Privacy Policy

Last updated: 2026-09-13

This policy explains what data LionFuscator (lionfuscator.com) collects, why, and how long we keep it.

1. What we collect

  • Account: username, email address, password (stored as a pbkdf2 hash - never in plaintext), account creation time, plan, credit balance, 2FA enrollment state.
  • Submissions: a small tag (“web” or an API-key marker) is stored per build; the plaintext Lua source you upload is never persisted beyond the moment the transform runs. The obfuscated OUTPUT is kept so you can re-download it from your dashboard.
  • Billing: Stripe customer and subscription IDs, and (for crypto) Coinbase Commerce charge IDs. Card details and wallet addresses are stored by those providers, never by us.
  • Sessions: a per-device session token, IP address, User- Agent string, and a best-effort city / country label. Shown in Account settings so you can revoke individual devices.
  • Operational logs: IP address, timestamp, URL, response code for security and rate limiting. Retained up to 30 days.
  • API keys: a searchable prefix (13 chars) and a pbkdf2 hash of the full key. The full key is shown once at creation and is not stored anywhere by us.

2. Why we collect it

  • Deliver the Service, authenticate you, and let you download your past builds.
  • Bill for paid plans and refill credits on the 30-day window.
  • Enforce fair use (rate limits, abuse detection, device revocation).
  • Comply with legal obligations and respond to abuse reports.

3. What we do not do

  • We do not sell, rent, or share your data with data brokers.
  • We do not use your submissions to train machine-learning models.
  • We do not read the plaintext of your submissions - it is not stored, only transformed and returned to you.
  • We do not run third-party advertising or behavioural analytics trackers on the site.

4. Third parties we use

  • Stripe - payment processing. Stripe’s privacy policy applies to card data you enter on their hosted checkout.
  • Coinbase Commerce (crypto payments, where enabled) - their privacy policy applies to the wallet flow.
  • SendGrid (Twilio) - outbound email delivery for verification, password reset, and receipts. Emails are sent from our own @lionfuscator.com domain.
  • Cloudflare - CDN, DDoS protection, WAF, and inbound email routing. Traffic to and from the site transits Cloudflare edge infrastructure.
  • Render - application hosting. Standard hosting logs may transit their infrastructure.
  • Friendly Captcha (or the currently configured captcha provider) - bot check on registration and password reset.
  • ipapi.co - best-effort city / country lookup for the device-sessions list.

5. Retention

  • Account records: until you delete the account.
  • Job outputs: up to 90 days, then the stored payload is cleared while the row (name / preset / date / bytes) remains for your history. You can also delete individual jobs from the dashboard sooner.
  • Operational logs: up to 30 days.
  • Billing records: retained as required by tax and accounting law.

6. Your rights

You can view and change your email, password, and 2FA from Account settings, revoke individual devices, and delete your account (which cascade-deletes your jobs, sessions, and API keys). For any additional data request - export, correction, or deletion of specific records - email [email protected].

7. Children

The Service is not intended for children under 13. Accounts we identify as belonging to children under 13 will be removed and any data purged. If you are a parent or guardian and believe your child has created an account, contact [email protected].

8. Security

Passwords are pbkdf2-hashed. Sessions use HttpOnly + SameSite=Lax + Secure cookies. The site enforces a strict Content-Security-Policy, X-Frame-Options: DENY, Cross-Origin-Opener-Policy, and a Permissions-Policy that denies powerful browser APIs the site does not use. 2FA (TOTP) is available for every account. API keys are hashed at rest. All traffic is served over HTTPS with HSTS.

9. Changes

We may update this policy. Material changes will be announced on the Service and in the changelog.

10. Contact

Privacy questions or requests: [email protected].