Privacy Policy

The controller responsible for data processing on this site ("Goha", "we") is the person named in the Impressum. Contact details for privacy requests are listed there.

Goha has no login. When you first open the site, your browser generates a random identifier (a "clientId") that is stored in your browser's local storage and sent with your requests so we can show and manage your keys. Anyone using that browser can see and manage the keys tied to that identifier; clearing your site data removes it.

We process the following, on the legal basis of Art. 6(1)(b) GDPR (performing the service you request) and Art. 6(1)(f) GDPR (our legitimate interest in security and abuse prevention):

• Your clientId and the keys tied to it (creation time, expiry time, optional label).
• A hardware identifier (HWID) that the script sends the first time a key is used, so the key can be locked to that device.
• IP addresses and request metadata, logged for rate limiting, abuse prevention, and security, and recorded on activity events (e.g. key created, key validated). We do not use this for profiling or advertising.
• An admin session cookie — only ever set for the site operator, not for normal visitors.

We use your browser's local storage for the clientId and your key list, and a strictly-necessary cookie during ad-gate verification. These are required for the service to function. The operator's admin panel uses a session cookie. We do not set advertising or analytics cookies ourselves.

Third-party ad providers set their own cookies. Two separate things are involved: the ad-gate providers you are forwarded to when creating a key (work.ink / Linkvertise / LootLabs), and the on-page ads served by Adsterra. The Adsterra scripts are only loaded once you accept the consent banner; the ad-gate step is governed by the provider you choose at the moment you are forwarded there. Both are covered in the sections below.

Your consent choice itself is stored in your browser's local storage so we do not have to ask on every visit.

Creating or extending a key is monetized through an ad-link step. You choose the provider — work.ink, Linkvertise, or LootLabs— and are forwarded to their page. Once there, that provider's own privacy policy governs what they collect (which typically includes device data and advertising cookies). We only receive a confirmation that you completed their flow; we do not receive your activity on their pages.

• work.ink: work.ink/legal/privacy-policy
• Linkvertise: linkvertise.com/privacy
• LootLabs: loot-labs privacy policy

We display ads on this site through Adsterra, in popunder, social bar, and native banner formats. Their scripts are served from effectivecpmnetwork.com and set cookies and similar identifiers on your device to select, deliver, and measure ads.

If you are in the EEA, the UK, or Switzerland, nothing from Adsterra loads until you accept. On your first visit a banner asks for your choice, and the ad scripts are only added to the page if you agree (Art. 6(1)(a) GDPR, § 25(1) TTDSG). If you decline, no ad script is loaded. Either way the key system remains fully usable — we do not gate keys behind accepting ads.

To know whether we have to ask, we read the country your request arrives from via our own CDN (Cloudflare). This is a same-origin lookup — your IP address is not sent to any third-party geolocation service, and the country is kept only in your browser's session storage. Outside those regions, where opt-in consent is not legally required, the ad scripts load without a banner; you can still switch them off at any time via Cookie settings in the footer.

You can change your choice at any time via Cookie settings in the footer. Withdrawing stops any further ad script from loading. Cookies Adsterra has already set live on their own domain, so we cannot delete them for you — please clear them in your browser settings.

For details, see Adsterra's privacy policy.

Our application runs on Render (hosting) and our database is Supabase(PostgreSQL). Both act as processors on our behalf and may process data on servers located outside the EU. Such transfers are safeguarded by the EU Standard Contractual Clauses / the providers' data-processing terms.

Keys are kept until they expire or you delete them. Expired keys are dropped from active queries. Activity events are retained for up to about 90 days and then automatically deleted. Server logs are kept only as long as needed for security.

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object (Art. 21). You may also lodge a complaint with a supervisory authority. To exercise any of these, contact us via the Impressum. Because keys are not tied to a real identity, we may need the clientId or key in question to locate your data.

This service is not directed at children. If you are under the age of digital consent in your country, please do not use it without the involvement of a parent or guardian.

Deleting a key removes it from our database. Clearing your browser's site data removes your local identifier. For anything further, contact the address in the Impressum.