Files on your computer

Imported data, notes, simulated orders, backtests, and exports stay on your computer. Client-presence reporting does not upload them.

Galaxy Medal account association

Desktop checkout associates a Galaxy Medal order with the explicit signed-in official-app account or session. Browser checkout associates it with the account matching the Zinuto ID deliberately entered and validated for that order; it does not require sign-in or prove that the payer owns the account. The service never guesses an account from a name, email, amount, or payment time. A full Zinuto ID appears on a Galaxy Star Map card only when the user requests public identity and the review is approved.

Historical Ko-fi records

For older Ko-fi transactions, the account service may retain versioned keyed-HMAC digests of normalized payer email that were created for legacy renewal matching. Raw email was handled only in webhook memory and was not stored or logged. Legacy Tip and Donation event labels are accounting facts, not names for the current Galaxy Medal product. Account deletion destroys these digests.

Galaxy Medal payments

Galaxy Medal checkout starts either in the signed-in official app or in the website after a Zinuto ID is validated. PayPal, Alipay, or the applicable app store processes the payment under its terms. The account service owns the order and status and keeps the minimum ledger needed for target validation, product delivery, reconciliation, refunds, fraud prevention, audit, and legal obligations. The website collects no card, payment-account, password, or verification-code details. Older Ko-fi and pre-product Alipay records may remain only for those same historical and legal purposes.

Browser checkout and session storage

Browser checkout sends the Zinuto ID you enter to the account service to validate the receiving account, then sends the selected tier, locale, payment provider, idempotency key, and a short-lived target token to create the order. This tab's session storage temporarily keeps the entered ID, target and attempt tokens, provider, tier, order ID, status token, and resume URLs so an interrupted checkout can resume. They are removed when the checkout is reset or the tab session ends; the account service retains its own minimum transaction ledger as described above.

Galaxy Star Map cards and public identity

A first or restored Galaxy Medal purchase automatically creates a stable card and position. By default the card is anonymous: it shows Medal designs, current or historical light state, and first-lit months, but no account name, Zinuto ID, email, payment, provider, order, or exact payment time. The Public identity switch in the official desktop app controls only the account name and full eight-character Zinuto ID. Turning it on submits them for review; only approval displays them and makes the card searchable by identity. While off, pending, rejected, hidden by an administrator, or being re-reviewed after an automatic name update, the card remains anonymous and anyone who knows its stable link can open it. Expiry, reversal, or a full refund dims the affected Medal but preserves its historical entry, stable link, and position; when no grant remains, the card returns to anonymous display. Only account deletion removes the card. Existing copies cannot be remotely recalled.

Account deletion is in the app

The website has no account-settings or deletion controls. The Public identity switch and account deletion are available only in the official app. Deletion removes the Galaxy Star Map card and account identity, destroys historical Ko-fi renewal digests, and detaches the account from retained ledger facts; minimum transaction, refund, chargeback, fraud-prevention, audit, and legal records may remain for the applicable period.

Client-presence record

Every official Zinuto distribution sends this record. Only an accepted observation starts the one-hour interval; failed requests may retry and do not consume it. Locally built Zinuto Core never sends it. The service HMAC-transforms the installation ID and discards the raw ID and request IP before storage. An optional session may link the record to an account. It contains no files, market data, trading, payment, or practice content. Account deletion removes that link; the anonymous record remains.

Website and download logs

Logs help keep the service secure and reliable and provide aggregate counts. IP addresses are masked at ingestion. For browser ID validation, the account service immediately HMAC-transforms the request address into a keyed abuse-control identifier and retains only its invalid-attempt counter and cooldown for up to 30 days; the guard stores neither the raw IP nor the entered Zinuto ID. Anonymous raw website logs remain for up to 30 days.

Contact

Email privacy questions and suspected vulnerabilities to contact@zinuto.com.

Your practice data stays on your computer.