Privacy Policy

This Policy describes how data is processed:

• on slarp.gg and its subdomains (the account area play.slarp.gg, the forum forum.slarp.gg, Neuro ai.slarp.gg);
• in a SLARP account;
• in the SLARP app for Windows;
• in the SLARP server network through which the app carries traffic;
• when digital orders are placed and fulfilled;
• when you contact support.

1. Data controller

ESIMPSON LLC, a limited liability company registered in Sharjah Media City (Shams), United Arab Emirates; licence No. 2645101.01, Sharjah Media City (Shams) Free Zone Authority. Address: Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, United Arab Emirates. Email for personal-data requests: hello@esimpson.org. SLARP is the trade name of the slarp.gg storefront; the data controller is ESIMPSON LLC (the “Controller”).

2. What data we collect and where it comes from

2.1. Website, account, orders and community

• SLARP account: Telegram ID and public profile data; email when you sign in by email; internal account and session identifiers; the fact and time of your consent to the public documents; the generalized browser and operating-system name of a session. Signing in to the site from the SLARP app uses a one-time link. The code in the link is stored on the server only as a hash and is valid for no more than 2 minutes.
• Order: the selected product, region and option; the recipient’s login or other identifier; order number and amount; payment and fulfilment statuses; operation identifiers at the payment and technical partners. A payment receipt is generated from the data of a paid order. The order’s owner can open it in their account, print it or save it.
• Protection of orders and the free trial. When an accelerator order is placed and when a free trial is issued, we store a tag of the IP address and a tag of the email address normalized to one form: lower case, and for Gmail addresses also without dots and without the part after “+”.

  The tag is produced by a keyed hash (HMAC) with the Controller’s secret key. The IP address or email itself is not stored in it, and it cannot be recovered from the database alone.

  The tags are compared with the tags of other accounts:

  • order tags are checked by anti-fraud rules and may put an order’s fulfilment on hold until it is reviewed;
  • trial matches are only recorded and block nothing automatically.
• Support: the content of your request, attached materials, the order number and your contact details.
• Forum:
  • member profile data: username, display name, bio and status, avatar and banner, links to profiles on other services if the member added them;
  • published posts and wall entries, likes, follows and the friends list;
  • private messages and chat messages;
  • reports and moderation decisions.
• Operation and protection of the site and the API: request date and time, IP address, browser or app-version details, security logs, session cookies and local interface settings. The IP address is also used by rate limiters.
• Product analytics: event type, section, page path, product code and a pseudonymous session identifier. The analytics stream must not contain email addresses, recipient data, payment details, issued codes or free text. The survey on the uninstall page stores only the selected reason and the app version, with no user or device identifiers and no IP address.

2.2. The SLARP app for Windows

• Device data. When a key is activated and when you sign in to the app through your account, the following is sent to the server:
  • computer identifier — a SHA-256 hash computed from the Windows installation identifier (MachineGuid). The system identifier itself is not sent to the server;
  • computer name — the Windows network name.

  The server stores them together with the time of linking, the time of the last request to the service, an unlink flag and hashes of internal session tokens. This data is needed for the per-key device limit, the device list and unlinking.

  The device list is shown to you in the app and in your account: name, time of linking and time of last activity. Your account also shows unlinked devices — until they are deleted on the schedule in section 6.

• Signing in to the app via the site. The server stores the name of the computer that requested the sign-in so it can be shown at confirmation. A sign-in request is valid for 5 minutes and is then deleted.
• Service requests from the app. The app sends its version, the selected mode and connection route, and an internal session token.

  The list of games, programs and sites selected for acceleration is not sent to the server. The app itself determines on your computer which process and site a connection belongs to and routes only what you selected through the SLARP network. The app finds the games installed on your computer by itself from launcher data, and this list also stays on the computer. The Controller receives the selected games, programs and sites only as part of a diagnostic report that you sent.

