Prospira Tweaks
01Who is responsible for your data
ALEKO Marcin Lewandowski, reachable at one address.
Prospira Tweaks is run by ALEKO Marcin Lewandowski, a sole proprietorship registered in Poland (jednoosobowa działalność gospodarcza), NIP 5581690947, REGON 367203470. Address for correspondence and complaints: ul. Widokowa 1A, 89-333 Osiek nad Notecią, Poland.
The person who runs Prospira Tweaks decides what happens to your data, which under the GDPR makes them the controller. Anyone who helps with support or a session works on their instructions and sees only what that work needs.
Write to contact@prospiratweaks.com about anything on this page and a person reads it. There is no data protection officer, because the operation is not large enough to need one under the GDPR - the same address is the right one for every request in section 07.
02What we hold, and why
No name on your account, and an email address only if you bought something or joined the waitlist.
You sign in with Discord, so what we receive is a Discord id, a username and an avatar. Discord does not give us your email address, and nothing on this website asks for your name or your home address. The rest is worth saying just as plainly: we hold the country you gave when booking, the address you gave Stripe if you paid for something, your email if you joined the waitlist, and your network address in several places. If you use the Prospira Tweaking Utility, section 09 says what the app sends us and what it keeps on your PC. And if you use the Prospira ToolBox, section 10 applies instead - it receives your Windows username, which for most people is a first name.
| What it is | What for | What that means | How long |
|---|---|---|---|
Your Discord account | Account | Who you are, as far as we know it - Discord never gives us your email or your real name. | While your account exists |
Your payment reference | Account | Links your account to Stripe so a purchase can be found again. | While your account exists |
The email you paid with for Champion | Account | The address you gave Stripe when buying a Champion plan, copied to your account so we can find it when you write to us from that address, and so the emails about your plan reach you - including one if a renewal payment does not go through. | While your account exists |
Referrals | Account | Your referral code and link. When someone buys with it: which account referred which, the purchase and its discount, and whether it counted - checked against refunds and against the same PC or payment card on both accounts, so nobody can refer themselves. On the waitlist: your code and how many confirmed sign-ups came from your link. | While your account exists |
The PC details you typed | Booking | What you entered when booking: processor, graphics, memory, monitor, peripherals, the games you play, and the country you are in - the last one so we can offer you the session in your own time zone. | While your account exists |
The email you paid with | Booking | The address you gave Stripe at checkout, copied back to us. For a session: to confirm your booking, remind you to back up before we erase the drive, and write once after the session; that last one is blind-copied to Trustpilot, which is how the review invitation reaches you - section 04 lists them. For Champion: four emails in the first two weeks about the plan you bought - that it is on, how to check Game Mode, the order for BIOS and Advanced, and a reminder before the refund window closes. Three weeks after the purchase, one more asks for a review on Trustpilot; it goes to every buyer who kept the plan, and only once. | While your account exists |
News and offers after a purchase | Marketing | Only if you tick the box after a purchase - on the page, or in the app after buying Champion, where you also confirm you are 16 or over. We keep when and where you agreed, and for the page also the wording and the address and browser you agreed from. We then send news and offers to the address you paid with, each with a link to stop them. | Until you unsubscribe |
Your booking and what you paid | Billing | The package, the amount, the currency, the Stripe references, when it was paid and when it is scheduled. | 5 years (tax law) |
Sign-in records | Security | The address and browser you signed in from, so a stolen account can be spotted. | 90 days |
Your licensed PC | Licence | A one-way fingerprint of the machine your licence is tied to, free tier included. Section 09 says what it is made from; we cannot read any of that back out of it. | While your account exists |
Tweak content you downloaded | Licence | When the app loads its tweak list after you sign in - and, as a Champion, the Advanced tweaks or the BIOS settings list - we note which one you received, when you first and last did, and how many times. Every account's copy is arranged slightly differently - invisibly, the settings are identical - so a copy posted online can be traced to the account it came from. The content itself is not stored with it. | 90 days after the last download |
Bug reports you send | Support | What you wrote in the app's bug report form and, unless you switch "Attach details" off, the app's version, your Windows version and the latest error messages from the app's log on your PC. It also opens a support ticket on our Discord, so Discord holds a copy too. | Until the bug is fixed and shipped |
Your rating of the app | Feedback | The score you gave when the app asked how it is running for you, any comment you added, and the app version. | While your account exists |
Your answer when uninstalling | Feedback | If you use the app's uninstall window: the reason you picked, any comment you added, whether you went ahead or kept the app, whether its changes were turned off and its data deleted, how many of its changes were on, how long it had been installed, and the app version - tied to your account only if you were signed in. | 12 months |
