Privacy
What we hold, why we hold it, and for how long. Written to be read rather than to be complied with.
The short version
- No third-party analytics, no advertising networks, no tracking scripts, no fingerprinting.
- These marketing pages set no cookies at all. Signing in to your account sets one, and it keeps you signed in — nothing else.
- We never see what is on your screen, what you have open, or what you type.
- CtrlFlick Lab sends usage counts and diagnostics — which of a game’s guns you use, and what went wrong if Lab fails — so we can improve its recoil patterns and tuning. It is on by default and one switch in Lab’s settings turns it off.
- Your IP address is kept for 90 days for fraud detection, then shortened — 12 months if your licence was revoked or reported itself modified, or if the address requested a free trial. We geolocate it to a country and no further.
What the application sends
While CtrlFlick Recon or CtrlFlick Lab is running it checks your licence with us. Each check sends:
- Your licence key.
- A hardware identifier — a set of one-way hashes derived from components of your PC. These cannot be reversed into serial numbers or into any identifier we could match against anything else.
- Your computer’s name, in plain text. This one is not a hash, deliberately: it is what lets you tell “DESKTOP-GAMING” from “WORK-LAPTOP” on your account page when you want to know which machine holds your licence. If your computer name identifies you, so does the entry on that page.
- The version you are running.
That is the whole of a licence check. It does not include your files, your screen, your keystrokes, or the programs you run. CtrlFlick Recon sends nothing else.
CtrlFlick Lab: usage and diagnostics
CtrlFlick Lab also sends us a little about how it is used, to improve its recoil patterns, its tuning and the games it supports — above all, to know which guns to tune first, and whether an update’s tuning was an improvement. It is on by default; the switch “Help improve Lab” in Lab’s settings turns it off, and from then on none of it is sent. It is:
- Usage counts, at most once a day, for each game you have: the guns you have used Lab’s recoil assistance with, and in how many Lab sessions each; and how many times you put your own tuning back after an update changed it. Names and numbers — never when, or for how long, you played.
- Diagnostics, when Lab fails at something: which version of Lab and of the game’s pack you have, and what failed. Technical detail about Lab, never about you.
- Game requests, only when you use “Request a game”: the game you name and the note you write.
Lab reads your game’s screen to know your loadout, and it does that on your PC alone: no picture of your screen, no keystroke and nothing from the game’s memory is sent with these counts. The counts go with your licence key, are in your data download, and are never sold or shared.
CtrlFlick Lab: reports
CtrlFlick Lab may send crash reports and diagnostics, to improve its autodetection and the program. It also keeps backups of your Lab setup, which you can turn off in Lab’s Backup tab.
What the server observes
Your IP address arrives with any connection, as it does with every website. We keep it for 90 days against the licence check, because “this key was used from forty networks this week” is how licence sharing is detected. After 90 days it is shortened so it no longer identifies a connection. We resolve it to a country only, which is done at the network edge before it reaches us — there is no lookup service and no third party involved.
Two situations keep it longer, for 12 months: a licence we have revoked, and a licence whose own copy of the program reported that it had been modified. Both are records of something we acted on or something the software measured, and both are the kind of thing that gets disputed months later — a record that is already gone cannot answer the dispute in either direction. If your licence is in good standing, this does not apply to you and the 90 days above is the whole of it.
The address a free trial is requested from is kept for 12 months for the same reason, and then shortened. The record that a particular machine has had its trial is kept for good — that is what stops the same PC taking an unlimited number of them — but it identifies the machine, not you.
The IP kept against a licence check is never joined to the page-view records below. They are separate on purpose.
Page views on this website
We count page views, server-side, in our own database. There is no script in this page doing it, nothing loaded from another company, and nothing that follows you to another website. What is recorded is the page, where you came from if a link sent you, the country, and an IP address that is already shortened when it is written — the last part is discarded before the row is stored, not later.
This is why there is no cookie banner on this site: there is nothing to consent to. It also works with JavaScript switched off, because it does not use any.
