Privacy Policy

Last updated: [DATE]

This explains what [COMPANY NAME] (“Smoke”) collects about you, why, and what you can do about it.

What we collect

• Account details: your username, email address and a scrambled (hashed) version of your password. We never store your password itself. If you sign in with Google, we receive your name, email address and a Google account ID.
• Profile (optional): bio, up to three links, an avatar and a banner. A creator's profile and pictures are public once they list something to sell. Other people's profiles are private.
• Purchases and sales: what you bought or sold, the price, the fees and the date. This is shown to you in My library and My earnings.
• Reviews: if you review a product, your rating, your text and your username are public on that product page. You can edit or delete your review at any time.
• Downloads: we remember which products you have downloaded, so that people who download a free product can review it. We also keep a private download log (which account got which product and version, when, and a scrambled network code, never your readable IP address) for 90 days, to stop products being shared or leaked and to trace a leak if one happens.
• Wishlist and recommendations: the products you save to your wishlist, and what you bought, played, downloaded and rated, are used to suggest products you may like. Your wishlist is private. We don't sell this data.
• Plays: when you play a browser game we record that you played it (account and time), the same way as a download.
• Ads: if Smoke shows ads, we count how many times an ad was shown and clicked. These counts are not tied to your account. Ads are labelled "Ad" and are never shown to ad-free members.
• Community posts and replies: what you write on a product's community page is public with your username. You can delete your own posts. Smoke staff can remove posts that break the rules.
• Following and notifications: the creators you follow and the alerts we send you (sales on wishlisted products, new releases, replies). Alerts can also be emailed; you can turn emails off in My account.
• Support requests: messages you send through the support form and our replies, kept so we can help you and prove what was said.
• Cloud saves and achievements: if a game uses Smoke cloud saves, the save files the game uploads for your account, and which achievements you unlocked. Achievements may be shown as a percentage of owners; saves are private to you and that game's developer tools can only reach them while you play. You can delete saves or your whole account.
• Seller statistics: we count product views (once per visitor per day), wishlist adds, sales and plays. Sellers see totals only, not who the visitors were.
• Coupon use: which coupon codes your account used, so each can be used once.
• Files you upload: products, cover images, avatars and banners.
• Reports: if you report a product or creator, we keep your report and your account name.
• Technical data: your IP address may be seen by our server and kept briefly in logs to keep the site running and secure.

Cookies and similar storage

• sid: a login cookie that keeps you signed in (up to 30 days). It is needed for Smoke to work.
• gstate: a short-lived cookie used for security while you sign in with Google (about 10 minutes).
• Saved choices in your browser, such as the category you picked on the home page. This stays on your device.

Smoke's own ads do not use tracking cookies. If you add ad networks or analytics later, this page and the cookie notice must be updated. [UPDATE IF AD NETWORKS OR ANALYTICS ARE ADDED, AND LAWYER TO CHECK]

How we use it

• To run your account, process purchases, deliver downloads and pay sellers.
• To send emails about your account, such as confirming your email address or resetting your password.
• To keep Smoke safe: stopping fraud, malware and abuse, and handling reports.
• To meet legal and tax duties.

We do not sell your personal information.

Who else handles your data

We use other companies to run parts of Smoke. They only get what they need to do that job:

• Payments: [PAYMENT PROVIDER, e.g. Stripe] (card details go to them, not to us)
• Email: [EMAIL PROVIDER, e.g. Resend]
• Google sign-in: Google, if you choose to sign in that way
• Hosting and file storage: [HOSTING PROVIDER]

We may also share information when the law requires it or to protect people from harm. [IF DATA IS TRANSFERRED TO OTHER COUNTRIES, EXPLAIN HERE]

How long we keep it

We keep your account details while your account is open. Records of sales, fees and refunds are kept as long as tax and accounting law require. [CONFIRM RETENTION PERIODS]

Your choices and rights

You can edit your profile, pictures and links on My account at any time. On the same page you can download a copy of your data and delete your account yourself. Deleting erases your profile, reviews, wishlist and login. Sales records are kept without your name for tax and refund rules, and the private download log is kept for up to 90 days to trace leaks; products you sold that people bought are taken off the store but stay available to those buyers. To correct something you can't change yourself, or for any other request, contact [PRIVACY CONTACT EMAIL]. Depending on where you live (for example the EU, UK or California) you may have more rights, such as objecting to certain uses or complaining to a data protection authority. We will honour the rights that apply to you.

Security

Passwords are hashed, logins are rate-limited, and uploads are checked. No online service is perfectly secure, so please use a strong, unique password.

Children

Smoke is not for children under 13, and selling is for adults (18+). If you think a child has given us personal information, contact us and we'll remove it.

Changes and contact

We may update this policy and will tell you about important changes. Contact: [PRIVACY CONTACT EMAIL], [POSTAL ADDRESS].