This policy explains the data the OG Flow Code Premium Toolkit storefront processes. We do not claim that the site collects no data. We describe the limited payment, access, preference, support, security, and hosting data it actually uses below.
Cookies and local browser storage
The site sets one first-party cookie:
ccs_sessionis set after a verified PayPal order, or successful access restoration. It contains a signed, short-lived reference to the relevant PayPal order and an expiry. It is HTTP-only,SameSite=Lax, Secure in production, unavailable to page JavaScript, and expires after 30 minutes. It keeps the payment reference out of URLs while the confirmation and download routes verify access.
The site also uses these local-storage preferences:
a11y-prefsstores accessibility-widget choices on the device.ccdt-updates-globe-positionstores the position of the on-screen changelog widget.
The application code does not send those two local-storage values to our server or use them for cross-site tracking. We do not use marketing cookies. We currently classify the payment-session cookie as strictly necessary and the two local preferences as user-requested functionality, so the site does not show a consent banner for them. (LEGAL REVIEW REQUIRED — confirm the classification in every jurisdiction served.)
During checkout, the browser also briefly stores a confirmation of the two checkout consent choices in sessionStorage, keyed to that order's opaque PayPal token — used only to resume completing your purchase if PayPal returns you to the site directly instead of through the usual in-page confirmation. It is deleted the moment it is used, is never sent anywhere except back to our own server to confirm your order, and does not persist beyond that.
One-time PayPal order data
New purchases choose one of five fixed-price tiers on the pricing page (Core, Full Toolkit, Multi-Stack, Architect, or Agency). The browser sends our server only the selected tier's identifier — never a price. The server validates that identifier against its own tier configuration and sets the corresponding fixed USD total, product identifiers, and line items; PayPal receives and processes the payment details directly. After PayPal reports the order as captured, the server independently re-checks the captured amount against the price for that tier before granting access. We do not receive your card number, bank credentials, or PayPal password.
Purchases made before this five-tier structure launched — the original toolkit, its Multi-Stack add-on, and the standalone Architect Pro Pack — remain restorable under the order-ID-and-email verification described below. That earlier pricing is no longer offered to new buyers.
Our server processes:
- the PayPal order ID, order and capture status, amount, currency, product SKU, purchase time, and capture time to create, capture, and verify the order;
- the PayPal-account email returned for the order only when needed to compare it with an email submitted through the restore-access form; and
- the calculated purchased product version and tier (one of the current Core, Full Toolkit, Multi-Stack, Architect, or Agency tiers, or a legacy base/Multi-Stack/Architect Pro tier for pre-relaunch purchases) while answering an access request.
These checks are performed live against PayPal with no-store request and response handling. The application has no customer database and does not persist the full PayPal API response. PayPal may return other payer or payment-source fields that briefly pass through server memory, but the application code does not read, log, or store them.
Restore access and the standalone pack upgrade
To restore a one-time purchase, you submit a PayPal order ID and the email associated with that PayPal order. They are sent in a POST body, never in the URL. The server asks PayPal for the order, verifies product, amount, completed capture, and purchaser email, and returns the same generic failure response for every mismatch. A running server instance temporarily keeps only a keyed hash of the payment reference and an attempt count for up to 15 minutes to slow repeated guessing.
Before the five-tier structure launched, an existing base-toolkit owner could also buy the Multi-Stack Expansion Pack standalone, using the identical order-ID-and-email check against the original order before a new, separately payable PayPal order was created. That standalone path is no longer offered to new buyers; purchases made that way remain restorable under the same check.
Private sessions and download watermarking
Payment references are never placed in page URLs, browser history, analytics page names, or public error messages. The short-lived signed session is stored only in the HTTP-only cookie described above. Every download route rechecks PayPal before building a ZIP.
Each archive carries a short one-way license identifier derived from the verified PayPal order using a server-only secret. Text-based files receive an inert comment in their native format, while JSON is left unchanged and the archive includes a top-level notice. The identifier does not reveal the raw PayPal reference or personal information by itself. It is used only to deter and investigate unauthorized redistribution.
Checkout consent and PayPal webhooks
On completed checkout, the application writes a log line containing only the one-way order watermark, accepted legal-policy version, and timestamp. It does not log the raw order ID, buyer email, name, or full PayPal response. Because the application currently has no database, this evidence is subject to the hosting provider's log retention; it should not be represented as permanent storage.