Prospira Points | Account | Your points and every change to them: each daily claim with the day and time zone it was counted in, first steps, and what you redeemed and what it gave you (days of Champion, a voucher or a gift code). Each claim and redemption is checked against the fingerprint of your licensed PC, so one PC cannot collect for several accounts. While a streak of 30 days or more lasts, your Discord account has a role on our server that shows it. | While your account exists; points expire after 12 months without activity |
How the app is used | Usage | Short signals from the app that show where new users get stuck: that it started and how many times, that sign-in and the restore point finished, which starter preset was applied, which setup steps were done, whether the app tour was finished, that the first change was made, that a change was made or undone and whether everything was undone at once, which change failed to apply or to undo, that the app hit an unexpected error (a count here; what it said is in the diagnostics below), that a Game Mode session ended, which locked tab or upgrade screen was opened, that a checkout was started and for which plan and currency, and the app version. Each carries only a random number the app picks once on your PC. It is not your account, your network address or your PC's fingerprint, and nothing you typed is in it. | 13 months |
Diagnostics from the app | Support | Unless you switch "Send diagnostics" off in the app's Settings: the errors and warnings the app writes in its log and the crashes it hits, how turning each tweak on or off went and which ones something else changed back, how the BIOS check, scan, changes and restores went and whether the changes held after a restart - with your motherboard's maker and model, its BIOS version and your processor - the full list of your BIOS settings each time the app reads them, with what each one is set to but never what a text field holds, such as a password - your hardware (the PC's maker and model, processor, graphics card and driver, memory and its speed, motherboard, BIOS and Windows version, no serial numbers) and how often each tab is opened. The app takes your Windows username, computer name, email addresses and anything that looks like a key or a token out of every line before it leaves the PC, and the log file itself is never sent. Errors, tweak and BIOS results and the BIOS settings list are tied to your account if you are signed in; the hardware and the tab counts are not, and carry only the app's random number. | 90 days; totals with nobody in them, such as how often an error happened, stay |
Your acceptance of these terms | Records | Which version of the Terms of Service and of this policy you accepted, that you confirmed the minimum age the terms set at the time, where you accepted - the installer, the app or the checkout - when, and the address and browser it came from. It is how we can show what you agreed to. | While your account exists |
Our audit log | Records | What we did as administrators and to whose account - sometimes including a short excerpt of what you wrote. Next to it, what happened to your account without us: payments, renewals and refunds reported by Stripe, changes you made to your own billing, a PC tied to your account or refused, and a subscription removed once it ended. An entry can include the address the action came from. A copy of each entry, without the address, goes to our Discord (section 04). | Address: 90 days. Payments: 5 years. The rest: 2 years. The copy on Discord: 90 days |
Waitlist sign-up | Waitlist | Your email, only if you joined the waitlist on one of its forms or ticked the box for our emails when asking for the installer link on a phone, plus the exact wording you agreed to and the address and browser you agreed from. Also the language of the page you signed up on, the link that brought you there if there was one, where you heard about us if you answered, and which of our emails have gone out to you. | Until you ask us to delete it |
Where you heard about us | Feedback | Your answer, if you give one: in the app after your first sign-in, together with anything you typed under "Somewhere else" and the app version, or in the optional field when you book a session. A booking also keeps the link that brought you to the site, if there was one. | While your account exists |
Purchases with a creator code | Billing | If you paid with a creator's code: which code, what you paid, the discount and the commission we owe the creator for it. We pay the creator; we do not tell them who you are. | As billing records |
Credit on your account | Billing | What a Check or your referrals left on your account, its currency and until when it is valid, and each purchase it went towards - so it is used once and comes back if that purchase is refunded. | As billing records |
Web server request log | Server | Every request to this website, to the server the app talks to and to our update server: address, browser and the page or file asked for. Written before any code of ours runs, so it happens whatever you answer in the storage panel. | 14 days |
This table is the server side, which you cannot inspect from where you are sitting. What you can do is ask us for a copy of all of it under section 07, and we answer within a month. The browser half is different: section 05 names every key, and you can check those against your own browser in about ten seconds. The last row is not something we chose to keep - it is the web server's own request log, and it is here because a list that skipped the largest store of all would not be worth reading.
