Privacy Policy

Last updated: 8 November 2026

The AI chat is described in section 14B. AI chat and OpenAI.

Changes of 8 November 2026: the Benchmark and its results ranking (section 5F), retention of results (section 11) and how results are accepted into the ranking (section 12).

Changes of 7 November 2026: custom status and profile picture in Friends (section 5B), the Requests window with comments and a diagnostic log (5C), the local MCP server (5D), components downloaded from third parties (5E), automated content moderation (sections 10 and 12) and new retention periods (section 11).

We take care of your privacy. This notice fulfils the information duties under Articles 13 and 14 GDPR (Regulation 2016/679) and describes cookies / similar technologies across SmoothWizard services. It reflects actual processing in our products: the marketing site, pay.smoothwizard.com, the Windows desktop application, and SmoothWizard Mobile.

1. Controller

Artur Spychalski, conducting business as SkullMedia Artur Spychalski, entered in the Polish CEIDG register, NIP 5922292367, REGON 524191477.

Privacy contact: [email protected]. No Data Protection Officer (DPO) has been appointed - use the address above for GDPR matters.

2. Scope of services

This policy covers, among others:

• the SmoothWizard marketing site (smoothwizard.com),
• the payments and account service pay.smoothwizard.com (sign-up, login, subscriptions, orders, affiliate program),
• the SmoothWizard Windows application and related license / account APIs,
• the SmoothWizard Mobile app (App Store / Google Play) and the local mobile server in the PC app (phone-PC pairing on the LAN),
• community features in the Application (Friends, Requests) and the team moderation panel at support.smoothwizard.com,
• support channels (email, Discord) when you send us data in correspondence.

3. Categories of data

Depending on what you use, we may process among others:

• Account / identity: email, display name, avatar, external account IDs (Google, Discord, Steam, Twitch), hashed password (for email/password accounts),
• Transactional data: order and subscription history, amounts, currency, payment status, operator transaction IDs (Stripe; other PSPs when enabled), billing data as required by law,
• Affiliate data: partner code, sale attribution, commission balance, payout requests, phone (BLIK), IBAN / transfer details,
• Technical / security: IP address, access and security logs, session IDs, browser / device type, timestamps,
• App / license data: device identifiers used for Footprint / license binding (including HWID or an equivalent hardware fingerprint), plan status (Basic / Pro / trial), activation and license-verification logs via API,
• Mobile / LAN data: when using SmoothWizard Mobile - data needed to discover the PC on the local network, pairing (PIN), optimization control and usage view; phone-PC traffic usually stays on the LAN (not a cloud remote panel),
• Support communications: email / Discord message content (including screenshots and Discord user IDs) when you contact support,
• Content you publish: nick, custom status, profile picture, requests (suggestions and bugs), comments, votes, abuse reports,
• Benchmark results: test results and the hardware and BIOS settings saved with a result - on your computer, and sent to us only when a result goes to the ranking,
• Diagnostic data: Application version and part of the diagnostic log - only when you attach them to a bug report,
• Cookies / local storage: e.g. login session, currency preference, partner code - see Cookies below.

We do not store full payment card numbers in SmoothWizard databases - card vaulting is handled by the payment provider.

4. Purposes and legal bases

Purposes include:

• registration, login, and account maintenance,
• license activation, verification, and abuse prevention (API, Footprint / HWID),
• fulfilling Pro orders and subscriptions (one-shot and auto-renew),
• affiliate program operations (codes, attribution, commission payouts, converting balance to a one-shot checkout discount),
• support and complaints,
• running community features (Friends, Requests), moderating user content and handling abuse reports,
• running the Benchmark and its results ranking and protecting the ranking from abuse,
• newsletter / marketing - where you consent,
• security, abuse prevention, establishing or defending claims,
• legal obligations (accounting, tax).

Bases (GDPR Art. 6):

• (b) contract or pre-contract steps (account, license, order, affiliate),
• (c) legal obligation (e.g. accounting, tax),
• (a) consent (e.g. newsletter, some non-essential cookies),
• (f) legitimate interests (security, license-fraud prevention, service improvement, claims) - balanced against your rights. For (f) you may object (Art. 21 GDPR).