• Data on your computer. Everything listed below is stored on your computer and is not sent to the servers automatically:
  • the internal session token — in Windows Credential Manager;
  • the app’s settings and logs (connections, route choice, game server addresses, errors) — in the app’s data folder.
• Diagnostic reports. A report is created on your computer with the “Report a problem” button or when the app crashes, and goes to the Controller only by your action.

  What a report contains:

  • your description, up to 500 characters;
  • app version, mode and connection route;
  • the selected games, programs and sites;
  • fragments of the app’s logs, including game server addresses and country codes;
  • the computer’s network settings: network adapters, local IP addresses, DNS servers, routing table;
  • the list of running processes. Only processes related to networking, games, launchers, anti-cheat and the selected programs are included.

  What is removed or masked before sending (the masking is repeated on the server):

  • the Windows user name in file paths and the account’s security identifier (SID);
  • the computer name;
  • MAC addresses — only the part that identifies the manufacturer remains;
  • activation keys, passwords, tokens, email addresses and unique identifiers.

  When a report is sent:

  • a problem report — only after you press the button;
  • a crash report — after your confirmation, or automatically if you chose automatic sending in the settings.

  If the server cannot be reached, the report is saved to your desktop and is not sent anywhere. A received report is linked to the key and the device it was sent from.

• Network quality measurements (“Anonymous telemetry”). In versions 1.3.1 and newer, measurements are sent only if you turned on the “Anonymous telemetry” switch in the app’s settings; it is off by default. Earlier versions could send measurements even if the switch was not turned on.

  What a measurement contains:

  • whether the SLARP network servers respond and with what latency;
  • the share of lost network packets and the latency for the addresses and ports of the game servers you played on;
  • aggregate route-choice counters: how many connections went through SLARP servers and how many went direct.

  As of this revision the server accepts such measurements but does not store them. Measurements the server stored earlier are deleted automatically no later than 30 days after receipt. If storage is turned on again, the rules are:

  • a measurement is stored together with the app version, the time and only the first two numbers of the sender’s IPv4 address (for example, 95.24.x.x);
  • the full IP address, key, account and device are not stored with the measurement;
  • route-choice counters are not written to the database; they go only to the API’s service log;
  • measurements from app versions below 1.3.1 are not stored.
• Connectivity checks. The app checks whether the internet works and whether the ISP is restricting it, to tell such cases apart from a service failure. For this it contacts publicly available addresses:
  • ya.ru, mail.ru, gosuslugi.ru;
  • www.cloudflare.com, cp.cloudflare.com, speed.cloudflare.com (download of a 128 KB test file);
  • www.gstatic.com;
  • 1.1.1.1 and 8.8.8.8.

  The owners of these addresses receive the IP address the request was made from and the usual details of an HTTPS request — as with any request to them. The app sends them no other data.

• Name resolution (DNS). While the app is connected, it looks up server addresses by name through public DNS servers. Each such query contains the name whose address is needed, for example the name of a game server or a site.
  • Cloudflare (1.1.1.1). In Game mode, the names requested by the selected games and programs go here, except domains under .ru, .su and .рф. The query goes directly from your computer over plain, unencrypted DNS, so Cloudflare receives the name and your IP address. The names of the selected sites, and of Discord and Telegram if they are selected, are requested through a SLARP network server over encrypted DNS (DNS over HTTPS) when that route is available: Cloudflare receives the name and the IP address of the SLARP server, not yours. In System mode, all names go here except domains under .ru, .su and .рф; the query goes through a SLARP network server, and Cloudflare receives the name and the IP address of the SLARP server, not yours.
  • Yandex (77.88.8.8 and 77.88.8.1). In both modes, names under .ru, .su and .рф are requested from 77.88.8.8 directly from your computer over plain, unencrypted DNS. Yandex receives the name and your IP address. In System mode, requests to 77.88.8.8 and 77.88.8.1 are not routed into the SLARP network and go direct, including requests from other programs if these DNS servers are set in Windows settings.

  These DNS servers belong to third-party companies and operate under their own rules. The Controller has no control over what they record.

• Game covers. Game covers in the app’s interface are loaded by public links from Steam’s image server (cdn.cloudflare.steamstatic.com). That server receives your computer’s IP address and the address of the requested cover — as with any request to it.

