Privacy Policy

2. Scope and related policies

This Policy applies to HFi Shop at shop.hfi.gg, related checkout flows, account pages, admin-reviewed order records, and shop support interactions. It does not control the privacy practices of Discord, Stripe, ARK: Survival Ascended, platform stores, game-server hosts, mods, plugins, or other third-party services.

Your use of HFi Shop is also governed by the Terms of Service, Cookie Policy, Refunds Policy, and any checkout disclosures shown at the time of purchase.

3. Information we collect

The information HFi Shop collects depends on how you use the site. The main categories are:

• Discord account information, such as Discord user ID, username, global display name, avatar reference, login time, and OAuth session state.
• Linked ARK identity information from HFiCore, such as trusted EOS ID, known character rows, server labels, latest seen timestamps, and link status.
• Shop account and session information, such as session ID, cookie values, login state, admin authorization status, and account page activity needed to keep you signed in.
• Order, entitlement, and fulfillment information, such as product keys, Shard amounts, supporter tier, donation amount, order public ID, Stripe customer or checkout references, payment status, delivery status, audit records, and refund or dispute flags.
• ArkShop and in-game shop state needed for fulfillment, such as Shard balance, kit grant state, item redemption records, selected target character/server, and delivery queue entries.
• Support and moderation information, such as messages you send to staff, issue descriptions, screenshots, logs, display preferences, donor display names, reports, fraud signals, and staff notes needed to resolve a request or protect the community.
• Technical information, such as IP address, browser type, device or user-agent details, timestamps, requested URLs, error logs, security events, and coarse operational telemetry from the web server or reverse proxy.

4. Sources of information

We collect information from you directly, from your browser, from Discord OAuth, from HFiCore identity records, from ArkShop and related game-server systems, from Stripe payment events, from HFi staff tools, and from logs generated by the shop, reverse proxy, Docker container, database, or delivery worker.

We may also receive information from community moderation channels, support reports, payment dispute notices, webhook events, game-server admin tools, and security systems when those records are needed to investigate fraud, abuse, delivery problems, account ownership, or policy violations.

5. How we use information

HFi uses personal information only for shop, community, security, and legal purposes that fit the HFi Shop service. Those uses include:

• Authenticating you with Discord and maintaining your shop session.
• Showing account status, linked identity status, Shard balance, orders, deliveries, supporter status, and donation activity.
• Creating checkout sessions, processing payment confirmations, recording payment status, and fulfilling paid orders after verified payment.
• Granting, deducting, reversing, or auditing Shards, kits, supporter entitlements, donation thank-you benefits, and other digital or in-game benefits.
• Preventing fraud, chargeback abuse, duplicate fulfillment, account impersonation, unauthorized access, cheating, exploit abuse, and unsafe RCON or database actions.
• Providing support, responding to requests, handling refunds or disputes, enforcing community rules, and protecting HFi staff and players.
• Maintaining logs, backups, audit trails, compliance records, tax/payment records, security records, and operational diagnostics.
• Improving the site, product catalog, checkout flow, account-linking flow, server labels, and player-facing support experience.

6. Payments and Stripe

HFi Shop uses Stripe for checkout, payment processing, subscriptions, refunds, disputes, fraud controls, and related payment records. Stripe may collect payment details, billing information, device information, transaction information, and fraud-prevention signals according to Stripe's own privacy and payment terms.

• HFi receives and stores payment references needed to operate the shop, such as Stripe customer IDs, checkout session IDs, subscription IDs, invoice IDs, payment status, amount, currency, product key, and metadata needed for fulfillment and audit.
• HFi does not intentionally store full card numbers, card security codes, or complete payment credentials on HFi servers.
• Stripe may process your personal data as an independent provider and, depending on the activity, as a processor or service provider for HFi.
• Payment disputes, refunds, chargebacks, and fraud reviews may require HFi to share order, account, Discord, fulfillment, and support information with Stripe, banks, card networks, law enforcement, or other parties involved in the payment process.

7. Cookies and session storage

HFi Shop uses a server-side session cookie to keep you signed in and separate from the main hfi.gg site session. The cookie helps maintain login state, Discord OAuth state, account menu state, and secure access to account or admin pages.

We may also use ordinary server logs and browser-provided request information for security, debugging, and analytics-like operational review. See the Cookie Policy for more detail. If HFi later adds analytics, advertising, or additional tracking tools, this Policy and the Cookie Policy should be updated before those tools are treated as active.

8. How we share information

We share personal information only when needed to operate, secure, support, or legally protect HFi Shop and the HFi community.

