Privacy Policy

Updated October 3, 2026

This policy explains the public website, the customer dashboard at nebulavgc.com/customer, Discord support, and the Windows Multiloader preview. Required reporting and OLD/NEW HWID comparisons below apply to the Multiloader 2.0.8 rollout; this disclosure is published before that backend cutover.

When you visit

Your browser sends connection details, including your IP address, the page requested, and browser information, to Cloudflare and our hosting provider so they can deliver and protect the site. They may handle connection logs under their own policies. Our public pages do not use analytics, advertising trackers, third-party fonts, cookies, or browser local storage.

Page resources

Styles, scripts, and icons are served with this website. If you sign in to the customer dashboard, your Discord profile picture may load from Discord’s image CDN; that request also shares connection details with Discord. There are no embedded chat widgets or advertising services.

Product pages and compatibility

You can browse the catalogue and individual product pages without creating an account. Compatibility cards are product information only: the website does not scan your computer or read your processor, Windows version, TPM, HVCI, or Secure Boot settings.

Discord sign-in and your dashboard

The Dashboard link opens the customer area on nebulavgc.com. When you choose to sign in, Discord asks for access to your basic profile. We request the identify permission, not your email, messages, or server list. We receive your Discord user ID, username, optional display name, and avatar reference. We use the ID to show licenses assigned to you and the profile details to identify your account on the dashboard. We do not retain the OAuth access token after checking your identity.

If you activate a key, we associate the license with your verified Discord ID. Activating an unused key with the same product set as your current license adds its remaining time to that license; other product sets are linked separately. We record that each key was used so it cannot be activated again. The portal shows license status, expiry, device count, your active key and HWID reset status. Your active key is returned only within your authenticated, verified license-owner session so you can view and copy it. Keep it out of screenshots and public messages. The portal records session creation and last-use IP addresses for security and rate limiting. A random sign-in state expires after ten minutes; customer sessions expire after 24 hours of inactivity or seven days in total. Expired state and session records are cleaned up afterward. Security audit records become eligible for cleanup after 90 days. License records and Discord associations remain while needed to provide or administer access, subject to applicable retention obligations.

The portal uses first-party Secure, HttpOnly cookies for sign-in state and customer sessions. It does not use advertising cookies or browser local storage. The old /#dashboard demo, if opened from a saved link, uses only sample data in page memory; it does not connect to a customer account.

Windows Multiloader preview

The native Windows app signs in with a license key, independently of Discord website sign-in. Every sign-in requires device-bound verification. On launch, the app collects a device fingerprint, computer name, Windows build, and available hardware details locally: disk, RAM, monitor and motherboard serials; MAC addresses; system vendor and UUID; chassis, GPU, local IP addresses, connection types, Secure Boot and TPM status. Some fields may be unavailable on a given PC. Launch alone does not send the hardware report. When you submit a key, the app sends the collected report with device-held-key proof, including when sign-in is rejected for a device mismatch. Our service separately observes the connecting public IP; it is not the same as a client-reported local IP address. Device details are client-reported and are not proof of physical hardware. We use this information to apply license and device limits and investigate account access. Hardware reporting is required for Multiloader key sign-in; there is no opt-out. Please review this before purchasing.

The owner console can display device, hardware and login records. Hardware reports and mismatch snapshots are encrypted in server storage and are not returned to other customers. Device reports become eligible for cleanup 30 days after receipt; mismatch snapshots become eligible about 30 days after capture. Recent login and connection IPs have 30-day cleanup cutoffs based on their last-use or session-expiry records. Cleanup runs in bounded periodic batches; downtime and backlogs can delay deletion. Backups can retain earlier copies until their own retention period ends. If a verified Discord account is linked to the license, someone who signs in with that key on an approved device can see its display name, user ID, and avatar. Keep the key private. Loading the avatar contacts Discord’s image CDN from your device without sending your license key or auth token. The app does not save your license key or session tokens to disk. The Windows app is a preview, not a public software release.

HWID reset requests

A reset request requires a website session for the verified Discord account linked to the license and a recent server-recorded mismatch from that key. Requests and staff decisions enforce a six-hour per-license cooldown. When you submit a reason, NebulaAUTH sends your Discord profile, full license key, reason, and an OLD/NEW hardware comparison to our private staff channel. OLD refers to the saved device binding; NEW refers to the report sent with the rejected key attempt. The comparison includes reported fingerprint and available serial details. It does not authorize a reset by itself: staff must approve or deny the request, and approval clears the license’s device bindings and ends its loader sessions.

After a decision, the bot attempts to remove the raw key from the staff message and disable its buttons. OLD/NEW details and the decision remain in the message. Delivery or edit failures can delay this update. Discord messages, staff copies and screenshots are not erased by the server’s hardware cleanup and are subject to Discord’s retention and our staff handling. Requests, reasons and decisions are also retained in the service for administration and abuse prevention.

When you contact us

If you message us on Discord, we receive your Discord profile information and whatever you include in your message. We use that information to respond to your question. Please keep passwords, full payment details, and other sensitive information out of public channels.

Discord handles information on its service under its own privacy policy. Visiting a Discord link leaves this website.

Payments and software

This website does not collect payment details or process orders. Before making a purchase elsewhere, review the payment provider’s privacy information and the terms supplied with the software.

Questions about your information

Contact us privately through the official nebulavgc Discord to ask about information you have shared, request a correction, or ask for deletion where applicable. Information held by a third-party service is also subject to that service’s procedures.

Changes to this policy

We will update this page when our data practices change. The date above shows when this version was last revised.