Last updated 30 July 2026
The headline: GOL has three products. Check and Envie process only the data you explicitly send, plus minimal operational data; command, code, and message content is processed in memory and discarded immediately. None of it is written to storage. Exnos runs entirely on your machine and sends nothing to us. We never sell your data. We do not share your data for cross-context behavioural advertising. Here is everything else, plainly.
| Data | Why | Where it lives | Retention |
|---|---|---|---|
| Your email address | Sign-in, license, receipts and the emails you ask for | Cloudflare KV (encrypted at rest) | Until account deletion |
| Single-use sign-in codes | Verifying it is really you | Cloudflare KV | Deleted on use or expires in 5 minutes |
| Session tokens and license keys | Keeping you signed in and metering usage | Cloudflare KV | Sessions: 30 days. Keys: until account deletion. |
| Credit balance, usage counts, and transaction log | Billing: deducting the per-use price, providing your transaction history | Cloudflare KV | Until account deletion |
| Payment records | Crediting your top-ups | Stripe. We never see or store card numbers. | Per Stripe's retention policy |
| IP address and user agent | Login notifications, session tracking, rate limiting, abuse prevention | Cloudflare KV (login records), Cloudflare standard server logs | Login records: until account deletion. Server logs: per Cloudflare's policy. |
| Device fingerprint (hashed) | Preventing duplicate accounts per device and enforcing free daily check limits | Cloudflare KV | Indefinite (hash only, not reversible to device identity) |
| Usage analytics for customer keys | None collected. Command content and message prompts are processed in memory and never written to storage: not a truncated copy, not a hash, nothing. What survives a request is your billing record only: the time, the cost, and whether it passed. | Nowhere | Not retained |
| Usage analytics for one internal test key we own | Producing published case studies of what Check catches on our own machine. Retention is hard-coded in the server to that single key; a customer key cannot be retained. | Cloudflare KV | Rolling event windows on our own key only |
| Lifecycle events (install, uninstall, key created, key re-issued, free-limit reached, top-up) with the tool channel, OS, architecture, and the first 12 characters of the account ID. No command content. | Understanding adoption and where the product loses people, aggregate statistics | Cloudflare KV | Aggregate counters kept indefinitely; individual events only in the rolling 200-event feeds above |
| Feedback you submit from the console (message, category, your email, IP) | Reading and acting on your feedback | Cloudflare KV, and delivered to us by email via Resend | Until account deletion, or on request |
| Terms-acceptance record (timestamp, terms version, IP) | Evidence that you accepted the Terms | Cloudflare KV | Until account deletion |
| Envie: machine fingerprint (hashed) sent with render-grant requests | Authorising the render. The fingerprint is bound into the signed grant so a grant issued to one machine cannot be replayed on another. Processed per request, never stored. | Not retained | Not retained beyond the request |
The golproductions.com website uses Google Analytics 4 (measurement ID: G-4E865XW6LD) to understand how visitors interact with the site. Google Analytics collects anonymised data such as page views, session duration, approximate geographic location, device type, and referral source. This data is processed by Google under its own privacy policy. Google Analytics does not have access to your GOL account data, API key, or any data you send through the Check API.
If you prefer not to be tracked by Google Analytics, you can use a browser extension such as the Google Analytics Opt-out Browser Add-on or enable your browser's "Do Not Track" setting.
The GOL website uses:
We do not use advertising cookies or third-party tracking cookies beyond Google Analytics.
Four providers touch slivers of your data so the product can work:
Each processes data under its own privacy policy and our instructions. Your data may be transferred to and processed in countries outside Australia by these providers. Cloudflare, Stripe, Google, and Resend each maintain standard contractual clauses and/or certifications for international data transfers.
We send transactional email only:
No marketing lists unless you explicitly opt in, and anything optional will have a working unsubscribe.
If you email us for any business reason, we keep that correspondence as ordinary business records for the life of the engagement and as required by Australian tax and record-keeping law. We do not share it with anyone except the service providers listed in section 5, and never for marketing.
| Data | Retention |
|---|---|
| Sign-in codes | Deleted on use or auto-expires in 5 minutes |
| Rate limit counters | Auto-expires in 60 seconds |
| Daily spending records | Auto-expires in 48 hours |
| Sessions | Up to 30 days |
| Usage analytics events | Customer keys: none, ever. Our own internal test key: rolling event windows for published case studies |
| Lifecycle event counters (installs, uninstalls, key issuance, top-ups) | Aggregate counts kept indefinitely. Individual lifecycle events sit in a rolling 200-entry feed carrying a truncated account ID; no command content in either. |
| Feedback and terms-acceptance records | Until account deletion, or on request |
| Transaction log | Rolling window of last 200 entries per account |
| Account records (email, keys, balance) | Until you close your account |
| Webhook idempotency keys | Auto-expires in 7 days |
| Envie render-token request fingerprint | Not retained beyond the request |
Ask us to delete your data and we will remove your account records. Unused credits are non-refundable and, if you have not requested full deletion, remain honoured in your account records indefinitely as described in the Terms.
Under the Australian Privacy Principles and applicable law, you have the right to:
Email support@golproductions.com for any of the above. We handle requests in line with the Australian Privacy Principles, and we will respond like humans, not like a ticket queue. We aim to respond within 14 days.
If you are a resident of a US state with a comprehensive privacy law (including California, Virginia, Colorado, Connecticut, Texas, Oregon, and others), you may have additional rights:
To exercise any of these rights, email support@golproductions.com. We will verify your identity using your account email and respond within 45 days.
GOL products use automated processing in the following ways:
None of these automated processes make decisions that produce legal effects or similarly significant effects on you. If you believe an automated decision has affected you unfairly, contact us at support@golproductions.com.
GOL products are not directed at individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that a user is under 18, we will delete their account and associated data.
We take reasonable steps to protect your personal information:
In the event of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), as promptly as practicable.
If this policy changes, the date at the top changes with it. Material changes will be flagged in the console or by email at least 14 days before they take effect.
Privacy questions, access requests, or complaints: support@golproductions.com.