Privacy Policy

This policy covers the public website and the dashboard (accounts, orders, payments, tickets, API keys, the affiliate program). It does not cover third-party platforms such as social networks or crypto wallets, which have their own policies.

• Account: email address, username, and your password stored only as a salted scrypt hash — we never store passwords in readable form.
• Orders: the service, the public link you submit, quantity, drip-feed settings, status and delivery counts.
• Payments: top-up amounts, the gateway's transaction identifiers (OxaPay track IDs) and refund records. We never see or store your wallet keys; payments are handled on the gateway's hosted page.
• Support: the tickets you open, their subjects and the full reply thread.
• Affiliate program: your referral code, the accounts attributed to it, and commission/payout records including the payout address you provide.
• Security and anti-abuse: IP addresses used to rate-limit sign-up attempts (5 per hour per IP), to deduplicate affiliate visit tracking, and to detect bots via a hidden form field; security-relevant events such as repeated failed logins.

The dashboard keeps your session token and your language preference in browser local storage, and may remember a referral code during the attribution window. Clearing your browser storage simply logs you out; it does not delete your account data, which lives server-side.

Cryptocurrency top-ups are processed by OxaPay on their hosted payment page. We receive a signed confirmation callback containing the amount and a transaction identifier, which we use to credit your balance exactly once. We do not receive your private keys, seed phrase or wallet credentials.

To deliver an order, the service details and the public link you submitted are forwarded to the fulfilment partner(s) providing that service. They receive only what is required to perform the delivery. We do not sell your personal data, and we do not share it with advertisers.

• Contract: operating your account, processing orders, top-ups, refunds, tickets and payouts.
• Legitimate interest: protecting the platform and its users against abuse — rate limiting, bot detection, fraud and chargeback handling, commission clawbacks.
• Legal obligation: keeping financial records where accounting law requires it.

Account and order data are kept while your account exists. Financial transaction records are retained for the period required by accounting rules. Security and rate limit data are kept for a short window consistent with their anti-abuse purpose. When you request deletion, data that must be kept for legal or anti-fraud purposes (for example, records of past transactions) is minimised rather than destroyed.

You can access and update your account details in the dashboard. For access, export, rectification or deletion of your data, open a ticket from the dashboard; we may verify your identity through the account itself before acting. You may also lodge a complaint with your local data protection authority where applicable law gives you that right.

Pharaoh does not send marketing newsletters. Operational communication happens inside the dashboard: order statuses, ticket replies (with an unread badge) and balance movements.

Pharaoh is not directed at children, and accounts are not intended for anyone below the minimum age for using such services in their jurisdiction. If you believe a minor's account exists, report it through a ticket and we will act.

Passwords are hashed with per-user salted scrypt; payment callbacks are HMAC-verified before a balance is credited; private areas (dashboard, admin) are excluded from search engine indexing; API keys can be regenerated at any time, immediately invalidating the previous key.

This policy may be updated as the service evolves; the current version is always the one published on this page. For any privacy question, open a ticket from your dashboard.