Privacy Policy

1. Data controller

2. The short version

w0a is a licensed desktop application. It sends data to our servers for one reason only: to check whether your licence is valid. Your games, files, browsing history and keystrokes are never collected.

The app sends our server six fields in total: your licence key, a hardware ID derived from your device, a hardware summary sent with the licence checks the app makes and stored only at first activation, and the version, time and text digest of the agreement you accepted in the app (kept on your licence record as evidence of acceptance). The digest is a one-way checksum of the agreement text itself; it says nothing about you and exists so we can show which wording you were shown. Separately, our server records your IP address from the connection itself and the country derived from it.

3. What the app sends to our server

These are all the requests the app makes to our server for licence checks, and their full contents are listed below. Two more exist. While the app is open it holds a live connection to our server so that a cancelled or banned licence stops working within seconds; that connection carries the same licence key and hardware ID and nothing else, and the app re-opens it whenever it drops. And at exit: when you close the app it sends the same licence key and hardware ID as a sign-off notice, so the admin view stops showing the device as online. There are no others.

3.1 Licence key

The key you enter is transmitted on every validation. We use it to determine your subscription's validity and duration.

3.2 Hardware ID (HWID)

To verify that one licence is used on one device, an identifier is generated from your machine. It is the SHA-256 hash of three values combined, of which only the first 32 characters are used: the product UUID the manufacturer wrote into your motherboard's firmware, the motherboard serial number and the processor ID. None of these belong to Windows, so reinstalling Windows does not change the identifier. Only on a machine whose firmware carries no usable identity — some virtual machines and boards shipped with placeholder values — does the app fall back to the Windows installation ID (MachineGuid) combined with the processor ID, and only there does a reinstall change the identifier.

3.3 Hardware summary (sent with the licence checks)

To make support easier and to detect licence abuse, the fields below are sent when the app checks your licence. Two such checks run at the start of a session — the one at start-up and the first background check a few minutes later — and they do not know about each other, so where a key is already stored the summary is sent twice per launch rather than once. It is not re-sent after that while the app stays open, and it is also sent whenever you activate or re-check a key yourself on the Settings page. The server records the fields only at first activation; later submissions are ignored and the record is not updated.

When the in-app Privacy (streamer) mode is on, your local network IP is sent masked. That is its only effect on data collection: it visually hides your licence key, HWID and IP on screen, but does not reduce what else is collected. We will not overstate it.

4. What our server adds by itself

The following are not sent by the app; our server derives them from the connection itself. We call them out separately because you would not otherwise realise they are recorded.

5. What stays only on your device

The following are stored on your computer under %AppData%\w0a\. Apart from the exceptions marked below, they are never transmitted to us:

• Error log — technical fault details if the app crashes. When the file grows, only the most recent lines are kept.
• Settings — your licence key, encrypted with Windows' own protection service so only your account can decrypt it, plus preferences such as language, theme, game path and process rules.
• Backup file — the previous value of every registry entry we change, so it can be reverted.
• Crash state — consecutive crash count and last start time, so the app can fall back to a safe mode.
• Hardware ID cache — the raw firmware product UUID, motherboard serial number and processor ID, kept so your ID stays the same if one of those readings later fails. This is the file described in section 3.2; the raw values in it are never uploaded — only the hash is.
• Other working files — your saved benchmark runs, your process and game-reserve rules, a timing trace of the most recent start-up, a marker file recording whether the last graphics-card profile finished applying, any custom background image you set, and — only if you use the repair that clears hosts-file entries blocking Windows Update — a timestamped copy of your Windows hosts file, kept so the change can be undone. None of these ever leaves your device.
• Agreement acceptance details — the record of which machine accepted the agreement, and which language it was shown in, stays local. Note: the accepted version, the time, and the digest of the text you were shown are sent with licence validation and stored on your licence record, as described in section 2 — those three are the items in this file that do leave your device.

Your RAM module serial numbers and mouse/keyboard model details are displayed in the app but are not included in the hardware summary sent to our server.

