The short version
- Downloading a free script doesn't need an account, and we don't ask you for any details to do it.
- Buying a script needs an account, so we store your email address and a record of what you bought.
- We never see your card details. Payments are handled entirely by Link, a Stripe service.
- We count visits anonymously to see which pages and links people use. No cookies, no ads, no tracking across other sites.
What we collect
When you create an account
- Your email address, used to sign you in and contact you about your account.
- Your password, which is stored only as a secure hash. We can't read it.
When you buy a script
- Which script you bought, the price, when you bought it, and a reference to the payment so we can match refunds and support requests to it.
When you sign in, create an account or reset a password
- Your IP address and the email address you entered, to stop people guessing passwords or flooding inboxes with reset emails. Both are scrambled with a keyed one-way hash before they're stored, so the record can't be read back as an address, and it's deleted after about a day.
If you choose to connect Discord
- Your Discord user ID and username, and the access tokens Discord issues for the connection. The tokens are encrypted before they're stored, and only allow us to read your username and set the Customer role. They can't see your servers, messages or friends.
- We use them only to tell Discord whether you own a paid script, so it can give or remove that role. Disconnecting from your library deletes them.
If you post on the request board
- Signing in there with Discord gives us only your Discord user ID and username. We don't get your email, and we don't keep the access from Discord: it's used once to ask who you are, then cancelled.
- What you post, and which requests you vote for. Your username is shown publicly next to what you post, and requests may be shared in our Discord server. Votes aren't shown against your name.
- We may remove any request. Ask us and we'll delete yours.
When you email us
- Whatever you choose to include, so we can reply and help.
Who processes it for us
We use a small number of services to run the store:
- Vercel hosts the website. Like any web host, its servers receive your IP address and basic request details when you visit, and keep them in short-lived logs to run and protect the site.
- Vercel Web Analytics counts page visits, where visitors came from, and which products get downloaded. It uses no cookies and stores no personal data: each visitor is an anonymous code that resets every day.
- Supabase stores accounts, purchase records and the script files, and handles sign-in.
- Stripe and Link process payments as merchant of record, calculate and remit tax, prevent fraud, send your receipts and handle payment disputes. They collect your payment details, billing address and email under Stripe's privacy policy.
- Resend delivers account emails, such as confirming your address and resetting your password.
- Discord is only involved if you connect it, or sign in to the request board with it. For the Customer role we tell it whether you're a customer and how many paid scripts you own. We don't share your email or what you bought.
- Have I Been Pwned is used when you choose a password, to check whether it has appeared in a known data breach. Only the first five characters of a one-way hash of it are sent, so the service never receives your password or anything it could be recovered from.
These providers may store and process data in other countries, including the United States. We only share what each one needs to do its job, and we don't sell or rent your information to anyone.
Cookies
We only use cookies that are needed to keep you signed in and to make sign-in, password resets and connecting Discord secure. The Discord one lasts ten minutes and is deleted as soon as you're back. If you sign in to the request board, a cookie keeps you signed in there for up to 30 days, or until you sign out. There are no analytics, advertising or third-party tracking cookies, so there's nothing to opt out of.
How long we keep it
We keep your account and purchase history for as long as your account exists, so your library keeps working. If you delete your account we remove your details, except where we need to keep a record of a transaction for tax, refunds or disputes. Stripe keeps its own payment records under its own obligations.
Your choices
You can ask us to show you the information we hold about you, correct it, or delete your account. Email support@venscripts.dev from the address on your account. If you delete your account, you'll lose access to any scripts in your library.
If you're unhappy with how we've handled your information, tell us first and we'll put it right. You can also contact the privacy or data protection regulator where you live.
Children
The store is intended for developers and server owners. Anyone under 18 needs a parent or guardian to make or approve a purchase. See the terms. We don't knowingly collect information from children under 13.
Changes
If we change what we collect or who we share it with, we'll update this page and the date at the top.