Privacy Disclosure & Data Policy

At Rovaflow, we adhere to a strict protocol of operational isolation. Because our software facilitates local physical device orchestration and SMM task execution directly on your physical hardware, we ensure that your workstation environments remain entirely yours.

Unlike standard desktop emulators or third-party cloud managers, our binary runs locally and enforces a complete zero-exposure rule on user file storage:

• No Content Audits: Rovaflow does not scan, index, read, or upload any personal files, documents, browser histories, or local media directories located on your host PC or server.
• Strict Process Isolation: The software execution is bound strictly to the designated execution sandbox and targeted ADB/USB communication ports, leaving other background operating system processes entirely unmonitored.
• Zero Cloud Mirroring: All configurations, workflows, and task parameters remain stored in your local encrypted system cache and are never transmitted to our remote databases.

To preserve licensing server integrity and enforce concurrent execution thresholds (slots) under your active subscription plan, the Rovaflow native binary performs a localized validation query when establishing a connection to the sync relay.

This process harvests non-identifying hardware variables to generate a localized Hardware Identifier (HWID) signature:

• HWID Elements: The software reads your CPU manufacturer string, physical core count, system RAM capacity, motherboard serial number, and primary storage drive volume identifiers.
• One-Way Cryptographic Salting: These individual values are immediately passed through a local one-way SHA-256 hash algorithm combined with a private salt. The resulting 64-character alphanumeric signature is the only value sent to our database.
• Anti-Seat-Sharing Verification: The signature is checked against your active license key to confirm the instance matches your assigned slot limit. No raw hardware identifiers or readable serial numbers are ever stored in the cloud.
• Connection IP Logs: The license server logs current public IPv4/IPv6 addresses strictly to match geo-allocation blocks and prevent concurrent usage leaks across geographically disparate connections on a single key.

Access to the self-service customer portal (for downloading updates, generating client keys, or submitting support tickets) requires registration. We protect this identity gateway with industry-grade defensive protocols:

• One-Way Password Salting: All customer passwords are encrypted in flight and hashed inside the SQLite relational database using the modern, high-intensity **bcrypt** algorithm with a cost factor of 11. Your cleartext password is never visible to administrative or support personnel.
• Secure Session Isolation: Portal authentications set uniquely generated token identifiers tied directly to local session memory arrays on our hosting environment. These are bound using standard HttpOnly, SameSite=Lax, and SSL-Secured cookies to prevent cross-site scripting (XSS) or session hijacking.
• Referral Fraud Shielding: Referral linkages utilize non-personally identifiable cookie hashes to credit affiliates, coupled with anti-self-referral validation variables to block duplicate sign-up exploits.

When purchasing subscription keys for Rovaflow, we maintain high compliance structures regarding financial transactions. To ensure absolute financial privacy, our core servers do not collect, process, or store financial credentials:

• No Card Storage: We do not log raw credit card digits, cardholder names, CVVs, or expiration dates on our local databases.
• Gateway-Only Routing: Payment requests are securely routed via payment networks (Stripe, PayPal, or cryptographic merchants) using secure TLS 1.3 protocol channels.
• Stored References: Our databases log strictly the purchase reference identifiers, currency codes, payment quantities, and subscription status flags required to trigger instant key delivery.

We provide full control mechanisms inside your customer dashboard to manage your stored records. You have absolute transparency and control over your license key telemetry:

• HWID Clearing: You may wipe and reset all bound SHA-256 HWID associations directly from your licensing dashboard at any time to reassign software executions to a new host machine.
• Account Purges: You have the right to request a complete deletion of your customer profile. Upon manual validation, all associated email hashes, license logs, and affiliate references will be permanently scrubbed from our SQLite relational databases.
• Co-Engineered Security Audits: In tandem with our infrastructure engineers at Xpert Mania, our servers undergo continuous threat reviews to verify zero leakage across API structures, keeping your digital footprint protected.