Privacy notice
Last updated: 25 October 2026
1. Operator and contact
Otrek's Plugins is operated by Otrek's Plugins.
Privacy contact: https://otreksplugins.com/en/contact. You can also use Contact and support. This notice covers this website and its download/update API.
2. Information we use
Accounts contain an email address, display name, password hash, verification status and account preferences. Profile fields are optional. New accounts use public profiles; you can make your profile private in account settings. Public reviews show your display name, score, text and reviewed version. Private support messages are accessible to you and the administrator team.
Purchase verification uses the marketplace, buyer name, order reference and evidence you submit. If Lemon Squeezy purchases are enabled, checkout receives your account name, email and an opaque account-binding reference. Signed events provide order, product, payment status, currency, amounts and refund information used to grant or adjust download access. The site stores these order/access records and keyed event digests, not full payment-card details. Payment details are entered on Lemon Squeezy. Existing marketplace purchases can still be verified manually. Order records are retained while needed for access, support, refunds and applicable obligations.
Download history records the account, product, version, time, source and a keyed IP hash. Update tokens are stored as hashes with their scope, expiry and last-use time. The API receives the current plugin version; checking for an update does not prove that an update was installed.
3. Purposes and legal grounds
We use necessary account, access and download information to provide the service and administer your software access (GDPR Article 6(1)(b)). Security, abuse prevention, support administration and proportionate product statistics serve our legitimate interests in a reliable service (Article 6(1)(f)). Legal obligations apply where required (Article 6(1)(c)). Optional public profile information is published at your choice; you can withdraw that choice in your profile settings. We do not sell personal data or use these statistics for advertising profiles.
Email is required for an account, verification and recovery. Without required information, we cannot provide those account functions. Browsing public documentation does not require an account.
4. Product statistics and device storage
Only administrators see product analytics. They contain page views, approximate visitor days, referring domains, broad device categories, downloads and update checks. IP and browser information are used transiently to calculate a keyed pseudonym that changes each UTC day. Analytics do not store raw IP addresses, complete browser identifiers or referrer paths/query strings. Administrators and recognized bots are excluded from ordinary visitor totals. No analytics cookie is created. A visitor day is not a count of identifiable people.
Necessary session cookies support sign-in and form security. A browser session expires after one hour of inactivity or twelve hours in total. Language/theme cookies last up to one year. Editor drafts and guide preferences may be stored locally in your browser; clear them on shared devices. Hosting/security providers may keep separate connection logs.
The product visit counter also respects the Do Not Track and Global Privacy Control signals sent by your browser.
Live Activity uses the existing browser session and a keyed pseudonym, plus account ID and session revision when signed in. Only administrators see the current grouped subpage, broad browser/client name, country code from trusted Cloudflare or server GeoIP, referring domain or recognized campaign label, and activity times. Raw IP addresses, complete User-Agent strings and referrer paths or query strings are not stored. No external geolocation requests or additional tracking cookies are used. Active browser sessions cover the last five minutes and expire after 30 minutes without activity; signing in or out preserves the same visit. Recognized bot activity is grouped separately using a keyed daily IP/browser pseudonym; bot identities are not verified. DNT and GPC prevent collection. Detailed live sessions and route deduplication data are deleted once inactive for 24 hours, during traffic cleanup or scheduled maintenance. Non-identifying session aggregates are retained alongside existing statistics, counted once at the first website/subpage visit in UTC with the audience at that first visit. Earlier analytics remain unchanged. Run scheduled maintenance regularly to enforce retention even when no one visits. The legacy aggregate online presence cache expires after 15 minutes. Trash retains content for restoration without removing licences or history.
5. Recipients and external services
Authorized administrators and providers of hosting, database storage, transactional email, backups and network security process information needed for their tasks. Provider locations and contracts depend on the operator's hosting setup; contact us for the current provider list and applicable international-transfer safeguards. Any transfer outside the EEA must have an applicable GDPR transfer basis. External images, embedded videos and links can connect your browser to their providers, which may receive your IP and browser data and apply their own policies. Marketplace purchases and Discord interactions take place under those services' policies.
6. Retention
Account and access records are retained while needed to provide access, resolve disputes or meet applicable legal obligations; closed-account data is reviewed for deletion or anonymization. Support and purchase evidence are kept while needed to resolve the request, handle follow-up or substantiate access. Contact us to request removal of information no longer needed.
Daily analytics pseudonyms cover the current UTC date and the two preceding dates; older dates are removed by daily analytics cleanup or maintenance; referring-domain/device aggregates are limited to 400 days. Non-identifying daily download/view totals are retained for product reporting. Scheduled maintenance removes download history and read notifications older than 90 days, audit entries older than 365 days, expired one-time records and local test mail. Backups follow the operator's backup cycle and are restricted to recovery; deletion requests must be reapplied after a restore. The operator must run maintenance regularly and align host log/backup retention with this notice.
7. Your rights and requests
Depending on the conditions in the GDPR, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent where it applies. Contact https://otreksplugins.com/en/contact; we may request proportionate identity verification and normally respond within one month. You may complain to your competent data protection authority, including the Dutch Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl. There is no advertising profiling or solely automated decision with legal or similarly significant effects. Access restrictions can be reviewed by an administrator. Material changes to this notice will be identified on this page.
Account security and website traffic
If you choose to remember a device, an HttpOnly sign-in cookie lasts up to 30 days. The server stores a hashed validator, account reference, session revision, broad device label and usage/expiry dates. Signing out revokes that device; password/MFA changes revoke all remembered devices. Authenticator secrets are encrypted; recovery codes are stored as one-use hashes. Setup QR codes are generated locally without sending secrets to an external QR service. Website statistics cover subpages, including grouped account routes, with separate guest/member/staff totals. They do not store private route identifiers, search text or tokens. Ordinary visitor reports exclude staff and separate bots; DNT/GPC remain respected. Daily pseudonyms and 400-day dimension retention follow the analytics rules above.
Optional Google and Discord sign-in
If you choose Google or Discord sign-in, that provider verifies your identity and shares an account identifier, display name and email information. We keep the connection to sign you in to the same website account. Provider details are private and are not added to your public profile. Your provider password is never shared with this site. Provider access and refresh tokens are not retained. You can manage or disconnect connections in Account security while keeping another sign-in method. The provider handles its own authentication under its privacy policy.