Last updated 2026-08-10
Privacy Policy
This site runs no analytics, embeds no trackers, and sets no cookies while you browse. Personal data is collected in four places only: when you write to me, when you subscribe to the mailing list, when you create or sign in to an account, and when you use a licence. This page says exactly what each one stores. What you tell me about yourself at signup is counted in aggregate to decide what to build — it is never sold, shared, or used to target you.
1. Who is responsible
Thanadet Sribandit (sole trader), 66/1 Moo 8, Nong Waeng Subdistrict, Kanthararom District, Sisaket 33130, Thailand, is the data controller for this site and for ZHiCK plugin licensing. Questions about anything on this page, and any request described in section 8, go to zhickstudio@gmail.com.
2. What this site does not do
Worth stating plainly, because it is the part that removes most of the usual concerns:
- No analytics of any kind. No Google Analytics, no Plausible, no self-hosted equivalent. Page visits are not counted or profiled.
- No advertising, no tracking pixels, no fingerprinting scripts, no cross-site identifiers.
- No cookies while you browse. Browsing the portfolio, the blog or the shop sets nothing. The only cookies this site can set are session cookies after an explicit sign-in — a customer signing in to their account, or the operator signing in to the admin panel — and they do nothing except keep you signed in.
- No remote fonts or remote images. Everything the pages load comes from this domain, so no third party learns you were here just because a page rendered.
- No data is sold, rented, or shared for anyone else's marketing. Ever.
Because there are no visitor cookies and no tracking, there is no consent banner. A banner asking permission to do nothing would be theatre.
One number is kept: how many times each installer has been downloaded, per build, per day. It records the file and the date and nothing else — no address, no browser, no account, no session. Two people downloading the same file are indistinguishable in it, and so is one person downloading it twice. It exists so the studio can tell which tools people actually use, and it is why the list above says nothing about page visits being counted: they are not.
3. What is collected, and when
Nothing here is collected passively. Each row happens because you did something specific.
| What | When | Why |
|---|---|---|
| Name, email, and the project type, budget and message you write | You submit the contact form | So I can read it and reply. No IP address is recorded with it. |
| Email address | You subscribe to the mailing list | To send the list. One click unsubscribes, using a signed link so nobody else can unsubscribe you. |
| Email address, an optional name, and your password (stored only as a hash that cannot be reversed) | You create an account with email and password | So you can sign in and see your licences, orders and downloads. Whether you also ticked the box for product news is stored with it, and can be changed in account settings at any time. |
| Your email address, name and Google's account identifier — never your Google password, contacts, photo or anything else | You sign in with Google | Google confirms who you are and only those three things are kept. Google necessarily learns that you signed in to this site; what they do with that is governed by their own privacy policy. |
| A display name, the country you say you work from, what you do, and which programs you work in (Nuke, After Effects, Resolve and so on) — every answer chosen from a fixed list, never free text | The first time you sign in, in a short form that appears once | To know who these tools are being built for, and above all which program to build the next one for. Counted in aggregate to make that decision; never used to target you individually. Every answer can be changed at any time in account settings. |
| Optionally: whether you freelance or work at a studio, roughly how long you have been doing this (a range, never your age or date of birth), and how you found this site | The second screen of that same form, which has a Skip button and means it | They shape pricing and tell me whether posting work anywhere reaches anyone. Because this site runs no analytics (see section 2), asking is the only way that last one can ever be known. Skipping costs you nothing, and each answer can be cleared later. |
| IP address and browser identification | You sign in, by either method | Shown to you as your own session list, and used to notice an account being used from somewhere it should not be. |
| Email address | You start a trial or buy a licence | It identifies the licence. It is how you get your key back if you lose the email. |
| Machine fingerprint and the machine's name | You activate a licence on a computer | To count how many machines a licence is used on. See section 4. |
| IP address | You activate, deactivate or start a trial | Rate limiting and abuse investigation. Not used to build a profile or to locate you. |
| IP address, plus the email or licence key that was tried | A licence or trial request fails | So a licence key cannot be found by guessing. Kept briefly, then discarded. |
Payment details are never collected by this site and never reach this server — see section 6.
4. The machine fingerprint, in full
A licence is tied to a computer, which means something has to identify that computer. What is stored is a SHA-256 hash of a Windows installation identifier combined with a fixed ZHiCK-specific prefix. The raw identifier never leaves your machine, and the hash cannot be reversed back into it.
- No hardware serial numbers, no MAC addresses, no disk or CPU identifiers are read or transmitted.
- Because it is namespaced to ZHiCK, the same computer produces an unrelated value for anyone else's software. It cannot be used to match you across products.
- It is stable across reboots, RAM and GPU changes — it changes when Windows is reinstalled, which is exactly when a licence legitimately needs re-activating.
- You also supply a machine name so you can recognise your own computers in the seat list. It is whatever your computer is called; you can change it.
5. Email
Transactional email — receipts, licence keys, trial reminders — is sent through Resend, an email delivery provider. Your address and the contents of the message pass through their systems, which is unavoidable for anything that has to arrive in an inbox.
Mailing-list email is separate from transactional email. Unsubscribing stops the list and does not stop a receipt for something you bought, because a receipt is a record you are entitled to.
6. Payments
Payments are handled by Stripe, who process the payment on my behalf. The sale is made by me, and the invoice comes from me.
Card numbers and billing details are entered on Stripe’s systems and never touch this server. What comes back is limited to what is needed to issue your licence and keep a record of the sale — your email address, the amount, the country used for tax, and their reference for the transaction.
7. Video embeds
Some portfolio pieces are hosted on YouTube or Vimeo. Nothing is requested from either until you click play — until then the page shows an image served from this domain. Once you do, that provider receives the request and applies their own privacy policy. YouTube embeds use the no-cookie variant.
8. How long things are kept, and your rights
Contact form messages are deleted after 24 months. Mailing-list entries are kept until you unsubscribe. Failed licence attempts are kept only as long as the rate-limiting window needs them. Licences, seats and the sales record are kept for as long as the licence is valid and afterwards for as long as tax and accounting law requires.
You can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be erased. Write to zhickstudio@gmail.com.
One limit worth being straight about: a request to erase everything cannot remove the record of a completed sale, because that is an accounting document. What happens instead is that the personal parts are stripped — the email address is replaced, and the record continues to exist as an anonymous line in the books.
If you are in the UK or EU, the lawful bases are: consent for the mailing list and for product-news email you opt into on your account, contract for anything needed to sell and deliver a licence (including the account itself), and legitimate interest for the abuse-prevention data in section 3. You have the right to complain to your local data protection authority.
9. Children
Nothing here is directed at children, and the products are professional tools. Accounts and purchases are not knowingly offered to anyone under 16.
10. Changes
If this policy changes in a way that affects what is collected or who it goes to, the date at the top changes and anyone on the mailing list is told. Small corrections are made without announcement.