What we collect
| What | Why |
|---|---|
| Email address | To send your files and receipt, and to find your order if you lose it. |
| Licensee name and company | They are printed on your licence. |
| "What's your app?" (optional) | Helps us decide which icons to make next. |
| Order details | What you bought, the price, and the PayPal payment ID, for our records and tax. |
| Where you came from | The campaign tag in the link you followed and the name of the site that sent you (like perplexity.ai), never the full address. Stored with your order so we know which links bring buyers. |
| Download counts | To enforce the 5-downloads-per-link limit. |
| Sign-in sessions | When you sign in, we keep the session's start time, last use and browser name so you can see and end your sessions from your account. |
We never see your card or bank details. PayPal handles payment and shares only the payment result and method with us.
Signing in with Google or GitHub
You can sign in with an emailed code, or with Google or GitHub. If you use Google or GitHub, we ask only for your email address. We receive that address and whether the provider has verified it, and nothing else: no name, photo, contacts or repositories. We use it to find your orders and start your session, then discard the provider's access token. We don't post anything or keep access to your account.
Who helps us
- Cloudflare hosts the site, stores orders and files, and runs the bot check on Find my order and checkout (Turnstile).
- Cloudflare Web Analytics counts page visits without cookies and without identifying you.
- PayPal processes payments.
- Resend sends order and sign-in emails.
- Google and GitHub confirm your email address, only if you choose to sign in with them.
We don't sell your data, and we don't use advertising or tracking cookies.
Cookies and storage
We set only the cookies we need to keep you signed in. io_session keeps you signed in for up to 30 days, or until you sign out. io_oauth lasts 10 minutes while you sign in with Google or GitHub, to check that the reply really comes from your sign-in. Neither is used for tracking or advertising. Your browser's local storage remembers your cart and whether you chose light or dark mode. Its session storage holds the campaign tag and the referring site's name until you close the tab. Both stay on your device; the campaign tag and site name are sent with your order when you check out. PayPal and Cloudflare Turnstile may set their own cookies when you use them.
How long we keep it
We keep orders for as long as tax and accounting law requires, then delete them. We don't send marketing email unless you ask for it.
Your rights
You can ask us for a copy of your data, to correct it, or to delete it (except what we must keep for tax). Email hello@iconoven.com. The data controller is Appic Marketing LLC, the company behind IconOven.