Payments go through Stripe Checkout — a hosted page on checkout.stripe.com. Card numbers never reach our servers; only an opaque session ID and webhook event come our way.
What Stripe sees: card number, IP address, country, card billing email. What we see: session ID, country, amount, paid status. We don't see card numbers, names, or addresses unless the user voluntarily fills them in.
We store transactions tied to UID (your device identifier in HWIDChanger) — but UID is a random 9-digit code that holds no personal information. Even subpoenaed, the link "UID → person" is impossible without your help.
Apple Pay / Google Pay / Link work the same way: tokenised payments that hide the actual card. To us they look identical to a regular card; to the bank — like a virtual one-time card.