providers receive the information necessary for their role, such as an email address, account identifier, order information, or technical information required to perform the requested service. Payment providers may handle some payment information under their own policies. We do not authorize service providers to use your information for purposes unrelated to the services they provide to us.

5. Cookies and Similar Technologies

Essential cookies and browser storage keep sign-in sessions, cart contents, checkout return context, preferences, and a short-lived list of owned product slugs used to display account actions. The owned-product display hint expires after fifteen minutes and does not authorize downloads.

Optional site analytics follow your consent choice. Hosting and security services may process request information to detect abuse.

You can control cookies through your browser settings, although disabling necessary cookies may prevent parts of the website from functioning correctly.

6. Data Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including maintaining accounts, providing purchased products, licenses and subscriptions, handling support, resolving disputes, preventing abuse, and meeting legal or accounting obligations.

When information is no longer required, we may delete or anonymize it where appropriate.

Some information associated with purchases, licenses, transactions, support, download activity, access changes, or legal obligations may need to be retained for longer periods.

7. Data Security

We take reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction.

Access to information is limited to systems, personnel, and service providers that require it for legitimate operational purposes.

However, no online service can guarantee absolute security. You should also take reasonable precautions to protect your account and personal information.

If you believe your account has been compromised, contact us as soon as possible.

8. Your Rights

Depending on applicable law, you may have rights regarding your personal information, including the ability to request access to, correction of, restriction of, or deletion of certain personal information.

You may also have the right to object to or withdraw consent for certain processing activities where consent is the applicable legal basis.

These rights may be subject to legal or legitimate business requirements, such as information that we are required to retain for transactions, security, fraud prevention, or legal compliance. Deleting your account may affect your access to purchased files, subscriptions, and support, and records needed for disputes or accounting may be retained.

To make a privacy-related request, contact us using the contact information provided below.

9. Marketing Communications

If you subscribe to our newsletter, you can unsubscribe at any time using the unsubscribe option included in our marketing emails.

Unsubscribing from marketing communications does not necessarily stop important transactional or security-related emails, such as purchase receipts, subscription notices, account notifications, password changes, or authentication messages.

10. Third-Party Websites

Our website may contain links to third-party websites, services, Discord servers, documentation, marketplaces, or other platforms.

Once you leave ZCraft Studios, their own privacy policies and terms apply. We are not responsible for the privacy practices or content of third-party services.

11. Children's Privacy

ZCraft Studios is not intentionally designed to collect personal information from children.

If you believe a child has provided personal information to us without appropriate authorization, please contact us so that we can review and take appropriate action.

12. International Processing

Some of our service providers may process or store information in countries other than your country of residence.

Where personal information is transferred across borders, we take reasonable steps to use appropriate safeguards and comply with applicable data protection requirements.

13. Changes to This Policy

We may update this Privacy Policy when our services, plans, data practices, or legal requirements change.

When we make changes, we will update the Last updated date shown at the top of this page.

Your continued use of ZCraft Studios after an updated policy is published means that the updated policy applies to your continued use of the services, to the extent permitted by applicable law.

14. Contact Us

If you have a question about this Privacy Policy, want to exercise a privacy right, or have a concern about how your information is handled, contact ZCraft Studios at Support@zcraftstudios.com or through our official support channels.

When contacting us about a privacy request, please provide enough information for us to identify your account or request, but do not send passwords, payment credentials, or other sensitive authentication information.

ZCraft Studios

Your privacy matters. We aim to collect only what we need, use it for clear purposes, and protect it with appropriate safeguards.