2.3. The SLARP server network

• Traffic. While the app is connected, the traffic of the selected games and programs passes through SLARP network servers, and in System mode — all of the computer’s internet traffic.

  To deliver traffic, the servers process your IP address and the destination addresses at the moment of transmission. The Controller keeps no logs of visited resources on its servers and does not record the content of traffic. This promise covers the Controller only: the public DNS servers of Cloudflare and Yandex, which receive names from the app (section 2.2, “Name resolution”), operate under their owners’ rules. A request reaches the service you are using from the address of a SLARP server, and that address is used by many users at the same time.

• Key check on connection. When connecting over the Hysteria2 protocol, the network server verifies the key through the Controller’s API and sends the connection’s IP address along with it. The API does not store this information.
• Server service logs. The software on the network servers keeps service logs. They may contain technical details of a connection: the connection IP address, the destination address, the time, an internal session or key identifier. They are used only for diagnostics and network protection.

2.4. Neuro (ai.slarp.gg)

• What is stored. While you use Neuro, the Controller’s server stores:
  • chats: the title, folder, pinning, the selected model and agent, the time of creation and change;
  • messages: the text of your messages and of the models’ answers, the time, the model, the outcome of the answer (received, stopped, error, model refusal, rejected by the check) and the result of the automated check;
  • your own agents: name and instructions;
  • usage records for every message: the number of input, output and cached tokens and reasoning tokens, the cost in rubles, the operation identifier at the technical intermediary;
  • the Neuro balance and its movements: top-ups together with the order, the starter gift, reserves, charges, refunds and adjustments with their reason;
  • the accepted revision of the Neuro Terms and the time of acceptance, Neuro settings such as the spending limit;
  • complaints about answers: the reason, the model and the time, without the text of the chat.

  Neuro does not accept files or images at present.

• Encryption and storage location. The text of messages, the titles of chats and folders, the instructions of your own agents and the results of the automated check are stored in the database in encrypted form. Each account has its own encryption key; account keys are protected by a master key kept separately from the database. This is not end-to-end encryption: to show you a chat and to pass a message to a model, the Controller’s server decrypts the content at the moment of processing. Usage records and balance movements contain no message text and are stored without this encryption.

  All of this is stored on the Controller’s rented primary server in Germany (Frankfurt am Main), in the same database as the account, and is included in its encrypted backups (sections 4 and 6). If chat storage moves to another server or another country, the Controller will announce it in advance in a new revision of this Policy.

• Who receives a message. To get an answer, the Controller passes to the model providers and the technical intermediaries through which access to the models is provided:
  • the text of the message, the previous messages of that chat and the instructions of the selected agent;
  • an internal pseudonymous tag of the account — an irreversible hash by which the providers tell one user from another to protect against abuse.

  For the automatic chat title, the first messages of the chat are passed the same way to a low-cost model. Your email address, Telegram ID, name, IP address and payment data are not passed to the providers or intermediaries.

  The providers and intermediaries process the message and the answer to produce the answer, under their own data processing terms. The technical intermediaries process messages in the USA. The model providers and the platforms that run the models are located, depending on the selected model, in the USA, the European Union, the People’s Republic of China or other countries; in particular, messages to models by developers from China may be processed in China.

  The Controller sends messages only to platforms that, according to the technical intermediary, do not keep them for their own purposes, including model training. Some providers keep messages for a limited time under their own rules to monitor abuse.