5. Application, Footprint and license API

The SmoothWizard application and license backend may process device identifiers (including HWID / Footprint) in order to:

• bind Pro / trial licenses to a device,
• limit device-limit circumvention and trial abuse,
• verify entitlements on API calls (e.g. login + HWID).

Footprint is for licensing and security, not behavioural marketing profiling. License terms: Application License Agreement. Account, payments, and marketing communications are covered by this policy.

While the Application is running (including in the tray), it sends a lightweight presence signal (heartbeat) to the license API (api-v2.smoothwizard.com) about every 2 minutes - session status, device limits, trial abuse protection, and activity view in your Account on pay.smoothwizard.com. Not used for ad profiling.

5A. Mobile app (SmoothWizard Mobile)

SmoothWizard Mobile (iOS / Android) connects to the PC app on the local network (Wi-Fi / LAN) using a PIN. In that scope we may process among others LAN device identifiers, connection status, control commands (optimization, usage view, shutdown / restart / lock), and the PIN on the PC side. The purpose is remote control of the PC on the same network - not marketing. App stores (Apple / Google) may process data independently as controllers under their own policies.

5B. Friends (beta)

Friends works in the Application and on pay.smoothwizard.com (Account > Friends). Using it is optional - data is created only once you open Friends. We process:

• Friends profile: nick (public), friend code and invite link, an internal identifier, privacy settings. Your login, e-mail and HWID are never shown to other users.
• Relations: invites, friends list, blocks, abuse reports. A report about a user becomes a ticket in our support system (support.smoothwizard.com), where the team handles it.
• Player card (from the Application only, one per PC on the Account): CPU / GPU model, amount of RAM, disk type, refresh rate and number of monitors, FPS results from sessions measured in the Application (average, 1% low, play time, date), Application version and Pro status, and - if you turn it on - selected SmoothWizard settings (no process lists, paths or exclusions). We do not send the list of processes running in the background.
• Custom status: a short text (up to 80 characters) with an expiry you choose (1 hour, 4 hours, 24 hours, 7 days or no limit). Only accepted friends see it. Before it is saved, the text is checked by our server-side filter (profanity, hate speech, scams, links, personal data such as phone numbers, e-mail addresses or account numbers, spam) and then by the OpenAI Moderation API (section 10). A rejected text is not shown to anyone; we keep it in the moderation log. Once the chosen time is up the status is no longer shown.
• Profile picture: you can pick an official avatar from the SmoothWizard gallery (for everyone; these are pictures made by us, we only store the ID of the chosen picture) or - with active Pro - upload your own picture. Your picture (PNG, JPEG or WEBP, up to 600 KB) is decoded on our server and saved anew as a 256 px and 64 px JPEG; this removes metadata, including EXIF and GPS location. The 256 px image alone (no file name, login or identifiers) is then sent to the OpenAI Moderation API, which rates sexual and graphic content. Based on that, the picture is approved automatically, rejected, or queued for manual review by the SmoothWizard team in the moderation panel (support.smoothwizard.com). When automatic rating is unavailable, a person decides on every picture. Until approval, friends see your previous picture or the default avatar. An approved picture is visible to accepted friends, to you (in the Application and in your Account on pay.smoothwizard.com) and to the moderation team. Limit: 3 attempts per day; after 3 rejections uploads are locked for 24 hours.
• Moderation log: on a rejection or a manual decision we record the type of content, the decision and its reason, the automatic score, a hash of the picture, the login, a hash of the IP address and, for a rejected status, its text. The log is used to handle appeals and prevent abuse.
• Presence status: online / in tray / in game and the game process name (only if you allow it). Status lives only in the server cache and expires about 3 minutes after the last activity.
• Shares: the content of a crosshair, settings export or Pro profile you send (exports contain no login, password, HWID or PIN). Content is deleted once the recipient imports or declines it, at the latest after 30 days; the share record itself after 90 days.

What others see: anyone with your code or link sees only your nick. Your player card, presence status, custom status, profile picture and game are visible only to accepted friends and only to the extent you enable under "What friends can see". Finding you by nick is off by default; you can also stop accepting new invites.