6. What we never collect

• Your files, documents or screenshots
• Your browsing history or the sites you visit
• Your keystrokes — there is no keylogging of any kind
• Your game accounts, in-game data, or the memory of game processes
• Your Windows username — it is stripped out of a problem report before the report is sent, with the one narrow exception described in section 5 (usernames shorter than three characters)
• Your card number or payment details — these are processed only by the payment provider and never reach us
• A list of your installed programs, or any report of which applications you run

7. What we see in the admin panel

The panel we use to manage licences shows the operator everything listed in sections 3 and 4. For transparency, here is the full list:

• Licence key, creation / activation / expiry dates, plan tier, and whether it is banned
• The full hardware ID
• Your full last-recorded IP address and your country
• Your last-seen timestamp
• Every field of the hardware summary, itemised
• The purchase note field — which contains your purchase email address
• The version of the agreement accepted on your device and the time of acceptance
• The payment provider's customer and subscription references — not shown in the key list, but included when the whole database is exported

Only an authorised operator can reach this panel, through a separate access channel that requires authorisation. Administrative actions taken there (creating a key, banning, changing duration) are written to a separate log server; those records are automatically deleted after 90 days and hold the time of the action, the action itself, a masked form of the licence key it was applied to — or, where the action covered several keys at once, how many — a short detail such as the new duration, and the operator's IP address, not yours.

The panel can also export the entire database to a file. When such an export is made, a copy of the data above exists on the operator's device. These copies are made only for backup and server migration, and are not shared with third parties.

8. Third parties and international transfers

Each of these transfers happens for one purpose only: the geolocation service to derive your country, the payment provider to take the payment and issue the invoice, the email provider to deliver your key, the front-end proxy to carry and filter the connection, the support forwarding to bring your report to us, and the DNS, ping, Windows Update and driver-download requests to run the test or installation you started yourself. None of them is used for advertising, profiling or any other purpose.

Several of these recipients — the geolocation service, the payment provider (Paddle), the email delivery provider (Google), the front-end proxy (Cloudflare) and, where enabled, the support-forwarding service (Discord) — are established abroad; to that extent your personal data is transferred internationally. Where a transfer is necessary to perform your contract — payment processing and delivery of your key — we rely on that necessity. For the remaining recipients we rely on the international transfer mechanism that provider makes available to its customers under the applicable law; you can ask which mechanism applies to a given recipient, and how to obtain a copy of it, through the contact channel in section 1. The remaining recipients in the table above — the public DNS resolvers, the regional reference hosts, Microsoft and GitHub — are abroad as well. We pass them nothing and receive nothing back: those connections are opened by your own computer straight to the host, and only when you start the test, the scan or the installation yourself. The geolocation lookup can be switched off entirely in our server configuration, in which case no country data is collected at all. How long any of these services retain their own records is outside our control.

Paddle is our merchant of record and acts as an independent data controller for the details you enter at checkout — your name, email address, billing address and payment method — under its own privacy policy (paddle.com/legal/privacy). Those payment details never reach us. After the purchase Paddle passes us your email address so that we can deliver your key.

9. Legal basis and purpose

Your data is never used for advertising, profiling or sale, and is never shared with any third party for marketing purposes.

10. Retention

Records tied to your licence (key, HWID, IP, country, hardware summary, accepted agreement version, time and text digest, last seen, purchase email, and the payment provider's customer and subscription references) are kept while the licence is live. After it expires, a clean-up job runs on our server every day and deletes the whole record once the licence has been expired for 24 months. You can ask us to delete it sooner. Two cases are handled differently: a record with no expiry date — a lifetime plan, or a key that was never activated — is not covered by that job, and a banned key keeps the ban but has its HWID, IP address, country, hardware summary and payment-provider customer reference erased at the same 24-month point. What stays on a banned record is the key itself, the purchase note that holds your email address, the payment provider's subscription reference, your last-seen timestamp, and the accepted-agreement version, time and text digest. One record deliberately outlives the licence row. Before a licence record is deleted, the fact that its owner accepted an agreement is copied into a separate ledger, because a claim about that acceptance can be brought long after the licence itself has gone. That ledger holds no personal data: the licence key appears only as a one-way digest, next to the agreement version, the digest of its text, and the acceptance time. It identifies nobody on its own — a key has to be presented alongside it before any row in it can be matched to a person — and it is kept for as long as such a claim remains possible.