• Automated check. Every message, together with several previous messages of the chat, is checked automatically before it is passed to a model, and so is every model answer, including for material sexually exploiting minors. The check is done by classifier models through the same technical intermediaries; they receive the text being checked. If material sexually exploiting minors is found:
  • the message is rejected and the account’s access to Neuro is suspended; if such material appears in a model’s answer, the answer is hidden and access is not suspended;
  • the checked text and the details of the check (account, time, result, hashes of the text) are stored separately from the chats, in encrypted form; the Controller’s team receives an alert without the content;
  • this material is handed over to the competent authorities on a lawful request. Only an authorized staff member can open it — on a lawful request or to review your own complaint about the suspension.
• What the Controller does not do. The Controller does not use users’ chats to train models, does not sell them and does not use them for advertising. The Controller’s staff do not read chats. An authorized staff member sees the text of a conversation only if you complained about an answer and passed its text in your request yourself, if you allowed a specific chat to be opened to handle your request, or if a lawful request binding on the Controller has been received. Server service logs contain identifiers, the model, the number of tokens, the cost and error codes, but not the text of messages.
• Starter gift. When the gift is credited, a tag of the email address, a tag of the IP address and a tag of the network (the first three numbers of an IPv4 address or the beginning of an IPv6 address) are stored. The tags are made with the same keyed hash as for the free trial (section 2.1); the addresses themselves are not stored in them. If a tag matches the tag of an account that has already received the gift, the gift is not credited. The tags are kept after the account is deleted, without a link to it.
• Managing your data. You can:
  • delete a chat — it is deleted from the working database at once;
  • download one chat or all your chats (Markdown or JSON);
  • delete your account — the chats, messages, folders, your own agents, complaints, Neuro settings and the account’s encryption key are deleted with it.

  Records of top-ups, charges and refunds are kept for mandatory record-keeping in the same way as order records, and after the account is deleted — without a link to it. Material from the automated check is kept for the period in section 6. The unspent paid balance can be refunded even after the account is deleted (Neuro Terms, section 8).

You enter data yourself or pass it through the sign-in method you chose. In addition, data is generated during the operation of the site, the app, the server network and the partners. If you order a gift for another person, you confirm that passing on their identifier is lawful.

SLARP does not ask for passwords to Steam, Telegram or game platforms, two-factor authentication codes or remote access to your device. Full bank card details are neither entered nor stored on slarp.gg. The SLARP app does not send the Controller the content of your traffic, your browsing history, your files or your correspondence.

3. Purposes and legal bases

• creating, protecting and maintaining a SLARP account — performance of the Terms of Service and security measures;
• price calculation, creation, payment, fulfilment, refund and support of an order, including the payment receipt — conclusion and performance of the contract;
• operation of the SLARP app and the server network: activation and sign-in, the per-key device limit, the device list and unlinking, route choice and traffic transmission, update checks and the staged release of new app versions — performance of the Terms of Service;
• service notices about access expiry, order status and the release of a new app version — performance of the contract;
• answering a request and resolving a dispute, including the review of a diagnostic report you sent — performance of the contract, the Controller’s legitimate interests and legal requirements;
• network quality measurements — your consent, which you give by turning on the “Anonymous telemetry” switch. Turning the switch off stops the sending of measurements;
• posts, communication between members and moderation on the forum — performance of the Terms of Service;
• operation of Neuro: storing chats, passing messages to models, balance and usage records, handling complaints and requests — performance of the contract (Neuro Terms);
• the automated check of Neuro messages and answers and the storage of detected material sexually exploiting minors — legitimate interest in protecting minors and preventing crime and abuse; handing such material over on a lawful request — an obligation set by law;
• protecting the Neuro starter gift from repeat receipt — legitimate interest, with respect for your rights;
• fraud prevention and infrastructure protection — legitimate interest, with respect for your rights;
• detecting repeat use of the free trial and protecting the network from abuse, such as sending spam or attacks on third parties — legitimate interest, with respect for your rights;
• mandatory record-keeping and compliance with requests from public authorities — an obligation set by law;
• anonymized product analytics — legitimate interest in improving the purchase path without advertising profiling.

Where a particular processing is based on consent, you can withdraw it. This does not stop processing that is needed for a contract already concluded or is directly required by law.

