Privacy

Last updated 24 October 2026

Who is responsible

Webfaze runs webfaze.com and is responsible for the data described here. Contact us through the contact page.

Your account

• Your name, username, email address and a one-way hash of your password (we can’t read your password).
• Two-step sign-in secrets (stored encrypted), the public keys of your passkeys, and your sign-in history: time, device type and IP address, so you can see your devices and we can stop attacks.
• When you choose a password we check it against known data breaches in a way that never sends your password or its full hash anywhere.
• Your settings, such as whether you want the “Webfaze news” email.

Licences and your installations

• Your licence keys (stored encrypted) and which plan each belongs to.
• When a Webfaze installation activates or checks its licence (about once a month, and before installing an extension or update), it sends us the site’s address, the Webfaze version, a random installation id, the installation’s public key and, as with any connection, its IP address. We use these to count seats, stop copied keys and offer updates.
• Nothing else from your site is sent to us: not its pages, posts, uploads, users, form entries or visitor statistics. Those stay on your hosting.

Payments

• Payments are processed by Lemon Squeezy, our reseller and merchant of record. You give your card and billing details to Lemon Squeezy, not to us, and Lemon Squeezy’s privacy policy applies to them.
• We receive and keep the order: what you bought, the amount and currency, its status (paid, renewed, refunded) and the provider’s order number. We never see your full card number.
• If you sell extensions, your payout details are stored encrypted and only shown to staff when a payout is sent; each time is logged.

Emails

• We send emails you need: confirming your address, password resets, security alerts (new devices, password and two-step changes), replies to your community posts and, for developers, review and payout notices.
• The “Webfaze news” email (releases, security notices) is sent only if you turn it on, and every one has a way to turn it off.
• We don’t sell or share your email address for anyone else’s marketing.

Logs and security

• Security events (sign-ins, failures, changes to your account) are recorded with time, IP address and device type. Rate-limit counters and blocked addresses are kept to stop abuse.
• Actions by Webfaze staff are recorded in a staff log.
• The servers that run webfaze.com may keep standard technical logs (address, time, page requested) for operating and protecting the site.

Cookies

Only cookies the site needs to work: your sign-in session, a form-protection token and a cookie that recognises a device you’ve signed in from before. There are no advertising or analytics cookies.

The community

Questions, answers and your profile in the community are public. We hide things that look like keys or passwords in posts, but please don’t post private details.

Your choices

• Download everything your account holds as one file, or delete your account, from Account, Security.
• Deleting your account removes your name, email, profile and sign-in methods and revokes your licences. Order records are kept, no longer linked to your name or email, for tax and accounting.
• You can ask us to correct your data, or ask any other privacy question, through the contact page.