Data Residency
The app is local-first — almost everything stays on your PC. This page is the honest, per-datastore map of the little that leaves it: what it is, where it physically lives, and how long we keep it.
Almost all product data — optimization backups, Guardian logs, benchmarks, and the DPAPI-encrypted license file — stays in %LOCALAPPDATA%\BRUTAL on your own machine and never leaves it. The table below covers only the data that leaves the device, datastore by datastore. It is the detailed companion to our Privacy Policy and subprocessors list.
| Datastore | What data | Where it physically lives | Retention |
|---|---|---|---|
| Cloudflare KV (license & account) | License records (your email address, plus name/phone where given and a machine-id hash), email-hash and machine indexes, subscription mapping, competition/giveaway entries, transient auth tokens, the Smart Route relay roster and CMS content | Cloudflare's global network — KV is centrally stored and globally edge-cached, with no jurisdiction pinning; the provider is US-headquartered (Cloudflare, Inc.) | License records: life of the account (a paid key keeps a de-identified stub as a lawful financial record after erasure). Transient auth tokens self-expire on a TTL |
| Cloudflare KV (device seats) | Device seats — one record per activated device (license key, platform, name, and a token hash + fingerprint hash), plus reverse-lookup indexes | Cloudflare KV, globally replicated (eventual consistency) | Until the device is revoked or the account is erased; token and fingerprint are stored only as SHA-256 hashes |
Cloudflare D1 (brutal-catalog) |
The support desk — for each conversation, your email address, your name if you gave one, the subject and what was written (including any diagnostics you chose to attach from the app); the retry queue for renewal reminders and payment receipts (the recipient's address and the message); the billing/refund ledger — an email hash plus each payment event Razorpay sends us, which includes the email address and phone number you paid with and the payment method as Razorpay reports it (for example a card's network and last four digits, never the card number); licence-activity and relay-usage counters (a license key with a machine-id hash, or a tunnel key — no email); the crash-report index, the game catalog and service-monitoring records. Also the Smart Route country-check record (license key, country, which app, first and last seen; paid accounts only, see the Privacy Policy) | A single primary location, auto-selected by Cloudflare at creation (no location hint is configured); Cloudflare's network | Support conversations and the mail retry queue: until you ask us to delete them, and deleted with your account. Billing ledger, payment events included: kept as a tax/financial record for as long as the law requires, including after your account is deleted. Crash index: 30 days (daily prune). Licence-activity and relay-usage counters: about 100 days. Country-check record: 90 days after it was last updated, and deleted with the account |
| Cloudflare R2 (downloads & website) | Installers and static site assets — no personal data | Per-bucket region auto-selected at creation; global edge cache | n/a (build artifacts) |
| Cloudflare R2 (crash reports, private) | Raw compressed crash payloads (may contain file paths or local usernames from stack context). The bucket is private and never web-served | Cloudflare; private bucket | 30 days, then deleted by a bucket lifecycle rule |
| Cloudflare Durable Object (relay fleet) | Smart Route relay surge-lifecycle records and a load signal — no PII; provider tokens and instance ids are redacted even from its own operations log | A single Cloudflare colo, auto-placed | Self-pruning lifecycle records; the authoritative roster lives in KV |
| Cloudflare Workers Logs | Structured request logs (IP, user-agent, route) for both Workers | Cloudflare | ~3 days searchable |
| Cloudflare Email Sending | Transactional email content (sign-in codes, keys, renewal reminders) and delivery logs | Cloudflare | Delivery logs per Cloudflare's retention; we keep no separate copy |
| Support inbox (Gmail) | A copy of each message you send us — by email, through the contact form, or with the app's Report a problem button: your email address, your name if you give it, the message and its attachments | Google LLC — USA | Until we delete it — ask and we will, including as part of deleting your account |
| GitHub Actions artifacts (disaster-recovery snapshot) | A weekly full copy of the Cloudflare KV and D1 rows above — license records including plaintext email addresses (and a name or phone number where you gave one), device seats, subscription mappings, giveaway entries, support-desk conversations, the mail retry queue, the billing ledger with the payment events Razorpay sends us, and the country-check record — kept as a private artifact in our private source repository | GitHub, Inc. (Microsoft) — USA | 90 days per copy; data deleted from the stores above stays in an earlier copy until that copy expires |
| Relay VPS fleet (Smart Route data plane) | Transient routed game packets (in memory, never stored); WireGuard peer config (your tunnel public key + tunnel IP); on-box service logs for SSH and agents — no traffic-content logging | Relays in service: 10 locations in 8 countries — India (Chennai, Bangalore, Delhi), Singapore, Japan (Tokyo), Indonesia (Jakarta), Bahrain, Germany (Frankfurt), Brazil (São Paulo) and USA (Dallas). Providers: Akamai/Linode, Vultr, LightNode | Packets: not retained. Peers: removed on revoke. Service logs rotate on-box; relays are rebuilt, not repaired |
| Razorpay | Billing/payment data — card numbers are handled entirely by Razorpay (PCI-DSS) and never reach us. What we keep is the subscription-id ↔ license mapping (in KV, above) and the payment events Razorpay sends us (in D1, above) | India | Per Razorpay's own statutory retention |
| Google Analytics (website only) | Site-usage events + GA cookies — consent-gated: the analytics script is not even loaded until you click Accept | Google LLC — USA | Per the GA4 property's retention setting; nothing is exported into our own stores |
| Google Gemini API (giveaway screening only) | The screenshot you upload to enter the giveaway | Google LLC — USA | Transient (the screening call); our copy follows the giveaway entry's KV lifecycle |
No EU-pinned storage today
Cloudflare offers jurisdiction controls only on some products (for example R2 jurisdictions) and not at all on KV, so we don't claim EU-only storage we don't actually have. The honest statement is the table above: Cloudflare's global network, billing in India, and in the USA consent-gated analytics, our support inbox and the weekly disaster-recovery copy. An EU-scoped storage option remains a roadmap item.
Jurisdictional anchor
The data controller is ARHAS INDIA (OPC) PRIVATE LIMITED (CIN U62013TS2026OPC220112), a One Person Company incorporated in India under the Companies Act 2013, registered office SY No. 4A & 4/AA, Peeramcheru, Golconda, Hyderabad 500008, Telangana, India — the company that operates BRUTAL Optimizer. Our primary regime is India's DPDP Act 2023, with the EU/UK GDPR serviced on the same rails. To exercise a data-access, correction, export or deletion request, email legal@brutaloptimizer.com.
Change discipline
Any new datastore, bucket, provider or relay country lands here in the same change that introduces it, so this page tracks reality rather than lagging it.