apps/api), and the policy language around it reflects real decisions, but it's a standard template rather than counsel-drafted for a specific jurisdiction. If you operate somewhere with specific disclosure requirements (GDPR, CCPA, etc.) beyond what's below, get that reviewed before relying on this as-is.
Last updated: September 17, 2026.
| Data | Why | Where it lives |
|---|---|---|
| Email, password (hashed) | Account login | apps/api (customers, affiliates, and admin accounts) |
| Payment method | Billing | Stripe only — never touches our servers or database |
| Subscription/referral history | Entitlement, affiliate commissions | apps/api |
| Shells you download | The catalog itself; download counts also gate the free-download limit described in the Terms | apps/api's object storage (the catalog is admin-curated — customers don't upload anything) |
Stripe — payment processing, subscription billing, and (for affiliates) payout account KYC. Stripe's own privacy policy governs what they do with payment data. We never receive your full card number, and for affiliates we never receive SSN, date of birth, or bank routing/account numbers — Stripe's hosted onboarding collects those directly.
Linode — our hosting provider. Our servers, database, and file storage all run on infrastructure they operate. We don't currently use any other third-party processor (no separate email-delivery vendor, analytics provider, or object-storage vendor beyond what's listed here) — we'll update this if that changes.
We keep your account, subscription, and billing data for as long as your account is active. If you close your account, we delete what we're not required to keep within 90 days, except billing records tied to completed transactions, which we retain for 7 years for tax and accounting purposes. Shells you've already downloaded are unaffected by account deletion — see the Terms of Service, Section 4, on the permanent license.
Email privacy@guden.io to request a copy of your personal data, ask us to correct or delete it, or export it. We'll respond within 30 days. Deleting your account doesn't revoke the license to shells you've already downloaded — see the Terms of Service, Section 4.
We don't run any analytics or ad-tracking scripts on this site. If you join our email list, we'll use your email address to send product updates; you can unsubscribe at any time.