Legal basis: Art. 6(1)(b) GDPR (providing a feature you use); handling reports and preventing abuse - Art. 6(1)(f) GDPR (legitimate interest: user safety). We keep the data until you remove it (unfriending, changing settings) or delete the Account - then the profile, custom status, profile picture, cards, relations and shares are deleted, and the note text is wiped from reports you filed. We then also delete your pictures from the moderation panel history and the moderation log about you. Other periods are in section 11. Reports are kept as long as needed to handle them and to prevent abuse.

The feature is in beta - its scope may change; we will describe material changes in processing in this policy.

5C. Requests (suggestions and bugs)

In the Requests window in the Application you can suggest games, apps and features, report bugs, vote, comment, follow requests and get notifications (about comments, team replies and status changes). All Application users can browse; writing, voting and commenting require signing in. Game and app suggestions and votes on them require Pro. We process:

• Content: title, description, category, comments, votes, follows, notifications, the status set by the team,
• Authorship: login (internal only), your Friends nick and your anonymity setting,
• Abuse reports: the reason you chose, an optional note (up to 300 characters), the reporter, the date,
• Moderation log: the rejection reason and an excerpt of the rejected text (up to 600 characters).

What is public. Title, description, comments, vote count, status and date are visible to other Application users. The author is shown as your Friends nick, or - if you have no nick or turn on anonymity - as the first letter followed by asterisks (e.g. "k*****"). Your login, e-mail and HWID are not shown. Do not put personal data in your posts - the filter blocks it but cannot catch everything.

Moderation. Titles, descriptions and comments are checked before publishing by our server-side text filter (profanity, hate speech, scams, links, personal data, spam); this content is not sent to OpenAI. You can report a post or comment. A report becomes a ticket in our support system, and a post reported by several different people is hidden until the team decides. After several reports within an hour we show a captcha, generated by our own server support.smoothwizard.com with no third-party service. The team can hide or delete content, change the status or block the author from posting in Requests. Deleted content disappears from view and stays in the database marked as deleted (by whom and when) for the period in section 11.

Diagnostic log with a bug report. In the "Bug" category the Application offers to attach the Application version and the last part (up to 96 KB) of the sw-v2-probe.log file from the Windows temporary folder. The box is ticked by default - you can untick it before sending. The log describes how the Application started and ran, and any errors; it may include process names, file paths (including your Windows user name), hardware model and system messages. It contains no password or payment data. Only the SmoothWizard team can read it; the author only sees that a log is attached.

Earlier game and app suggestions (the old voting window) and their votes have been moved to Requests. Their authors are shown under the rules above, i.e. without the login.

Legal basis: Art. 6(1)(b) GDPR (a feature you use); moderation, abuse prevention and bug diagnosis - Art. 6(1)(f) GDPR (legitimate interest: user safety and fixing the Application). Retention - section 11.

5D. Local MCP server (beta)

The Application can run a local MCP (Model Context Protocol) server through which an AI client you choose on the same computer (e.g. an AI assistant in a browser or desktop app) reads descriptions of the Application's pages and settings and, after you confirm in the SmoothWizard window, changes settings or runs actions. The server is off by default (Settings > General > Beta options), listens only on this computer (127.0.0.1), requires a token and refuses connections from other addresses. SmoothWizard sends no data to its servers through MCP. The AI client you connect may pass what it receives to its own provider under that provider's terms; it is not our processor.

5E. Components downloaded from third parties

For NVIDIA settings optimization the Application downloads NVIDIA Profile Inspector (open source, by Orbmu2k) directly from GitHub Releases. The list of versions (file URL, SHA-256 checksum, compatible driver range) comes from our API; that request contains no data about you or your computer, and matching to your driver happens locally. The file is installed only if the SHA-256 checksum matches. When downloading, GitHub (GitHub, Inc., USA) receives your IP address and standard connection data as an independent controller, under the GitHub privacy statement. The optional FPS measurement helper (Intel PresentMon) works the same way.

5F. Benchmark and ranking (beta)

The SmoothWizard Benchmark is a separate program you download from the Benchmark tab in the Application. It measures performance (RAM, CPU, 3D graphics, browser) and stability (RAM, CPU and graphics card tests). It changes nothing in the system.