4. Who receives the data

The minimum necessary data is received by:

• the hosting provider of the Controller’s server infrastructure;
• the hosting providers of the SLARP network servers — to the extent of the network traffic that passes through the servers rented from them;
• the payment provider that serves the selected payment method;
• the supplier of the selected digital deliverable — to the extent needed to fulfil the order;
• the providers of artificial intelligence models and the technical intermediaries through which access to the models is provided — Neuro messages together with the previous messages of the chat and the agent’s instructions, the answers to them and the pseudonymous account tag (section 2.4);
• Telegram — when you sign in through Telegram, contact support and for service notices in Telegram;
• the email delivery service — when a sign-in code and order notices are sent.

The recipient and the scope of data depend on the selected product and payment method. Data is not sold and is not shared for third-party advertising.

Where data is stored and processed:

• account, order and device data — on the Controller’s rented primary server in Germany (Frankfurt am Main);
• Neuro chats and messages — on the same server, in encrypted form (section 2.4);
• encrypted database backups — on the primary server and on a separate Controller server in Sweden;
• the SLARP network servers are located in Germany (Frankfurt am Main), Finland (Helsinki), Poland (Warsaw), Sweden (Stockholm) and Russia (Moscow, Yekaterinburg, Novosibirsk). Traffic that the app routes through the SLARP network may pass through servers in Russia and outside it;
• Neuro messages are processed by the technical intermediaries in the USA, and by the model providers in the USA, the European Union, the People’s Republic of China or other countries, depending on the selected model (section 2.4);
• the email delivery service processes the recipient’s address and the content of the email in the USA.

Data may be processed outside your country. Cross-border transfers are made only to the extent needed for the service to work and the order to be fulfilled, and with contractual and technical safeguards.

Data is disclosed to public authorities only if the Controller has a legal request that is binding on it, and only to the extent of that request. A complaint from a third party, including a hosting provider, is not in itself a ground to disclose your data to it.

5. Cookies and analytics

The site uses necessary cookies for authorization and session protection. The browser’s local storage holds the theme, interface state and a pseudonymous analytics session identifier. At present, product events are sent only to SLARP’s own API. No external advertising tracker is used. Neuro on ai.slarp.gg uses the same SLARP account session cookie; an unsent message draft (for no more than 7 days) and the Neuro interface settings are kept in the browser’s local storage.

The one-time link for signing in to the site from the app carries the code in the part of the address after the “#” sign. That part is not sent to the server when the page loads and does not end up in logs or in the Referer header. The site removes the code from the address bar at once.

The SLARP app sends data only to the Controller’s servers and to the third-party addresses listed in section 2.2: the connectivity-check addresses, the public DNS servers of Cloudflare (1.1.1.1) and Yandex (77.88.8.8, 77.88.8.1) and Steam’s cover server. No third-party analytics trackers or advertising identifiers are used in the app.

6. Retention and security

Sign-in codes and unfinished authorization attempts are valid for a limited time. Sessions have an expiry and can be revoked. Account data is kept until the account is deleted. Records of orders, payments, refunds and requests are kept for as long as the contract, mandatory record-keeping and the protection of the parties’ rights require. Once the purpose is achieved, data is deleted or anonymized unless the law requires keeping it longer.

Specific periods:

Security measures:

• access is restricted by role;
• connections are protected;
• actions on orders and payments are logged;
• secrets are not placed in frontend code;
• the text of Neuro messages, the titles of chats and folders, the instructions of your own agents and the check results are encrypted with the account’s key, and material from the automated check with a separate key; service logs contain no Neuro message text;
• diagnostic reports are kept in a closed store; only support staff can access them through the workspace, and every download of a report is logged.

7. Your rights

You can request information about processing, demand that data be corrected, restricted or deleted, object to processing and withdraw consent where it is the legal basis.

In addition, at any time you can:

• unlink a computer in the app or in your account;
• turn off “Anonymous telemetry” in the app’s settings;
• delete a Neuro chat and download your Neuro chats;
• ask us to delete a diagnostic report you sent before its retention period ends.

Send requests to hello@esimpson.org. For a quick question, support on Telegram is available. Do not send passwords, confirmation codes or full payment details.

8. Changes

A new revision applies from the stated publication date. Changes do not cancel the rights and obligations under orders placed on the terms that were in force before.