We collect the minimum we need to run an account for you: a username, a password hash, your email (optional), a device identifier so your subscription stays bound to one machine, and the IP addresses you sign in from so we can catch abuse. If you link Discord we also store your Discord ID. We don't sell any of it, we don't share it with advertisers, and we don't run analytics tracking on you.

The rest of this page is the specifics.

VMExit is the operator of this website, our software, and our Discord community. Contact is through our Discord — there's no mailing address.

Account registration. A username (you pick), a password (hashed with Argon2id, we never see the plaintext), and optionally an email address if you want password recovery. If you don't give an email we can't help you recover a lost password.

Device identifier. The first time you sign in on a machine, our software computes a hash of a few stable hardware attributes and binds your account to it. This is how we stop one subscription from being passed around. We store the hash, not the raw attributes — we can't go the other way from the hash to your hardware.

IP addresses and connection metadata. Every sign-in, every network call from our software, and every website request is logged with its IP and timestamp. We use it to detect account sharing, rate-limit abuse, catch chargeback fraud, and help you if something's wrong. Logs rotate after 30 days unless they're attached to an open incident.

Discord ID. If you link your Discord account to your VMExit account, we store your Discord user ID so the bot can grant you a role and route your /buy order to the right user. We can see your Discord username and avatar through Discord's API when the bot renders your profile. We don't scrape your messages or your other servers.

Subscription and payment records. We keep your order history (date, amount, coin or PayPal, status), the subscription state, and a short audit trail of what admin granted or revoked and when.

Session cookies. One cookie that remembers you're signed in. It expires when your session does. No tracking cookies, no third-party cookies, no analytics beacons.

Diagnostic telemetry. Our software sends short status messages to the server (e.g. that an authentication step succeeded, that a package download finished, that an update completed) so support can see where a stuck session got stuck. These are short category labels and short details, not screenshots, not file contents, not keystrokes.

What we don't collect. We don't log your gameplay, your in-game chat, your microphone, your screen, your other running processes, your browser history, your files, or anything else outside our own software and this website. Our software reads only what it needs to render its own UI and perform its own function — none of that leaves your machine.

Crypto. We generate an address for your order and watch the chain for an incoming transaction. We store the receiving address, the amount, and the txid. Those are already public on the blockchain — we're not learning anything about you that a block explorer wouldn't tell someone with the address. We don't KYC. We don't share txids with anyone except where legally required.

PayPal F&F. You send to our PayPal from your PayPal; the transaction appears in our account with your sending identity. PayPal handles that data under their own policy, which we don't control. We log the txid and the sender identifier for reconciliation.

Short list:

• Cloudflare, in front of our website as a reverse proxy / CDN. They see the IPs and request metadata of your website traffic as part of serving it.
• Discord, obviously, if you link your account. The bot calls Discord's API with your user ID.
• CoinGecko, BlockCypher, Etherscan, read-only, to fetch crypto prices and confirm incoming payments. We query by address and txid; we don't send your identity.

That's it. We don't share with ad networks, with data brokers, or with any third party beyond what's above. We will respond to a valid, properly-served legal process in a jurisdiction we recognize — and we will tell you when we do, unless legally gagged.

Account data (username, password hash, email, device identifier, Discord link, subscription state) is kept for as long as your account exists and for a short grace period after deletion to catch late chargebacks and reinstatement requests.

Request logs rotate after 30 days. Audit entries attached to a specific event (ban, chargeback, refund) are kept as long as they're reasonably needed for a dispute.

Deleted accounts: we scrub the fields that identify you (email, device identifier, Discord ID) and keep an anonymized stub so audit entries referencing the old user id stay readable.

On servers we operate. Encrypted at rest where it's practical (session secrets, device binding keys, payment secrets). The server speaks HTTPS only. Backups are encrypted.

There's no public cloud datastore, no analytics vendor, no third-party CRM.

You can:

• See what we have on you. Open a ticket in Discord and we'll pull it.
• Correct it. Email, Discord link — you can change those on the dashboard or ask us to.
• Delete your account. Ask us in Discord. We'll do the scrub described above. We won't delete payment records we're required to keep for anti-fraud, but we'll disconnect them from your identity.
• Unlink Discord. From the dashboard.

We don't need a government ID to action any of this, but we do need the request to come from a channel that proves it's actually you (signed in, or from your linked Discord).

VMExit is 18+. We don't knowingly collect data from anyone under 18. If you believe we have, tell us in Discord and we'll delete it.

We can update this policy. Material changes will be announced in Discord. Non-material changes (wording, a new sub-process, a clarification) go live without an announcement.

Open a ticket in our Discord. That's the one channel we read reliably.