03Why we are allowed to hold it
Mostly because you asked us to do something that needs it.
Your account, your bookings, your licence and your referrals are held to perform the contract you entered into - without them there is nothing to deliver. Billing records are kept because the law requires it of anyone selling. Login addresses, your rating, your answer when uninstalling, the anonymous signals from the app and the record of which terms you accepted are held on our legitimate interest in a service that is not trivially abused, that we can fix, and that can show what was agreed - and so are the link you arrived from and where you heard about us, which tell us where to spend our time, and passing your address to Trustpilot after a session so it can ask you for a review, and our one request for a review three weeks after a Champion purchase - you can object to those two, and section 07 says how. The waitlist and its emails, news and offers after a purchase, and analytics, run on your consent; every waitlist email has a one-click unsubscribe link, and consent is the one basis you can take back at any moment, which section 05 shows you how to do. The one email with the installer link that you can ask for on a phone is sent because you asked for it, and we do not keep your address afterwards, unless you also tick the box under that form to get our emails: then your address joins the waitlist on your consent, once you confirm it with the button in that same email.
04Who else sees it
Ten companies, none of them buying anything from us.
We do not sell your data and we do not share it for advertising. These are the only organisations that touch it, and each only gets what its job needs.
| Company | Where | What it does |
|---|---|---|
Discord | Ireland / USA | Signs you in, and is where a support ticket physically lives. Our own alerts also send it the address and browser of every login, and a copy of every entry in our two audit logs (sections 02 and 10). |
Stripe | Ireland / USA | Takes the payment. They hold the card details; we never do. |
Resend | USA | Sends our email: the waitlist confirmation and the emails before and at launch, the messages around a booked session or a Check, the emails about a Champion plan, the installer link if you ask for it on a phone, and news if you agreed to it - for which it keeps your address on our list until you unsubscribe. |
Trustpilot | Denmark | Gets a blind copy of the one email we send after a session, and uses the address on it to invite you to leave a review. Nothing else reaches them, and you are never obliged to answer. |
OVHcloud | Poland | Runs this website and its database. |
Cloudflare | EU / USA | Sits in front of this website and, since 20 October 2026, of our update server, which the app asks for new versions and the installer is downloaded from. It decrypts and re-encrypts that traffic, so it sees what passes through: the address and browser a request comes from and the page or file asked for. For our other addresses - the server the app talks to, the ToolBox and the status page - it only answers the DNS lookup and is not in the path of the traffic. |
TeamViewer | Germany | Carries the remote session itself. Nothing about it is recorded by us. |
Google Analytics | Ireland / USA | Counts which pages are opened, how far they are scrolled and which outbound links are clicked - and only if you allowed it. Advertising features are switched off. |
YouTube (Google) | Ireland / USA | Plays the CMOS reset video in the app's BIOS section - only after you press play, and then it receives your network address like any video you watch. |
Microsoft Clarity | USA | Records the visit as a replayable session: pointer movement, scrolling and clicks - and only if you allowed it. Its advertising side is switched off in two places, so it writes no cookie that would recognise you on another website. |
Where a company is in the United States, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
One row needs its own sentence. Discord receives more than the ticket: an internal alert sends it the address and browser of every sign-in, and once sent we no longer control how long Discord keeps it - so the 90 days in section 06 covers our copy, not that one. The copies of our audit log entries are different: we delete those from Discord ourselves after 90 days. They say what was done and to which account, payments included, and never carry your address - for a machine on the ToolBox side, only the network it connected from.
Until 19 August 2026 this list also carried three address-lookup services, which turned a visitor address into an approximate city for a map only we looked at. That is gone: the map now uses the country our own network provider already reports, so nothing is sent anywhere to place a dot.
05Cookies and what sits in your browser
One cookie keeps you signed in. Everything else is your own settings, and analytics only if you said yes.
One cookie: prospira_session, which keeps you signed in for 30 days. If you allow analytics, Google sets _ga and _ga_145ZTLN2CR, for 400 days each, and Microsoft Clarity sets _clck for a year and _clsk for a day. Everything else this site stores is your own settings and never leaves your browser: your language, your cart, the PC details you typed, an unsent message, and your answer to this question. One exception travels with you when you act: prospira_ref_v1, the name in a link that brought you here, such as a creator code, kept for 60 days and sent along only when you join the waitlist or book a session, so the discount from that creator applies and we can tell which posts are worth our time.