When you release your key's device binding yourself, the key and the time of the release are recorded so the limit of 2 releases in any 30 days can be counted. Entries older than that 30-day window are deleted the next time the same key's binding is released, and once a licence record itself is deleted, the key's remaining release history is removed by the daily clean-up.

Administrative action logs are automatically deleted after 90 days. Our licence server also prints operational lines to its own console — an activation, a rejected key, a country lookup that returned nothing — and those lines carry your IP address and a shortened form of your licence key. How long they survive is decided by the log-rotation settings of the system we run the server on, not by us.

One more short-lived record exists. When you buy, our server writes two duplicate-payment guard entries that contain your purchase email address, so that two notifications about the same payment cannot issue you two keys. They stop being useful after 30 days and are removed by a clean-up that runs at most once a day, on the next purchase notification the server receives — so on a server taking no further orders they would sit until one arrives.

11. Security

• All traffic between the app and our server is encrypted with HTTPS; the app refuses unencrypted connections.
• Licence validation responses are digitally signed; a fake server cannot produce a valid response.
• The licence key stored on your device is encrypted using Windows' own protection service.
• Our servers are protected by rate limiting and failed-attempt lockout.
• Administrative access requires a separate, strong secret.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify you in the manner and within the period the law requires.

12. Your rights

Under the data-protection law that applies to you — the GDPR in the EU/EEA, the KVKK (Art. 11) in Türkiye, and equivalent laws elsewhere — you have the following rights:

• To learn whether your personal data is processed
• To request information about that processing
• To learn the purpose and whether the data is used accordingly
• To know the third parties to whom the data is transferred, at home or abroad
• To request correction of incomplete or inaccurate data
• To request erasure or destruction
• To require that correction and erasure be notified to third parties the data was shared with
• To object to adverse outcomes arising solely from automated analysis
• To claim compensation for damage caused by unlawful processing
• To ask us to restrict processing while a dispute about the accuracy or lawfulness of the data is being resolved (Article 18 GDPR)
• To receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where that is technically feasible (Article 20 GDPR)

The channel for exercising these rights will be published in section 1. Answering your request is free of charge; we may ask for a reasonable fee only where a request is manifestly unfounded or excessive. Your request will be answered within 30 days at the latest. For a request made under the GDPR, where the request is unusually complex we may extend that period by up to two further months and will tell you the reason within the first month (Article 12(3) GDPR); for a request made under the KVKK the period is thirty days in every case and cannot be extended (KVKK Art. 13/2). If we cannot identify you from the request itself, we may ask for the licence key or the purchase email address the record is held under — we do not ask for identity documents. If you are not satisfied with the response, you may complain to your data protection authority — the KVKK Board in Türkiye, or your national supervisory authority in the EU/EEA and elsewhere.

We take no decision about you that produces legal effects, or similarly significant effects, on a solely automated basis. The one-device rule is applied automatically during the licence check, but a refusal only blocks activation on a second machine: you can release the binding yourself on the bound device (Settings → License → "Unbind This Device", at most 2 releases in any 30 days), and where the bound device can no longer do that, an operator can review the case and reset the binding on request through the channel in section 1. The free one-day trial key is the exception: it stays bound to the device that claimed it and is released by neither route, because it expires within a day.

13. Children and age limit

w0a is not directed at children under 16, and we do not knowingly collect data from anyone under 16. The box you tick to accept the agreement in the app carries your declaration that you meet the age terms in clause 2 of that agreement; that declaration is the only age check there is, because we have no way of verifying age and do not attempt one. If we discover data from someone under 16 has been processed, we delete it and cancel the associated licence.

If you are 16-17, you may use w0a with the knowledge and consent of your parent or legal guardian. Purchases, and the data processing tied to them, must be made or approved by your parent or guardian. A parent may always contact us regarding their child's account and data.

14. Changes

If we update this notice we will change the version number and effective date on this page. If we make a material change that expands what we collect, we will notify you inside the app before it takes effect.