Privacy Policy
What we collect when you create an account, order a subscription and talk to support, how long we keep it, who else sees it and how to delete it.
Effective date: 29 October 2026
This policy explains what ForeverBot collects on https://botwowforever.com, why, how long we keep it and what you can do about it. It is short because there is little to tell: the site has no analytics, no advertising, no trackers, no third-party scripts and no mailing list.
Who we are
The operator of ForeverBot, based in the operator's country of residence, runs https://botwowforever.com and the ForeverBot software ("we", "us"). We are the data controller for the personal data described here.
Contact: the support chat on your order page, or open a support ticket from any order in your account.
What we collect and why
Account data. A nickname, a password and the date you joined. We never store the password itself, only a salted scrypt hash of it. We do not ask for an e-mail address, a name, a phone number or a payment card. Purpose: signing you in and tying your subscription and orders to you. Basis: contract.
Subscription and bot token. Your plan and its end date and, once you create one, a personal bot token (it starts with aur_). The full token is shown to you exactly once; we store only its SHA-256 hash, its last four characters and the time it was created. When the software starts, it presents the token to our licence endpoint, which answers with your nickname and whether your subscription is active. Through that endpoint we receive nothing about your game account, your characters or your computer. Basis: contract.
Order and payment data. For every order: the order code, the plan and its price in USD, the coin and network you chose, our wallet address, the exchange rate used, the exact amount quoted, when the quote expires, the order status, the hash of the blockchain transaction that paid for it (found by our server or pasted by you) and the amount actually received. We do not store the address you sent from, although the transaction hash points to it on the public ledger. Basis: contract; keeping the payment record afterwards rests on our legitimate interest in accounting and dispute handling and, where bookkeeping law requires it, on a legal obligation.
Support messages. Everything written in an order chat: your messages (up to 2,000 characters each), our replies and the automatic status messages, each with a timestamp. Basis: contract.
Reviews. If you write a review after a purchase: a rating from 1 to 5 stars, the text (10 to 600 characters) and when you wrote or edited it, linked to your account. One review per account. After we approve it, it appears on the home page with your nickname and the month it was written, and in the page's structured data so search engines can show it. Basis: consent, given when you submit it. You can withdraw it at any time by asking us in a ticket or by deleting your account.
Technical data. Like every web server, ours sees the IP address of each request. We use it only to count requests for rate limiting (sign-ups, sign-ins, orders, messages, licence checks) and to lock a nickname for 15 minutes after five wrong passwords. These counters live in the server's memory; they disappear when their time window ends or the server restarts. We do not write IP addresses, browser details or page views to our database, and we keep no visitor statistics. If the server runs behind a hosting provider's proxy, that layer may keep standard connection logs for a short time. Basis: legitimate interest in keeping the site up and abuse out.
What we do not collect. No e-mail, real name, postal address, phone number, payment card or bank details, device fingerprints, game account credentials, chat logs from the game or any files from your PC.
Legal bases
- Contract: account, orders, payment matching, delivery of the token and installer link, support chats.
- Legitimate interest: rate limits and lockouts, matching payments to orders, keeping payment records for accounting and disputes, notifying the owner of new orders and messages.
- Legal obligation: keeping payment records where bookkeeping or tax rules require it, and answering lawful requests from authorities.
- Consent: publishing your review with your nickname. Nothing else relies on consent.
Automated processing
The only automated decision we make is matching a blockchain transfer to your order by its exact amount and switching your subscription on when the network has confirmed it. Any payment whose amount does not match is reviewed by a person. We do no profiling.
Cookies and local storage
We set exactly one cookie, aurum_session, and only when you register or sign in.
- It holds a random session id; the server stores only a hash of it.
- It is strictly necessary to keep you signed in, so no consent banner is needed.
- It is
HttpOnly,SameSite=Laxand, on the live HTTPS site,Secure. - It lasts 30 days and is renewed for another 30 days when you visit with fewer than 15 days left. Signing out deletes it and the session behind it.
There are no analytics, advertising or third-party cookies. Our scripts do not use local storage or session storage. Your orders are listed in your account, and an order page can be opened only while you are signed in to the account that placed it.