• Download and updates: the Application downloads the benchmark package and its description (manifest) from our server app.smoothwizard.com. The server then sees your IP address and standard connection data (server logs, section 11). The Application checks for a new version at most once every 6 hours, and that request contains no data about you or your computer. Before each test the Application checks the digital signature and the checksums of the benchmark files locally.
• What the benchmark reads on your computer: test results; temperatures, clocks and power during the test; CPU and graphics card model; RAM (capacity, speed, timings and, from the modules, maker, model and memory IC type); motherboard and BIOS version; BIOS settings (e.g. XMP / EXPO, PBO, Curve Optimizer, voltages - some readings need the PawnIO driver) and Windows settings that affect performance (e.g. Resizable BAR, HAGS, Secure Boot, VBS). Stability tests also check the system hardware error log (WHEA) so they can stop when something goes wrong.
• History on your computer: results and the settings saved with them are stored locally, in an encrypted file in the Application data folder (up to the last 50 results). They are not sent to us unless a result goes to the ranking. You can delete them in History or by removing the benchmark.
• Ranking (signed-in users only): only complete, trusted benchmark results go to the ranking; stability test results are never sent. With a result we send: its identifier, the benchmark and test suite version, the scores and measurements (e.g. FPS, memory bandwidth and latency), the CPU and graphics card model and - depending on your privacy settings - the RAM description (including model and IC type), the motherboard and BIOS settings. With the result we store your Account identifier, the date and a hash of your computer identifier (HWID). The hash is used for limits and abuse protection and is never shown to others. Your nick and avatar come from your Friends profile (section 5B).
• Ranking privacy settings: sending results (on by default; you can turn it off or send by hand with the button next to a result) and, separately: nick, avatar, BIOS settings, RAM, motherboard and measurements. Turning an option off hides that data at once in all your results, including ones sent earlier. Without a nick a fixed anonymous name is shown (e.g. "#4F2A") that cannot be traced back to your Account.
• Who sees the ranking: signed-in Application users. They see the best result of each Account and only the data you allow.
• Ranking protection: a result taken with a debugger attached or with modified benchmark files is marked untrusted and does not go to the ranking. The server accepts a result from one Account at most once every 2 minutes and 40 times a day.
• Deletion: you can delete all your results from the ranking at any time in the Benchmark settings.

Legal bases: performance of the contract (GDPR Art. 6(1)(b)) - running the Benchmark and ranking you use, and our legitimate interest (GDPR Art. 6(1)(f)) - protecting the ranking from cheating and abuse.

6. Login via external platforms

You may sign up / sign in via identity providers (including Google, Discord, Steam, Twitch - as enabled at the time). This is also an Art. 14 GDPR case (data from a source other than an email form).

Scope (examples):

• Google: email and basic profile (e.g. name, avatar) per OAuth scopes,
• Discord: user ID, username, email (when shared),
• Twitch: user ID, login / display name, avatar, and verified email (scope user:read:email / OIDC email claim; email field on Helix Get Users),
• Steam: profile identifiers needed to link the account - Steam does not provide an email (sign-in only after account linking).

We use this data for identification, secure login, license linking, and account personalization. We do not sell it. Google API data is used under the Google API Services User Data Policy (including Limited Use). Profile data is not used to train AI/ML models.

7. Payments

Payments are handled by external providers. Card numbers are not stored in SmoothWizard databases - card vaulting is done by the provider (e.g. Stripe). For payments via the operator (Stripe) we process transaction data needed to fulfill the order and accounting. Data for other PSPs - when that gateway is enabled in the Store.

Providers may act as independent controllers or processors under their own terms and privacy policies. Checkout and account: pay.smoothwizard.com; store rules: Store Terms.

8. Affiliate program

If you join the affiliate program, we process partner account data, codes, sale attribution, commission balances, and payout details (e.g. BLIK phone, IBAN). Buyer emails in the partner panel may be masked (buyer privacy). See the Partnership Program Regulations.

