Privacy Policy.

This Privacy Policy explains what we collect, why, and what we do with it. It applies to the ZigZag website, desktop application, and Discord services (together, the Service). ZigZag is operated independently; by using the Service you consent to the practices described here.

1. What we collect

• Discord identity. When you sign in with Discord we receive your Discord user id, username, avatar hash, and (optionally) email. We store these so you can log in, so Discord mentions in our server resolve, and so your dashboard can list your keys.
• License keys. We generate keys bound to your Discord id, with tier, issue date, expiry, and an optional admin note. Keys are visible to you in the dashboard and to ZigZag administrators.
• Device fingerprint (HWID). The ZigZag desktop app computes a SHA-256 fingerprint of five Windows registry values (MachineGuid, BaseBoardSerialNumber, SystemManufacturer, SystemProductName, ProcessorNameString). Only the resulting 32-character hex is sent to our server. The underlying registry values never leave your machine.
• Session cookies. After Discord sign-in we set a signed cookie (zz_sess) scoped to zigzag.onl, used only to keep you signed in. It is HTTP-only, Secure, and SameSite=Lax.
• Minimal telemetry. Our edge logs record IP, user-agent, request path, and timestamp for abuse prevention and rate-limiting. We do not run third-party analytics or advertising scripts.
• work.ink callback tokens. If you redeem a free key through work.ink, we validate the one-time checkpoint token with work.ink and immediately discard it after single use.

2. What we do not collect

• No Roblox credentials. We never ask for your Roblox password.
• No scripts. The scripts you run in the ZigZag editor stay on your machine.
• No keystrokes, no clipboard, no screen capture.
• No raw hardware serial numbers — only the derived fingerprint hash.

3. Why we collect it

• To authenticate you via Discord.
• To bind keys to a device so a single key cannot be shared across many PCs.
• To enforce rate limits (free keys per day, HWID rebinds per 24h).
• To let administrators investigate abuse and ban offending accounts.

4. Who we share it with

We share limited data with the service providers we need to operate:

• Discord — OAuth sign-in, slash command interactions, and DM delivery of your keys.
• Supabase — our Postgres database for keys, bindings, and audit logs.
• Cloudflare — website hosting, API edge functions, and DDoS protection; sees request metadata and IPs.
• work.ink — only sees the one-time checkpoint token you generate when claiming a free key.

We do not sell data to third parties.

5. Retention

• Expired or revoked keys and their bindings are retained for audit purposes for 365 days, then purged.
• Audit log entries are retained for 365 days.
• Session cookies expire after 30 days of inactivity.
• Edge logs are retained by Cloudflare per their default retention policy.

6. Your rights

• Request a copy of the data we hold about your Discord id.
• Request deletion of your account, keys, and bindings.
• Reset your device binding (rate-limited to prevent key sharing).
• Revoke access by leaving the Discord server and uninstalling the app.

To exercise these rights, open a ticket on the ZigZag Discord server.

7. Security

Traffic is TLS-only. The database runs on Supabase with row-level security policies. Session tokens are HMAC-signed. Discord webhooks and interactions verify Ed25519 signatures. We take reasonable measures to protect your data but cannot guarantee absolute security.

8. Children

The Service is not directed at children under 13. If you believe a minor has given us personal data, contact us and we will delete it.

9. International users

Our infrastructure is hosted globally through Cloudflare and Supabase. By using the Service you consent to processing of your data in jurisdictions where those providers operate.

10. Changes

We may update this policy. Material changes will be announced on Discord and reflected by an updated effective date above.

11. Contact

Privacy questions — open a ticket on the ZigZag Discord server.