The panel that appears on your first visit says the same in the same words, and lists what each one is for. You can reopen it here and change your answer - that is the whole mechanism, and it works from any page through What we store in the footer.
Nothing in that list follows you to another website, and that is a checked claim rather than a promise. Clarity is capable of writing five further cookies on Microsoft domains, two of which exist to recognise a browser across other sites and to serve advertising. We switch that side off in the code, and the site refuses to load those domains at all, so neither can happen even by accident. Opening this site on 29 August 2026 with analytics allowed produced the four cookies named above and nothing else.
There is no advertising network here, no tracking pixel and no third-party script beyond the ones named in section 04. If you decline analytics, neither Google Analytics nor Clarity is loaded at all, and withdrawing consent afterwards deletes what Clarity had stored.
06How long we keep it
Four rules: a timer (14 days, 90 days, 12 months or 2 years), 5 years for billing records, a trigger, or until somebody deletes it - and the table in section 02 says which one each thing falls under.
On a timer, by a job. Sign-in records after 90 days. Diagnostics from the app after 90 days. Your answer when uninstalling the app after 12 months. The web server log after 14 days. In our audit log, the address in an entry after 90 days, entries about payments after 5 years and the rest after 2 years. On the ToolBox system: the record of an activation after 90 days. The copy of an audit log entry from either system on our Discord after 90 days. Those are mechanisms rather than intentions - you can hold us to them.
On a trigger. Bug reports go once the bug is fixed and shipped. Your account, your licensed device, your rating, the record of what you accepted and the PC details you typed go when the account does. Your waitlist entry goes when you ask. We would rather name the trigger than print a number nothing enforces.
Kept because we must. Billing records - what you bought, what you paid and the Stripe references. Polish tax law requires records of a sale to be retained for five years, and that obligation does not end when you ask us to go away, so an invoice outlives the account it belonged to. It is held for that and nothing else.
Until somebody deletes it. On the ToolBox system: the diagnostic logs and files you send us, remote-support session records, and support tickets. Nothing expires those automatically today.
Ask us to delete your account and everything except the billing record goes with it. Two copies stay beyond our reach whatever we do: the one Stripe keeps, and any sign-in alert already delivered to our Discord.
07What you can ask us to do
See it, correct it, delete it, take it with you, or tell us to stop - by email, free, within a month.
You have the right to access what we hold, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time without that affecting anything done before.
Write to contact@prospiratweaks.com. We answer within one month. There is no charge and no form to fill in - the only thing we may ask is that you prove the account is yours, by sending from the address on file or by messaging from the Discord account itself.
If you think we have handled your data badly, you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), uodo.gov.pl, or to the authority in the EU country you live in.
08Where it is stored
On our own server inside the EU, in Poland.
This website and its database run on a server rented from OVHcloud in Poland. OVH is a French company, which is why you will sometimes see it described as French hosting; the hardware your data sits on is Polish. The server the Tweaking Utility talks to, our update server and the separate system behind the Prospira ToolBox run on that same server.
That is our own server, and we move nothing off it. Several of the companies in section 04 do hold data outside the EU on their own systems - Discord stores your ticket, Stripe stores your payment, Resend sends your mail, Google Analytics counts your visit if you allowed it. Each is named there with the safeguard the transfer relies on. What we can say plainly is what is ours: it stays here.
Deleting your data from our side does not reach those copies. Section 06 says which ones and why.
09The Prospira Tweaking Utility
It talks to us to sign you in, load its content and send diagnostics you can turn off, and to a few other services only when you use the feature that needs them.
The app is a Windows program, so it can reach further into your PC than a website can. This section says what it sends, and to whom.
To us. The rows in section 02 marked Licence, Support, Feedback, Usage and Records come from the app: the fingerprint of your PC, which tweak content it downloaded, bug reports, diagnostics, your rating, your answer when uninstalling it, short anonymous signals about how it is used, and your acceptance of the Terms of Service and this policy. The usage signals carry a random number instead of your account, so they tell us how many people reach each step, not who did what. The app also keeps a log of its own errors on your PC. The file itself is never sent: its errors and warnings reach us as diagnostics, cleaned as section 02 says, unless you switch "Send diagnostics" off in Settings, and its latest lines go inside a bug report you send with "Attach details" on. The fingerprint is worked out on your PC from the install identifier Windows creates, the hardware identifier Windows derives from the motherboard, the processor model and the motherboard maker and model - or, where Windows offers neither identifier, from the computer name and your Windows username. Only the one-way result leaves the PC. The app also asks our update server whether there is a newer version; that request carries your network address and a short code for the release channel your account is on.