Connecting Discord
You can connect a Discord account to your licence account. It is optional, it is not a way to sign in, and nothing about your licence depends on it — your licence key works on its own whether you connect one or not.
If you do, we ask Discord for one thing: who you are. That gives us your account id and your username, and nothing else. We do not receive your email address, the servers you are in, your friends, or your messages — and we cannot read your messages, because the permission that would allow it is not one we ask for.
We also do not see what you are playing. Disconnecting it on your account page removes both the id and the username immediately, and leaves no record that there was ever one there.
Cookies
Three, all strictly necessary, none used for tracking:
- Signing in to your account sets one that keeps you signed in. It holds a signed reference to your customer record and an expiry.
- The checkout sets one while an order is in progress.
- The admin panel sets one for staff. It is of no use to you.
None of them are readable by anyone else, none are shared, and none exist until you do something that requires one.
What is kept, and for how long
| What | Why | How long |
|---|---|---|
| Email address, password hash, payment provider’s payer reference | Your account and your purchases | While the account exists, then 30 days |
| Discord account id and username, if you connect one | Somewhere to reach you about your licence | Until you disconnect it, or the account is erased |
| Computer name | Showing you which machine holds your licence | While that machine is active, then 30 days |
| Hardware hashes | Enforcing one PC at a time | While the activation exists |
| IP address against a licence check | Detecting licence sharing and fraud | 90 days, then shortened |
| … where the licence was revoked or reported itself modified | Evidence for a dispute about that decision | 12 months, then shortened |
| IP address a free trial was requested from | Stopping unlimited free trials | 12 months, then shortened |
| CtrlFlick Lab usage counts | Improving Lab’s recoil patterns and tuning | While the licence exists |
| CtrlFlick Lab diagnostics | Finding and fixing faults | 12 months |
| CtrlFlick Lab reports you send | Fixing Lab | Until we have dealt with it, 90 days at most |
| Games you request in Lab, and your note | Choosing which games Lab supports next | While the licence exists |
| Shortened IP, page, referrer, country | Knowing which pages are read | 12 months (shortened from the start) |
| Orders, invoices and tax records | We are legally required to | 7 years |
Your data, on request
Sign in to your account and you can download everything we hold about you — your orders, your licences, your machines and Lab’s usage counts — as a JSON file, immediately and without asking anyone.
Deleting your data
Email support@ctrlflick.com and we will remove your personal details. Two honest caveats, because they are true of any business selling software and are usually left unsaid:
- Order and tax records stay for seven years. We are required to keep them and cannot delete them on request. What we can do is detach them from your identity, which is what we do.
- The licence audit log is append-only. Records of issue, activation, revocation and refund are what make the log trustworthy, so entries are never edited or removed. They are pseudonymised instead.
- Your software keeps working. Being forgotten is not a cancellation: anything you have paid for runs until it expires, and the name your PC reported is removed from our records without stopping it. What ends is our ability to reach you — there is no address left, so the licence cannot be renewed and you cannot sign in to the account area. Download your data first if you want a copy of it.
Who else sees it
- Our payment provider handles the payment itself. We never receive or store your card details.
- Our email provider delivers your licence key and receipts, and, once your licence has run out, the occasional email about updates. Every one of those has an unsubscribe link.
- Our network provider sits in front of this site, as it does for most of the web, and passes on your IP address and country.
We sell nothing to anyone, and there is no advertising network involved at any point.
Changes
If this page changes in a way that affects what we collect, the change applies from when it is published, and we will say so rather than editing quietly.
- 31 October 2026 — CtrlFlick Lab: crash reports, diagnostics and setup backups (“CtrlFlick Lab: reports” above).
- 1 November 2026 — update emails after a licence runs out, with an unsubscribe link.
- 23 October 2026 — added CtrlFlick Lab’s setup check reports: a picture of your game screen, sent only when you press Send or turn on “Always send”.
- 21 October 2026 — added CtrlFlick Lab’s usage counts, diagnostics and game requests (“CtrlFlick Lab: usage and diagnostics” above), and the switch that turns them off. CtrlFlick Recon is unchanged.