Who receives data
- Telegram. The owner is notified through a Telegram bot about new orders, payments, support messages and reviews. A notification contains the order code, your nickname, the plan and price, the coin, amount and status, a link to the transaction on a public explorer, the text of your support messages and the text of your review. The owner's replies travel back the same way into your order chat. Telegram processes these messages on its servers under its own privacy policy. We send Telegram no password hashes, no tokens and no IP addresses.
- Blockchain and price services. Our server, not your browser, queries mempool.space (Bitcoin), public Ethereum nodes and Etherscan (Ethereum) and TronGrid (USDT on TRON). It sends them our wallet address and, when checking a payment, the transaction hash, and nothing else. For exchange rates it asks CoinGecko, Coinbase or Binance for current prices, with no data about you at all. These services see our server's address, not yours.
- The public blockchain. Your transfer to our wallet is recorded permanently on a public ledger that anyone can read. We do not control it and cannot change or erase it.
- Hosting. Our server and its database run with a hosting provider, as any website's do. The provider keeps the machine running; we do not hand it your data separately.
- Authorities. Only when the law requires it.
We do not sell, rent or trade data, and we run no advertising. Our pages load no third-party scripts, fonts, embeds or pixels; everything, including fonts and the QR code on the order page, is served from our own domain.
How long we keep data
| Data | Kept until |
|---|---|
| Session (signed-in state) | 30 days after it was issued or last renewed; deleted at once when you sign out; expired sessions are purged every 10 minutes |
| Unpaid order and its chat | Deleted 24 hours after its quote expired, or 24 hours after the last activity on it, whichever is later |
| Order under review | Kept until support closes it, then treated as a closed order |
| Paid or closed order, its chat and payment record | Deleted 7 days after the last message or status change |
| Account (nickname, password hash, subscription, token hash) | Until you delete the account |
| Review | Until you delete your account or ask us to remove it; we may also unpublish it |
| Rate-limit and lockout counters | In memory only; cleared when the window ends (up to 60 minutes) or the server restarts |
| Owner notifications in Telegram | Kept in the owner's private Telegram chat under Telegram's rules; we delete them on request |
Deleting your account removes the account, its sessions and its review immediately. Orders are detached from the account and anonymised; their payment records stay for accounting until they reach the deletion window above.
Security
- Passwords are hashed with scrypt and a random salt. Sign-in checks take the same time whether or not a nickname exists.
- Session ids and bot tokens are stored only as SHA-256 hashes, so a copy of the database does not give access to accounts.
- Five wrong passwords lock the nickname for 15 minutes; sign-ups, sign-ins, orders, messages and licence checks are rate-limited per network address.
- The live site is served over HTTPS with HSTS. A strict Content Security Policy lets the pages load scripts only from our own domain, and state-changing requests are accepted only from our own pages.
- Order pages are private, excluded from search engines and never cached.
- The database is a single file on our server; only the owner has access to it.
No system is perfectly secure. Keep your password and bot token to yourself. We will never ask you for your password, your token or a wallet seed phrase, in the order chat or anywhere else.
Your rights
Depending on where you live you may have the right to:
- Access your data. Your account page already shows your nickname, subscription, token hint, review and every order with its chat. Ask us for anything beyond that.
- Correct inaccurate data.
- Delete your data: use the delete button on your account page, or ask in a support ticket. What happens is described in the retention section.
- Object to processing based on legitimate interest, or ask us to restrict it.
- Receive a copy of your data in a plain machine-readable format.
- Withdraw consent for your review at any time.
- Complain to the data-protection supervisory authority of your country.
Write to the support chat on your order page or open a ticket. Because accounts carry no e-mail address, we may ask you to make the request while signed in, so that we know it comes from the account holder. We answer within one month.
Children
The site and the software are for adults. You must be at least 18 years old to create an account. We do not knowingly collect data from anyone younger; if we learn that we have, we delete the account.
International transfers
Our server may be located in a country other than yours, and Telegram and the blockchain and price services listed above process data in their own countries. We send them only the minimum described in this policy. If you are in the EU, the EEA, the UK or Switzerland, these transfers rely on the recipients' standard contractual clauses where they offer them, and otherwise on the fact that the transfer is needed to perform the contract you asked for: checking your payment and answering your ticket.
Changes
When we change this policy we publish the new version here with a new effective date. If a change matters to how your data is used, we also say so on the site before it takes effect.
Contact
- Operator: the operator of ForeverBot
- Country: the operator's country of residence
- E-mail: the support chat on your order page
- Or open a support ticket from any order in your account.