Privacy Policy

Summary

StreamBoost is a self-hosted application. Your account, orders, payments and support conversations live in a PostgreSQL database operated by the site owner. There is no third-party analytics script, no advertising network and no tracking pixel on this site.

Account data

When you create an account, StreamBoost stores:

• your email address, which is the identifier you sign in with;
• a display name, if you set one;
• a hash of your password — never the password itself. An account created purely through Google or Apple has no password at all;
• whether your email has been verified, and when;
• your role (customer or administrator);
• your language preference, timezone and bio, if you set them;
• your account balance, and when the account was created and last changed.

Sign-in with Google or Apple

If you use Google or Apple to sign in, StreamBoost stores the provider name and the identifier that provider issues for you, so the same account is found next time. StreamBoost does not receive or store your Google or Apple password.

Sessions

Signing in creates a session record on the server and sets a session cookie in your browser. The cookie holds an opaque token, not your identity and not your password. Signing out deletes the session on the server, so the token cannot be reused even if it were captured.

Orders and services

For each order StreamBoost stores the service you chose, the target you supplied, the quantity requested, the quantity delivered, the price charged, the current fulfilment state and the timestamps of the order’s lifecycle.

An order is fulfilled by a provider system. The target and quantity you entered are sent to that provider because they are what the provider needs to do the work. Your email address, your name and your payment details are not sent to a provider.

Cancelled orders are kept, not deleted. They stop being processed, but the record remains so that your order history and the financial record stay complete and auditable.

Payments

Payments are handled by Stripe (cards) and Heleket (cryptocurrency). StreamBoost stores the amount, the currency, the status, the time, and the reference the payment processor issues for the transaction.

StreamBoost never receives or stores your card number, CVC or bank credentials. Those are entered on the payment processor’s own page and never reach this application. Each processor handles that data under its own privacy policy.

Every balance movement is written to a ledger, which is retained as a financial record.

Support tickets

Tickets and their messages are stored so a conversation can be continued. Administrators can read tickets in order to answer them.

Messages may be machine-translated so that you and the support team can read each other. Translation runs on a LibreTranslate service hosted on the same machine as the application — ticket text is not sent to a hosted translation API and does not leave the server.

Security and anti-abuse data

Sign-up and sign-in are protected by a challenge that a real browser completes. To make that work, and to stop automated abuse, StreamBoost records security events: the kind of event, the decision, a score, the signals that produced it, and a hashed identifier for the originating address.

• Rate-limiting and security events store a hash of the IP address or email, not the raw value.
• A sign-in verification record stores the request’s IP address and browser user-agent so they can be shown to you in the security email about that sign-in. That record is short-lived and expires.
• Security events carry their own retention cutoff and are swept automatically.

StreamBoost does not build a persistent browser fingerprint and does not use this data for advertising or profiling.

Email

StreamBoost sends email from a mail server run by the site owner, not through a third-party email marketing platform. Email is used for account verification, password resets, security notices and notifications about your account and orders.

What StreamBoost does not collect

• Card numbers, CVCs or bank credentials.
• Your password in readable form.
• Location, contacts, camera, microphone or files.
• Advertising identifiers or cross-site tracking data.
• Persistent browser fingerprints.

Cookies

StreamBoost sets three first-party cookies and no third-party cookies. They are described in full in the Cookie Policy.

Retention

• Account data is kept while the account exists.
• Orders, payments and ledger entries are kept as financial records, including for cancelled and refunded orders.
• Sessions expire, and are deleted when you sign out.
• Verification, password-reset and sign-in challenge tokens expire quickly.
• Security and rate-limit records carry an expiry and are swept.

When an administrator erases an account, the personal data on it is scrubbed. The row itself is retained in the one case where deleting it would destroy financial history that references it — the account can never sign in again either way.

Your choices

• You can change your name, language, timezone and bio in Settings.
• You can change your password, or sign out of your session, at any time.
• You can request a copy of your data, or its deletion, by opening a ticket from the support area.

Changes

If the data StreamBoost handles changes, this page is updated to match. The date at the top reflects the last substantive change.

Contact

Questions about this policy go through the support area, which reaches the site owner directly.