Privacy

1. Data controller

Pawlygon Studios is the data controller for the information processed through this site. You can reach us through the Contact page for any privacy related questions.

2. What we collect

• Contact form: your name, email address, message, and a record that you agreed to this privacy notice.
• Commission form: your name, email address, commission brief, selected tier, optional contact handles, reference links or files, and a record that you agreed to this privacy notice.
• Pawlygon account: when you sign in with Discord, we receive and store your Discord user id, display name, avatar, and email address with whether Discord has verified it. We also keep when you signed in, your active sessions (with the IP address and browser they came from), and the roles on your account, including roles that come from your membership in the Pawlygon Discord server. We never see your Discord password.
• Connected apps: when you use a Pawlygon app with your account (the Pawlygon dashboard at dashboard.pawlygon.net, and later Pawlygon tools for Unity), we keep which app it is, what it is allowed to do, and when it was last used.
• Your library: the products your account owns and how each came to it: a purchase matched by your verified Discord email, a license key you linked (we keep which product and store it is for), a Gumroad account you connected (we keep only its Gumroad id, never its password or access), Discord verification, a free product you added, or a grant from us. We also keep a history of your downloads: which file, when, which app, and a scrambled form of your IP address (never the address itself), used for the daily download limit and to spot abuse.
• Customer record: when you buy from us on Gumroad, Jinxxy or BOOTH, are invoiced by us, send a contact or commission request, or sign in, we keep one record of you as a customer: the name and email addresses the store or form gave us, your store buyer ids, your Discord id, your country (from the store), what you bought and for whom, totals of what you paid, and any notes our team adds. If you follow us on Gumroad and we import that list, we keep your email and when you followed. We use it to help you with orders and support, to see who bought what, and to know whether we may email you.
• Email preferences: whether you agreed to emails about new products and sales, and about updates to products you own, with when and how you told us (for example the switch on your account page, or a note from our team). We also keep whether a store tells us you don't want emails from us (Gumroad's unsubscribe link), and check it again every week.
• Security tokens: when you submit a form, Cloudflare Turnstile receives a short-lived token and your IP address to verify you are not a bot. We do not store the token; Cloudflare processes it according to their own privacy practices.
• Preferences: your theme choice (light/dark/system) and audio mute state are stored in your browser's localStorage so the site remembers them across visits. The entrance animation cooldown and optional dev-toolbar settings are also stored locally.
• Technical data: our hosting provider sees routine connection data (IP address, browser type, timestamps) when your browser requests pages or assets. We do not log or analyse this data for tracking purposes.

3. Legal basis for processing

• Consent: contact and commission submissions are processed because you explicitly consent by checking the agreement box before submitting the form.
• Providing your account: account data is processed to provide the account you asked for: signing you in, keeping you signed in, giving you access based on your roles, and delivering the products you bought.
• Legitimate interest: we process IP addresses and Turnstile tokens to prevent spam and abuse, and we keep limited server logs for security and availability. We keep customer records to support your purchases and to run the studio (who bought what).
• Marketing emails: we only email you news and offers when you opted in with us, or, where the law allows it for existing customers, when you bought from us and the store says you accept emails from sellers. You can opt out at any time on your account page or by contacting us, and we stop. Receipts, invoices and account emails are not marketing.
• Preferences: localStorage values are stored based on your explicit choices (clicking the theme or mute toggle) and are necessary to honour those choices.

4. How long we keep your data

Contact and commission submissions are kept for 24 months after the last activity on the request, unless you ask us to delete them earlier. Reference files uploaded with commission requests are kept for the same period. Turnstile tokens are verified and discarded immediately; Cloudflare retains them for a short period under their own policies. LocalStorage preference data remains on your device until you clear it.

Your Pawlygon account is kept until you delete it. A sign-in session lasts up to30 days and ends earlier when you sign out. A connected app keeps its access until 30 days after it was last used, or until you remove it. Your download history is kept for 13 months. Deleting your account removes your account, roles, sessions, connected apps, library and download history straight away; purchase records stay with the store's sales records.

Your customer record is kept while you are a customer and for as long as we must keep sales records for tax. If you ask us to erase it, we remove your name, emails, ids, notes and the words you wrote in forms, keep only the amounts of your purchases, and keep a one-way scrambled form of your email address so we never email you again.

5. Who we share data with

We do not sell personal data. We use a small number of service providers (subprocessors):

• Railway (hosting infrastructure) — processes server connection data.
• Directus (content management database) — stores contact and commission submissions and uploaded reference files.
• Discord (sign-in) — confirms who you are when you sign in with Discord, and tells us which Pawlygon server roles you have. Discord processes your data under its own privacy policy.
• Gumroad and Jinxxy (stores) — when you link a license key or connect your Gumroad account, we ask the store which product the key or account bought.
• Cloudflare R2 (file storage) — serves your downloads through short-lived links.
• Cloudflare (Turnstile challenge + DNS/CDN) — processes challenge tokens and IP addresses for bot verification.

6. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure ("right to be forgotten").
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal).

If you have a Pawlygon account, you can download your data or delete your account yourself: select your name at the bottom of the sidebar, then Download my data orDelete account. Your account page on dashboard.pawlygon.net lists every browser and app signed in to your account, and lets you sign any of them out.

To exercise any of these rights, contact us via the Contact page. We will respond within one month, free of charge.

7. Cookies and local storage

We do not use advertising, analytics, or third-party tracking cookies. We only store preference and security related values in your browser (theme, mute state, entrance cooldown, and your dismissal of this notice). You can clear these at any time through your browser settings.

When you sign in, we set one strictly necessary cookie onauth.pawlygon.net that keeps you signed in. It can't be read by page scripts, is only sent over secure connections, and is removed when you sign out or delete your account. Signing in also sets a short-lived cookie that protects the sign-in step itself.

The dashboard at dashboard.pawlygon.net sets its own strictly necessary cookie on that site in the same way, plus a short-lived one during sign-in. Both are removed when you sign out.

8. Complaints

If you believe we are not handling your data properly, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence.