1. Your account
An account is created by redeeming a licence key. It holds a username, a password hash, your plan and its expiry, and the account's status.
- The password itself is never stored. What is kept is an Argon2id hash, from which the password cannot be recovered.
- No email address is collected, so there is no address to verify, to reset a password with, or to lose. Account recovery goes through support.
- Administrator accounts additionally hold a two-factor secret, encrypted at rest with AES-256-GCM.
2. Licence keys
A key is stored as a SHA-256 hash together with its first group — for example GALIL-PRO-7F3A — so a key can be recognised and identified without being reproducible. The full key exists only on the copy you were given.
3. Your machine
The client computes a hardware fingerprint and sends its SHA-256 hash. The server stores that hash, when it was bound, and when it was last reset. It is used for one thing: keeping one licence on one machine.
It is not a serial number and cannot be turned back into one. Your dashboard shows only a truncated form of it.
4. Sessions
Two kinds, both listed on your Sessions page and revocable there.
- Browser sessions record a hash of the session cookie, your IP address, your browser's user-agent string, and when the session was created and last used. The cookie value itself is never stored, so a database leak alone hands over no live session.
- Client sessions record a session identifier, a replay counter, the bound machine hash, your IP address and the same timestamps.
5. Configs
A config holds its name, the settings text the client wrote, and its timestamps. The server does not interpret that text; it reads two header lines from it so a shared config can say which build wrote it.
A config is private by default and visible only to you. Publishing one to the marketplace is an explicit action, and it makes the config's name, description, size, dates, import count and your username visible to other signed-in Pro users, who may import a copy. Making it private again removes it from the marketplace but does not reach into copies other people already imported.
6. Sign-in attempts and rate limiting
- Every sign-in, registration and redemption attempt records what kind it was, the username attempted, the IP address it came from and whether it succeeded. No password, token or hash of either is recorded. These rows are deleted after 30 days.
- Rate-limit counters are keyed by IP address, username or session identifier. They hold a count and a window start, and are deleted a couple of hours after their window ends.
7. Administrative audit log
Actions taken by administrators — and a few taken by you, such as a machine reset or a password change — are recorded with who did it, their IP address, what was done and what changed. This log is append-only: the application can add to it and cannot alter or delete from it, including when the person using it is an administrator.
8. Server logs
Requests are logged with a correlation identifier, the method, the route, the response status, how long it took, the IP address and, on success paths, the account involved. The logger works from an allow-list of permitted fields, so anything not explicitly listed is dropped rather than filtered.
Never logged, in any form: passwords, password hashes, session tokens or identifiers, licence keys, two-factor secrets or codes, full machine hashes, CSRF tokens, and Cookie or Authorization headers.
9. Cookies
Three, all first-party, all strictly necessary, none used for analytics or advertising. All are HttpOnly and SameSite=Lax, and carry the Secure flag and the __Host- prefix in production.
| Cookie | Purpose | Life |
|---|---|---|
| __Host-galil_session | Keeps you signed in | 7 days, or 24 hours idle |
| __Host-galil_pending | Holds the gap between your password and your two-factor code | 5 minutes |
| __Host-galil_anon | A random value that the sign-in form's anti-forgery token is tied to. It identifies nothing and grants nothing | 24 hours |
There is no consent banner because there is nothing to consent to: remove these three and the site cannot sign anybody in.
10. Payments
Payment is made in cryptocurrency, directly to a published address, and is confirmed by hand through support. No payment data reaches this system. There is no card number, no billing address, no payment processor and no order table — what a purchase eventually produces is a licence key.
11. How long things are kept
| Data | Kept |
|---|---|
| Account and licence records | Until the account is deleted |
| Configs | Until you delete them, or until a plan downgrade prunes them |
| Sessions | Deleted 7 days after they expire |
| Sign-in attempts | 30 days |
| Rate-limit counters | A few hours |
| Audit log | At least one year |
A pruning job inside the server enforces these on a timer rather than leaving them as an intention.
12. Who it is shared with
Nobody. Your data is not sold, rented, or handed to advertisers or analytics providers, and the site makes no requests to any other origin — its content security policy does not permit one. The only information about you that another user can see is what you deliberately publish to the config marketplace, which is your username and the configs you chose to share.
Data may be disclosed where the law requires it, and infrastructure providers necessarily process traffic in the course of hosting.
13. What you can do
- Change your password, which signs out every other session.
- Review and revoke any session, browser or client, from your dashboard.
- Unbind your machine yourself, once every 30 days.
- Delete any config, and unpublish any config you have shared.
- Ask for your account and its data to be deleted. Open a ticket.
Deleting an account removes its configs and sessions. Entries in the append-only audit log and any licence record are retained as business and security records.
14. Security
Passwords are hashed with Argon2id. Session cookies and licence keys are stored only as hashes. Two-factor secrets are encrypted at rest. Authorisation is decided by the server on every single request from the account's live state, never from anything the client sends. The full detail is in the project's own security documentation.
15. Changes
If this notice changes, the date at the top changes with it. Material changes are announced through support.
16. Contact
Questions about any of this, or a deletion request, go through Discord.
Open a ticket