| What | When | Why |
|---|---|---|
| Purchase email, order ID, payment status | At purchase (sent to us by Paddle) | Apply the pass · support |
| A random ID created on your computer at install (not your name or device info) | When the plugin contacts our server | Free-use counts · pass check |
| Step number and guide name (max 40 characters) | When you request a step guide | Provide the guide |
| Request ID and the pass status your computer knows | When the plugin contacts our server | Request logs · error checks |
| The six-digit code we email you | When you start using it on that computer | Apply the pass |
| A computer identifier — a one-way hash of your computer's hardware ID (we never receive the ID itself) | When you activate a pass · when the plugin contacts our server | Limit each key to 3 computers |
| Product ID (a random number created on your computer when you register the product; products registered earlier may still use the app's bundle ID) | When the plugin contacts our server, once your product has one | Count the products a pass covers (Lite 3 · Plus 15) · check whether a removed product is added back within 30 days |
| The plan you are changing to · your language | When you change plans · when you receive a guide · when you receive a notice email | Plan change · language of guides and emails |
| Your license key | When you change plans, release a computer or activate a key | Identify which pass the request is about |
| A one-way value derived from your connection | When the plugin contacts our server · when you request an email code or a confirmation email | Rate limiting — the value from a server request is deleted after 5 minutes; the value from an email-code or confirmation-email request is deleted after 2 days (to count how many codes one place can request in a day) |
| Access log (IP address, time of access, request type) | When the Nightflight chat, the checkout page or the plan-change page contacts our server | Retention required by the Protection of Communications Secrets Act — deleted after 3 months |
Card numbers, billing address and name are collected by our reseller Paddle.com and are not shared with us. Your code, conversations, files and the records the plugin keeps (decisions, things you tried that did not work, and so on) are never sent to our server; they are stored on your computer. If you agree to use the cockpit view, a copy of those records is uploaded to a private page in your own Claude account; we ask once before the first upload. What goes up: decisions, blocked paths, feature progress, the state of your computer's chip, operating system, memory and storage, the names and stages of other products registered on that computer, the names of files you keep out of GitHub, and the key names in your secrets file. Secret values are never uploaded. We do not receive that page. If you decline, the records are viewed only as files on your computer. Processors and international transfers (legal basis: Article 28-8(1)3 of the Personal Information Protection Act — entrusted processing or storage necessary to perform a contract, disclosed in this policy): Paddle.com Market Ltd (UK, also processed by Paddle entities in the USA, Ireland and Canada; privacy@paddle.com) for payments, tax, receipts and refunds — we send the pass type, your customer number and your language (when you upgrade or buy again) and receive your email, order number and payment status; information you enter directly on Paddle's checkout is governed by Paddle's own policy as the seller. Vercel Inc. (USA; privacy@vercel.com) hosts this website — IP address, access time and browser details, deleted within one day. Plus Five Five, Inc. — Resend (USA, sending from Tokyo, Japan; privacy@resend.com) sends our emails (your six-digit code, pass details, end-of-pass notices with the buy-again link, and plan-change and computer-change confirmation links) — email address and the email contents, logs deleted after 30 days. Supabase, Inc. (privacy@supabase.io) stores our server data in Seoul, Republic of Korea; the network in front of its server functions is operated by Cloudflare, Inc. (USA), so your IP address passes through Cloudflare in transit while storage stays in Seoul. You can object to these transfers by emailing us, but they are required to buy and use a pass. Retention: we delete your data one year after you last use the service. Pass records (purchase email, registered computers, product slots) are deleted one year after the pass ends. Only for a refunded pass do we keep its records for three years from the refund, to detect repeated refunds. Payment records are kept by Paddle, the seller, for the period required by law. Access logs (IP address and time of access) are kept for three months as required by Article 41 of the Enforcement Decree of the Protection of Communications Secrets Act, stored separately from other data, then deleted. To access, correct or delete your data, email us at the address below.