9. Cookies and similar technologies

We use cookies / local storage for sessions, security, preferences and - after consent - analytics / ads. Examples actually used (as of the update date):

• session / auth (necessary) - keeping you signed in on pay.smoothwizard.com (Better Auth / session cookies),
• sw_currency - currency preference (up to about 12 months),
• sw_partner_code - partner code for sale attribution (about 30 days) after visiting /r/…,
• sw_club_code - loyalty-club code for /r/ attribution (about 30 days) when the path is a club hash, not a partner code,
• sw_promo_code - promo landing attribution (about 30 days),
• sw_acq - first-touch traffic source (Facebook / TikTok / organic, about 30 days). The attribution cookie may use Domain=.smoothwizard.com; that is not marketing consent,
• sw_ttclid - TikTok Ads click id on Pay (host-only, about 30 days) to attribute a subscription purchase,
• sw_fbclid - Meta Ads click id on Pay (host-only, about 30 days) to attribute a subscription purchase,
• _fbp / _fbc - Meta Pixel browser ids (after marketing consent; host-only) to match Pixel and Conversions API events,
• sw_pay_cookies_ack / sw_pay_marketing - Pay consent choice (about 12 months),
• OAuth / 2FA state cookies (short-lived, necessary for login).

On the marketing site, WordPress / plugin session cookies may run and - when enabled and after CMP consent - analytics (e.g. Google Analytics) or marketing tools (TikTok Pixel: analytics.tiktok.com; Meta Pixel: connect.facebook.net). Necessary cookies may rely on legitimate interest or service necessity; others (analytics / marketing) on consent (CMP / banner).

Consent given on the marketing site applies to that host (consent cookies are host-scoped, without a shared .smoothwizard.com domain). It does not automatically carry over to pay.smoothwizard.com. When TikTok Pixel and/or Meta Pixel is configured on Pay, the Pay cookie banner shows “Necessary only” / “Accept all”. Browser pixel events load only after marketing consent on Pay (TikTok: PageView, ViewContent, InitiateCheckout, CompletePayment; Meta: PageView, ViewContent, InitiateCheckout, Purchase). Pay may also send a purchase event to the TikTok Events API (CompletePayment) and to Meta Conversions API (Purchase) on the first paid Stripe or PayPal subscription, including click ids (ttclid / fbclid, _fbp/_fbc) when stored - only if you gave marketing consent on Pay (sw_pay_marketing cookie). If you choose "Necessary only", Events API / CAPI are not called. The events do not cover subscription renewals or Cashbill / prepaid payments.

You can manage cookies in your browser; blocking some may limit features (e.g. login, remembered currency, partner or ads attribution).

10. Recipients, processors and transfers outside the EEA

Recipients / categories:

• identity providers (Google, Discord, Steam, Twitch - when used),
• payment operators (including Stripe and PayPal; other PSPs when enabled),
• email delivery (e.g. AWS SES),
• hosting / IT infrastructure (including cloud services),
• accounting / advisors - as needed,
• TikTok (Pixel on Pay and on the marketing site after CMP consent; Events API on the first paid Stripe / PayPal subscription, only after Pay marketing consent),
• Meta / Facebook (Meta Pixel on Pay and on the marketing site after CMP consent; Conversions API Purchase on the first paid Stripe / PayPal subscription, only after Pay marketing consent),
• OpenAI (support chat message text, so it can prepare a reply; custom status text and uploaded profile pictures for automated moderation via the Moderation API - without login or identifiers; processor, transfer outside the EEA to the USA; under OpenAI's terms API data is not used to train models and requests may be kept for up to 30 days for abuse monitoring),
• other analytics / cookies tools - when enabled and based on consent or legitimate interest.

Where providers act as processors, we enter into data processing agreements (GDPR Art. 28), unless they act as independent controllers.

Data may be transferred outside the European Economic Area (EEA), in particular to the USA (e.g. Google, Stripe, AWS, TikTok, Meta / Facebook, OpenAI), where an appropriate mechanism applies: an adequacy decision, Standard Contractual Clauses (SCCs), or another GDPR-compliant basis.

11. Retention

We apply among others the following frames (or shorter if the purpose ends earlier):