The PayPal webhook endpoint verifies PayPal's signature before accepting an event. For configured one-time order, capture, refund, and reversal lifecycle events, it logs only the event type and a one-way watermark of the relevant payment reference. It does not log the full webhook payload. Event delivery also depends on the events enabled in the PayPal dashboard.
Analytics, performance monitoring, and hosting logs
The site includes Vercel Speed Insights and the Vercel Web Analytics component. These are intended for aggregate performance and visit information and do not use third-party tracking cookies. Vercel may process request and device metadata, including URLs, referrer, browser/device type, approximate location derived from IP, timestamps, and performance measurements. Web Analytics collects only when that feature is enabled for the deployment. We do not intentionally send PayPal order IDs, buyer email, or payment details to either integration; those values are not in page URLs and the HTTP-only session cookie is not readable by those scripts.
Vercel also processes standard infrastructure logs such as IP address, requested path, time, and response status to host and secure the site. Retention follows the project's Vercel plan and settings rather than a fixed period hard-coded by this application.
Separately, the site records a small set of first-party usage events for its own internal reporting: which pages were viewed, roughly how long a page stayed open, and whether a small, named set of buttons or links were clicked (for example, the pricing call-to-action or navigation links). Each event carries a random id generated in your browser's sessionStorage — not a cookie, not persisted across browser restarts or visits, and never derived from your name, email, IP address, or any other identifying value — so events from one visit can be grouped together without building a profile of you over time. We do not receive or store your IP address, precise location, or any PayPal purchase detail through this system; completed purchases are recorded only as an anonymous count against the product tier and price, with no link back to who bought it. This data is stored in a Redis database we operate and is not shared with, sold to, or processed by any third-party advertising or analytics network.
Support email and third parties
- PayPal processes checkout, payment, order, refund, dispute, and dispute data under its own privacy terms.
- Vercel provides hosting, edge delivery, logs, Web Analytics when enabled, and Speed Insights.
- Google Gmail processes the sender, recipient, content, and attachments if you email flow.spacework4u@gmail.com.
We do not sell personal information or use it for targeted advertising. We do not currently operate an email newsletter or automatic monthly product-update mailing.
Retention
- The
ccs_sessioncookie expires after 30 minutes. - The restore-attempt counter expires after 15 minutes and may disappear sooner when a serverless instance is replaced.
- Live PayPal access responses are not cached or saved in an application database.
- Consent and webhook log lines follow Vercel log retention and any operator deletion practice.
- Browser preferences remain until you reset the widget or clear browser storage.
- Daily usage-event counters (pageviews, visits) are kept for 90 days; the aggregate all-time totals used for internal reporting (page popularity, click counts, purchase counts by tier) do not expire on their own. A rolling log of the most recent 200 events is kept only to show recent activity and is continuously overwritten.
- Support emails remain in Gmail until no longer needed for the support, billing, security, or legal purpose involved. (LEGAL REVIEW REQUIRED — the operator should adopt a documented retention schedule.)
What the downloaded toolkit does
The downloaded toolkit has no seller telemetry, account system, background service, seller connection, or self-updater. Its installer runs only when you launch it. If you install optional hooks, they can run documented local checks or a local notification after specific Claude Code events; they do not contact us or fetch product releases. Optional MCP configuration and the CI example can make third-party network requests only if you choose to configure or run them. Claude Code itself is a separate Anthropic product with its own data and update behavior.
International transfers and legal bases
PayPal, Vercel, and Google may process data outside your country, including in the United States, under the safeguards described in their own privacy materials. (LEGAL REVIEW REQUIRED — confirm current transfer mechanisms and controller/ processor roles for every jurisdiction served.)
For EEA/UK processing, the intended legal bases are performance of a contract for order verification, delivery, restoration, the private session, and checkout evidence; and legitimate interests for proportionate security, anti-abuse, license-watermark, webhook, and aggregate performance processing. The local preferences are requested by the user. (LEGAL REVIEW REQUIRED — confirm these bases and any required balancing test or notice.)
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data, and to complain to a privacy regulator. California residents may also have rights to know, delete, and correct information and not be discriminated against for exercising privacy rights. We do not sell or share personal information for cross-context behavioral advertising.
Email flow.spacework4u@gmail.com to make a request. We may need information sufficient to verify the request and may direct PayPal-specific requests to PayPal when PayPal, rather than the site operator, controls the relevant record.
Changes and contact
We will update the effective date and version when this policy materially changes. Questions can be sent to flow.spacework4u@gmail.com.