Privacy Policy

This Privacy Policy explains how G2X Games collects, uses, stores, and protects information when you visit our website, create an account, purchase digital games or software licenses, or use our offline shared-account services.

G2X Games is operated by Zapscal Technologies (Pvt) Ltd. This Policy describes the types of information we collect, how we use and protect that information, when we share it with third parties, how long we retain it, and the rights that may be available to you under applicable data protection laws.

By using G2X Games, you acknowledge that you have read this Privacy Policy. Where applicable, we will obtain your consent for processing activities that require consent under applicable law.

G2X Games is a digital game key and software license marketplace operated by Zapscal Technologies (Pvt) Ltd, a company incorporated in Sri Lanka.

When you register, we collect your name, email address, and email verification status. If you sign in using Google or Discord, we receive information provided by the respective authentication provider, such as your provider account ID, email address, and username.

You may optionally provide or configure additional account information, such as a profile image, preferred display currency, and two-factor authentication (2FA) or passkey settings.

We also determine your approximate registration region when you first log in. This information is associated with your account and used for purposes such as regional pricing and currency localization. Your registration region is not continuously updated based on subsequent connections from different locations.

We collect and store information necessary to authenticate users, maintain secure sessions, and protect accounts. This may include:

• A unique session identifier or token, IP address, browser user-agent string, and session-related information.
• If you use a password, it is stored only as a salted cryptographic hash using an appropriate password-hashing algorithm. We do not store or have access to your plaintext password.
• If you enable two-factor authentication (2FA), we store your TOTP secret and securely encoded backup recovery codes.
• If you register a passkey (FIDO2/WebAuthn), we store the public key, device type, and related credential metadata required to authenticate your passkey. We do not receive or store biometric data used by your device to unlock the passkey.

Session cookies and other authentication cookies are described separately in our Cookie Policy.

For products delivered as offline shared accounts, we enforce a strict one-device activation limit to protect our licenses and help prevent unauthorized access, resale, or credential leakage.

Before revealing shared account credentials or retrieving 2FA login codes, our system may collect technical information about your device and browser to verify authorized devices, prevent unauthorized access, and protect our licenses. This may include device and browser characteristics, graphics and rendering information, hardware characteristics, display characteristics, operating system and browser information, language and regional settings, and other technical signals used for device verification.

The collected technical information is processed by our device verification algorithm and compared with information from your previously registered device to determine whether the current device matches the authorized device.

We log each device verification check, including the verification result and relevant security information, for purposes of fraud prevention, license enforcement, security monitoring, and investigating suspected misuse of our services.

The device verification system also stores a signed device identifier in an HttpOnly, Secure cookie (see our Cookie Policy) on your browser. This cookie is valid for up to 90 days and is used to recognize a previously registered device during subsequent verification requests.

For offline shared accounts that require launcher-side two-factor authentication (2FA), such as Steam Guard, we use an automated system to retrieve short-lived login codes from the shared account's authorized mailbox or authenticator and provide them through our service to complete the authentication process.

As part of operating and securing this feature, our systems automatically process technical and operational information associated with each code retrieval request. We may retain relevant security and operational records associated with these requests for service operation, auditing, fraud prevention, and security purposes.

When you place an order, we collect information necessary to process and fulfill your purchase, such as your order number, email address, name, purchased items, quantities, and pricing in your selected currency.

Depending on your chosen payment method, we may also process:

• PayPal: payment and transaction information provided by PayPal, which may include payment, capture, refund, and transaction identifiers, as well as relevant payment amounts.
• Cryptomus (cryptocurrency): payment invoice, transaction, and payment-status information provided by our cryptocurrency payment provider.
• Direct bank transfer: bank transaction references and payment proof, such as a screenshot or image of your deposit slip, which you provide for manual verification.
• Wallet / store credit: records of your store-credit balance, credits, debits, and related transactions.

We do not directly process or store full payment card numbers. Where card payments are available, payment card information is handled securely by the applicable payment processor.

We store certain files in private object storage, including bank payment proof screenshots, generated PDF invoices, and attachments submitted through support or refund requests.

Private files are not publicly listed or indexed. Access to these files is strictly restricted and, where files need to be accessed through the website, is provided through short-lived secure signed links.

When you contact our support team or submit a refund request, we collect information necessary to handle your request. This may include the category of your inquiry, subject, description, email address, file attachments you provide, and, for refund requests, the reason for the request.

We automatically determine your approximate country from your network connection to support currency localization and, if you arrive through a referral or promotional link, may temporarily store the associated referral or promotional code.

