Last Updated: 28 August 2026

  1. Who Is Responsible for Your Data

    sh4rkk.com is operated by Alex Karras (sh4rk), an independent developer based in Greece, who is the data controller for personal data processed through this site. You can reach us on Discord, or at the business address published on the contact section of the home page.

  2. Information We Collect

    We keep this minimal: your email address, display name, and purchase history, so we can maintain your library. If you leave a review, we store its text and star rating, and, if you add one, a display name and profile image. Replies you write on a review are stored the same way, with the same name and picture, and so is whether you liked or disliked a review or a reply. For Discord role claims we temporarily process your Discord username. Your locale and timezone are read in your browser to suggest a currency and are not stored on our servers.

  3. Analytics

    Google Analytics (provided through Firebase) helps us understand how the shop is used. It sets an identifier in your browser and processes your IP address, which is personal data, so it only runs after you accept it in the cookie banner. If you decline, it does not run. We also use Vercel's analytics, which is cookieless and does not identify you, to count page views. We do not use analytics to build advertising profiles.

  4. Accounts and Authentication

    Accounts are managed through Firebase Authentication. You can sign in with email and password or with Google. Your account data is used to give you access to your library and is not sold or used for advertising.

  5. Cookies

    Strictly necessary cookies, which are always on, keep you signed in and remember a discount code applied through a referral link. These are required for the site to work and do not need consent.

    Analytics cookies (Google Analytics) are only set if you accept them in the banner. You can change your mind at any time: the"Cookie Settings" link in the footer of every page reopens the banner, so withdrawing consent is one click, the same as giving it.

  6. Why We Are Allowed to Process It (Legal Bases)
    • Performance of a contract: maintaining your account, library, and order history.
    • Consent: analytics cookies, and marketing emails, which we only send if you subscribe on the subscribe page or the user preferences page and confirm the address. You can withdraw consent at any time.
    • Legitimate interests: keeping the site secure and preventing fraud and abuse.
    • Legal obligation: keeping transaction records for tax and accounting.
  7. Who We Share It With (Processors)

    We do not sell your data. We share only what is necessary with service providers who process it on our behalf:

    • Lemon Squeezy is the merchant of record: it sells you the product, so for the sale itself it decides how your payment and billing data are handled, under its own privacy policy rather than as our processor. We receive your email address and what you bought, so we can give you access. Gumroad (legacy) held the same role for older purchases.
    • Google / Firebase for authentication and, with your consent, analytics.
    • Supabase for storing reviews.
    • Brevo for the email subscription list, and Resend for transactional emails, if you subscribe.
    • Vercel (hosting) and Cloudflare (content delivery and downloads).
  8. International Transfers

    Some of these providers are based outside the European Economic Area, including in the United States. Where that is the case, the transfer is covered by an adequacy decision or by Standard Contractual Clauses, so your data keeps an equivalent level of protection.

  9. How Long We Keep It

    Account and library data is kept for as long as you have an account. Transaction records are kept for as long as tax and accounting law requires. Review content stays published until you ask us to remove it. If you subscribe to emails, your address is kept until you unsubscribe.

  10. Your Rights

    If you are in the EU or EEA you have the right to access your data, correct it, delete it, restrict or object to its processing, receive a copy in a portable format, and withdraw consent at any time. To exercise any of these, contact us on Discord, or at the business address published on the contact section of the home page. You can also request full deletion of your account and its data at any time; some transaction data may be retained where the law requires it.

  11. Complaints

    If you believe we have mishandled your data, you have the right to complain to your local data protection authority. In Greece this is the Hellenic Data Protection Authority (Hellenic DPA), at dpa.gr.

  12. Policy Updates

    We may update this policy. The date at the top reflects the latest version, and continued use of sh4rkk.com after a change means you accept the current version.