• With service providers, such as Stripe, hosting providers, database infrastructure, reverse proxy/CDN or DNS providers, email or support tools if enabled, monitoring tools, and security providers.
• With HFi staff, moderators, administrators, and trusted operators who need access to investigate orders, fulfillment, refunds, account-linking, delivery issues, abuse, fraud, or security events.
• With Discord-facing systems when needed to support login, supporter-role eligibility, community moderation, account-linking instructions, or support interactions.
• With payment networks, banks, Stripe, law enforcement, regulators, courts, or legal advisers when needed for chargebacks, fraud prevention, compliance, legal process, or protection of rights and safety.
• As public community display data when you choose or permit public display, such as donor display names, public donation preferences, leaderboard-style supporter displays, or community acknowledgments.

We do not sell personal information for money. We also do not knowingly share personal information for cross-context behavioral advertising. If that changes, HFi should update this Policy and provide any required opt-out controls before using the new practice.

9. Retention

We keep information for as long as reasonably needed for the purposes described in this Policy, including account access, order fulfillment, payment records, audit trails, legal compliance, tax records, fraud prevention, community safety, backups, dispute handling, and system security.

• Session data is kept for the configured session lifetime unless you log out, the session expires, or staff removes it for security reasons.
• Order, payment-reference, entitlement, audit, refund, dispute, and delivery records may be kept for longer periods because they are needed for accounting, fraud prevention, chargeback handling, support, and legal defense.
• Security logs, server logs, and backups may remain for limited operational windows or longer if needed to investigate abuse, outages, fraud, or security incidents.
• Some records may be retained even after account deletion requests if HFi must keep them for legal, accounting, security, anti-fraud, dispute, or community-safety reasons.

10. Security

HFi uses administrative, technical, and operational safeguards designed to protect shop data, including server-side sessions, access controls, environment-secret separation, database permissions, HTTPS through the public edge, private network routing to the shop container, and audit records for sensitive fulfillment activity.

No system is perfectly secure. You are responsible for protecting your Discord, platform, and game accounts, using strong passwords, enabling multi-factor authentication where available, and promptly reporting suspicious shop or account activity.

11. Children's privacy

HFi Shop is a general-audience community shop and is not directed to children under 13. Do not use HFi Shop if you are under 13. If you are under the age of majority where you live, use HFi Shop only with permission from a parent or legal guardian.

If HFi learns that it has collected personal information from a child under 13 without appropriate parental consent, HFi will take reasonable steps to delete or disable that information unless retention is legally required for security, fraud, dispute, or legal reasons.

12. Privacy rights and requests

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, or opt-out related to certain personal information. HFi will respond to verified privacy requests as required by applicable law.

• To make a privacy request, use the posted contact page or official HFi support channel.
• We may need to verify your Discord account, order details, linked ARK identity, or other information before acting on a request.
• We may decline or limit a request when allowed by law, including where records are needed for payment disputes, fraud prevention, accounting, security, legal claims, community safety, or another protected purpose.
• We will not discriminate against you for exercising privacy rights, but some features may stop working if required account, payment, or fulfillment data is deleted or restricted.

13. Your choices

• You can choose not to sign in with Discord, but account-specific checkout, Shard purchases, supporter subscriptions, and in-game redemptions may not work.
• You can log out to end the active shop session in your browser.
• You can manage Discord privacy settings through Discord, payment privacy settings through Stripe where available, and browser cookie settings through your browser.
• You can choose public or anonymous display where HFi Shop offers that option, such as donation display preferences.
• You can contact HFi support to request account assistance, privacy review, correction, deletion, or subscription cancellation support.

14. International and third-party transfers

HFi Shop may be accessed from different locations, and the services HFi uses may process information in the United States or other countries. Privacy laws may differ from country to country. By using HFi Shop, you understand that information may be processed where HFi, Stripe, Discord, hosting providers, or other service providers operate.

15. Third-party links and services

HFi Shop may link to Discord, Stripe Checkout, ARK-related services, community channels, support pages, documentation, or other third-party sites. Those services control their own privacy practices. Review their policies before using them or submitting information to them.

HFi is not responsible for third-party privacy practices, security, data retention, or account controls, except where HFi is legally responsible for its own use of those third-party services.

16. Security incidents

If HFi discovers a security incident involving personal information, HFi will investigate, take reasonable containment steps, and provide notices when required by applicable law. Notice may be provided through the site, Discord, email if available, account page, public status update, or another practical channel depending on the incident and available contact information.

17. Changes to this Policy

HFi may update this Privacy Policy from time to time. The updated Policy will be posted on this page with a new effective date or last-updated date. Continued use of HFi Shop after an update means the updated Policy applies to future use and, where legally allowed, existing records handled after the update.

18. Contact

Privacy questions, account requests, support requests, and legal notices for HFi Shop should be sent through the posted contact page or the official HFi community support channel announced by staff.

Include your Discord username, relevant order ID, linked survivor/server details when applicable, and a clear description of the request. Do not send passwords, full card numbers, one-time codes, private keys, or unrelated personal information.