Only what the operation needs.
When credit management is connected, codes and keys go from your browser to this portal’s server, then to its configured redemption or API service. They are used to perform the operation you request. When the connection is disabled, the portal sends no credentials upstream.
The portal does not save plaintext codes or keys in its database, browser storage, analytics, or application logs. Details remain in the current page’s memory until you clear them or leave the page. The clipboard belongs to your device; clear it after saving a copied key securely.
Security and recovery records.
The server stores a keyed, non-reversible fingerprint of a code, an operation reference, its state, and a timestamp to prevent duplicate use. It also stores hashed rate-limit buckets. No balance, request body, plaintext key, or plaintext code is saved. Attempt fingerprints are retained until the operator’s retention policy removes them; removing them also removes local duplicate protection.
Verification.
Connected credit forms use Cloudflare Turnstile to help prevent abuse. Cloudflare receives verification and browser information under its own privacy policy. The portal sends the verification token to Cloudflare, and does not include your API key or redemption code in that verification request. This site adds no analytics scripts.
Before public launch.
The service operator must supply its identity, applicable privacy terms, retention schedule, and a working privacy contact before public use. For questions during this local preview, contact the person who supplied the portal.