Discord Rich Presence is on by default. While the app is open, your Discord profile shows that you are using Prospira: which part of the app you are in, how many optimizations you have on, whether you are on Entry or Champion, and two buttons, to our website and to our Discord server. Anyone who can see your Discord profile sees it. It passes to Discord through the Discord app on your PC, not through us, and you can switch it off in the app's Settings.
Only when you use the feature. The network test measures your connection against Cloudflare's speed test. The list of installed Microsoft Store apps looks their names up in Microsoft's Store catalogue. The browser optimizations, if you apply them, set your browsers to look up web addresses through Cloudflare's secure DNS, so from then on those lookups go to Cloudflare rather than to your internet provider. Links in the app to drivers and tools open their makers' websites in your browser, under their own privacy policies.
On your PC. The app keeps its settings, a record of what it changed so it can undo it, and its backups in C:\ProgramData\Prospira, which only administrators can change. Uninstalling with Also delete Prospira's data ticked removes them; without it, the record of changes stays, so a reinstall can still undo them.
Diagnostics for a ticket. Settings, Support can save a .zip file on your Desktop: the app's log and basic facts about your PC and Windows, with your Windows username masked and without your sign-in or your PC's fingerprint. It stays on your PC and reaches us only if you attach it to a ticket yourself.
10The Prospira ToolBox
A second system, a second database, and different data about the same people.
Everything above describes this website and the Tweaking Utility. The Prospira ToolBox is a separate system with its own database, and it knows you by different things: not a Discord id, but your machine.
When you use the ToolBox we receive your Windows username and computer name, a description of your hardware - processor, motherboard, graphics, memory, BIOS - and a fingerprint derived from it that ties your licence to that one PC. Diagnostic logs you send us carry the same details. If you ask for remote support we record that the session happened, the address it came from, and the output of any script we ran on your machine. Support tickets opened from inside the app include what you wrote plus your licence and hardware identifiers.
The two systems keep separate records and neither queries the other. The one thing that appears in both is the fingerprint of your licensed PC, which is what ties a licence to an account - so the datasets can be matched on that if we ever need to, and you should know it rather than be told they are unconnected. The same person (section 01) is responsible for both, and every right in section 07 covers both equally.
It is held on the same server in Poland as everything else. It is reachable only through accounts we control.
Retention there follows section 06: activation records go on a timer. The ToolBox audit trail - what its operators did, and each activation, runner session, upload or refused request from a machine, with the licence or session it concerned - is kept for as long as the ToolBox runs. Every entry is chained to the one before it, so none can be changed or removed without it showing, and that only holds if none are removed. That is why, since 6 October 2026, it records only the network a machine connected from (the first three parts of its address), never the full address; entries written before then hold the full address. A copy of each entry goes to our Discord with only that network, and we delete it there after 90 days. The rest - logs you send us, files, remote support sessions and tickets - stays until somebody deletes it, and we would rather write that than publish a schedule nothing enforces.
11Children and teenagers
Prospira is for people 13 and over. Under 16, nothing that needs your consent; under 18, a purchase needs a parent's or guardian's consent.
Our Terms of Service set 13 as the minimum age, and the installer and the app ask you to confirm it. Your account is held to perform the contract (section 03), not on your consent. What does run on consent - news and offers by email, and analytics on this website - needs you to be 16 or over, the age Polish law sets for agreeing on your own: if you are younger, leave those boxes unticked. The box for news after a purchase asks you to confirm you are 16 or over. If you believe someone under 13 has an account here, write to contact@prospiratweaks.com and we will delete it and everything attached to it.
12Changes to this policy
The date at the top changes whenever this page does.
If we ever start collecting something genuinely new, or send data somewhere new, we will say so here before it happens rather than after - and the storage panel in the corner will ask you again if the change is one that needs your consent.
When a change matters for the Tweaking Utility, the app shows you the new version and asks you to accept it before you carry on.