See our Cookie Policy for a full inventory of the cookies and browser storage technologies we use, including optional analytics and advertising identifiers.

Access to mature (18+) titles requires you to confirm your date of birth. This confirmation may be stored locally in your browser to avoid repeated age-verification prompts.

We do not store your date of birth on our servers or in your account.

We use the information described above for purposes including:

• Create, protect, and manage your account, and authenticate your logins;
• Process, fulfill, and deliver your orders, including generating invoices;
• Verify manual bank payments and prevent payment fraud;
• Enforce the license terms of offline shared accounts, including the one-device limit;
• Retrieve automated 2FA codes needed to complete your login to shared platform accounts, such as Steam or Ubisoft;
• Provide customer support and process refund requests;
• Localize pricing and currency based on your region;
• Apply promotional or referral codes;
• Operate, maintain, and improve the security, reliability, and functionality of our platform;
• Where enabled, understand aggregate site usage through analytics and, where applicable, displaying advertising.

Where applicable data protection law requires us to identify a legal basis for processing your information, we rely on the following:

• Performance of a contract: To create and manage your account, process orders, and provide the services you request.
• Legitimate interests: To prevent fraud and unauthorized access, enforce applicable license terms, protect our platform, and maintain and improve our services.
• Consent: For optional analytics or advertising technologies where consent is required by applicable law.
• Legal obligations: To comply with applicable legal, tax, accounting, and regulatory requirements.

We do not sell your personal information to data brokers or advertising networks. We share information with service providers and third parties only where necessary to operate our services, process transactions, provide authentication, maintain security, or fulfill other purposes described in this Privacy Policy.

We may also disclose information when required by law, legal process, or governmental authority; to enforce our Terms of Service; or to protect the rights, property, security, or safety of G2X Games, our users, or others.

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, provide our services, maintain security, resolve disputes, and comply with applicable legal and accounting obligations.

• Payment proof screenshots: Retained for up to 90 days after upload for payment verification and dispute resolution, after which they are permanently deleted.
• Invoices and financial records: Retained for the period required to comply with applicable tax, accounting, and legal obligations.
• Session and authentication data: Retained for as long as necessary to maintain secure account sessions and protect our services.
• Device verification records: Retained for security, license enforcement, fraud prevention, and related operational purposes, generally for the applicable device registration period.
• Account deletion: If you request account deletion, we will permanently delete your account and associated personal information within 30 days, except where we are required or permitted by law to retain certain information.

Some of our service providers operate infrastructure or process information in countries outside your home country, including the United States. Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer is handled in accordance with applicable data protection laws and relies on appropriate safeguards where required.

Information about the location of our own backend infrastructure is not listed in this Policy and may be provided upon legitimate request by contacting [email protected].

Depending on your jurisdiction, you may have rights to access, correct, or request deletion of your personal information, as well as to object to or restrict certain processing.

Account deletion: Self-service account deletion is not currently available through the dashboard. To request deletion, email [email protected] from your registered email address. We will verify your request and permanently delete your account and associated personal information within 30 days, except for information we are legally required to retain, such as statutory tax and accounting records.

To exercise any other applicable privacy rights, contact us at [email protected]. We will handle your request in accordance with applicable law.

G2X Games is not directed at children. Certain mature-rated (18+) content requires users to confirm their date of birth before access. This confirmation is not verified against a government-issued identification document, and we do not store your date of birth on our servers or in your account.

We do not knowingly collect personal information from children under the minimum age permitted by applicable law in their jurisdiction. If you believe that a child has provided us with personal information, please contact us at [email protected].

We implement reasonable technical and organizational safeguards designed to protect your information against unauthorized access, disclosure, alteration, or destruction. These safeguards may include secure password hashing, encrypted or signed authentication and device tokens, HttpOnly and Secure cookie attributes, private object storage with time-limited access links, and verification mechanisms for payment-related requests.

While we take reasonable measures to protect your information, no system or method of transmission over the internet can be guaranteed to be completely secure. Accordingly, we cannot guarantee the absolute security of information transmitted to or stored by our services.

We may update this Privacy Policy from time to time to reflect changes to our services, data processing practices, legal requirements, or other relevant circumstances.

When we make changes, we will update the Effective Date at the top of this Policy. Where required by applicable law, we will provide additional notice or obtain your consent before material changes take effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we handle your information.

If you have any questions, requests, or concerns regarding this Privacy Policy or the handling of your personal information, please contact us:

Email: [email protected]