• user account - for as long as you keep the account; after account deletion we retain selected transactional data and logs (not the full account) until claim limitation periods expire (usually up to about 6 years), unless law requires longer,
• accounting / tax order data - typically 5 years (accounting / tax rules),
• license / Footprint / HWID data - for the life of Pro / trial entitlements and abuse-claim periods,
• security logs - typically 12-24 months (risk / industry practice),
• sw_partner_code - about 30 days,
• sw_currency - up to about 12 months,
• consent-based data (e.g. newsletter) - until consent is withdrawn; withdrawal does not affect prior lawfulness,
• support correspondence - for the life of the ticket and claim limitation periods.
• custom status - until the chosen time is up or you change or remove it,
• profile picture - approved: until you change or remove it or delete the Account, and its copy in the moderation panel history - up to 12 months (after Account deletion - at once); pending: until a decision; rejected automatically - the image is not stored; rejected by the team - the image is deleted right after the decision,
• moderation log (status, pictures, Requests) - 12 months; entries about you are deleted as soon as the Account is deleted,
• Requests and comments - while they are in Requests; content deleted by the author or the team - up to 6 months (time to appeal), then permanently erased; after Account deletion your posts and comments are anonymised (the author is replaced by a random marker, no login or nick), votes remain only as a count, and your follows, notifications and Requests settings are deleted,
• diagnostic log attached to a bug report - up to 12 months from sending, less if the request is deleted, and at once after Account deletion,
• abuse reports in Requests - up to 12 months from the report; after Account deletion reports you filed are anonymised and their notes wiped,
• Benchmark ranking results and ranking privacy settings - until you delete them (in the Benchmark settings) or delete your Account; results history on your computer - until you delete it,
• Account deletion - data from this section that must be deleted or anonymised is removed automatically, usually within minutes of the request being carried out; if a system is unavailable at that moment, the operation is retried until it succeeds.

12. Profiling and automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (GDPR Art. 22). Automatic rules (e.g. license checks, device limits, fraud detection) support security and contract performance - they are not behavioural marketing profiling.

The Benchmark ranking automatically does not accept results marked untrusted (debugger, modified files) or results over the limit. This does not affect your Account, Pro or the result saved in the history on your computer.

Automated content moderation (server-side text filter, OpenAI Moderation API for status and pictures) may block a status, picture, post or comment from being published or send a picture to manual review. This does not affect your Account or Pro. The Application tells you the content was rejected and the general reason. Doubtful pictures are reviewed by a person, and you can ask for any decision to be re-checked at [email protected].

13. Minors

SmoothWizard services (including Pay and the affiliate program) are aimed at adults or lawfully operating businesses. We do not knowingly collect data from children under 16. If you believe a child provided data, email [email protected] - we will delete it unless law requires otherwise.

14. Support (email / Discord)

When you write to [email protected] or on Discord, we process the ticket content, your identifier (email / Discord ID / nick), and attachments (e.g. screenshots). Basis: (b) (contract support) or (f) (handling enquiries). We do not publish your tickets publicly without need.

14A. Whether providing data is required

Providing data needed to create an Account (including email), sign in, and complete payment / Pro licensing is a contractual requirement (Article 13(2)(e) GDPR). Without it we cannot create an Account, sell / activate SmoothWizard Pro, or provide features that require sign-in. Payment details are usually collected directly by the payment operator (e.g. Stripe, PayPal) - without providing them to the operator, payment will not complete.

Marketing cookies and similar technologies rely on your consent - withholding them does not block the Account or purchase, but may limit ad personalisation. Sign-in via external platforms (Google, Discord, Steam, Twitch) is a voluntary alternative to email; without linking an external account those sign-in paths are unavailable.

14B. AI chat and OpenAI

The chat on support.smoothwizard.com, on pay.smoothwizard.com, and in the bubble on smoothwizard.com sends your message text to OpenAI (model gpt-5-nano) so it can prepare a support reply. OpenAI acts as a processor. This is a transfer outside the EEA, to the USA.

The purpose is a support reply. An AI reply can be wrong and is not a legal decision or a decision about your rights. Do not share passwords, 2FA codes, or card data.

We keep the conversation log. The bubble thread stays until a new chat, the browser is closed, or a few hours pass. GDPR contact: [email protected].

The chat may use Google reCAPTCHA to limit bots. Details: Google privacy policy.

15. Your rights

You may request access, rectification, erasure, restriction, portability, and object (including to marketing based on (f)). Where processing is based on consent, you may withdraw it.

To exercise rights, email [email protected]. You may also lodge a complaint with the Polish Data Protection Authority (UODO), Stawki 2, 00-193 Warsaw, uodo.gov.pl.

16. Security

We apply organizational and technical measures appropriate to risk (including HTTPS/TLS, OAuth, password hashing, access controls, admin 2FA).

17. Changes

We may update this policy when law or our services change (including pay.smoothwizard.com and the application). The current version is published on this page with the last-update date.