ThetaSecurity is operated under the corporate framework of CODES LTD. All rights reserved.
What an order stores
When you lock an invoice, the server writes a record with:
- the contact channel you entered, email or phone
- the package, and for a device, the model and storage tier
- the asset you prefer for settlement, and the dollar amount
- an invoice reference, a secret key for the link, and the time
A device or service order does not include an IMEI, an account, or your IP address. A paid IMEI check does include the IMEI, encrypted, until the verdict is stored. The application does not write the network address of the browser into the order.
Payment processing
When CODES LTD has turned on automatic collection, the server asks NOWPayments, a cryptocurrency payment processor, for a payment address for your invoice. NOWPayments receives the invoice reference, the dollar amount, and the asset. It does not receive your contact channel, your configuration, or your IP address from this site. Your wallet talks to the blockchain, not to this site. NOWPayments has its own privacy terms for the transfer it observes. With automatic collection off, no payment processor is involved.
What this site does not do
There is no analytics, no advertising, no tag manager, and no third-party script. Fonts and the invoice QR code are served from this site. The form is not a separate end-to-end encrypted channel. It is a request to the Theta server. Use a contact address you already trust.
The one cookie
Marketing pages do not set a cookie. The order portal, the device check, and the operator sign-in set a single session cookie named THETA. It exists so a form can be checked for cross-site forgery, and so an operator session can stay signed in. It is HttpOnly, SameSite=Strict, and marked Secure when the site is served over HTTPS. It expires when the browser session ends. It is not used to recognize a visitor across later visits, and it is not shared.
A device check
A free check, made with an IMEI and a purchase code, is answered and then discarded. It is not written into an order. A paid IMEI-only check stores the IMEI in encrypted form on that invoice until a verdict is issued, then deletes it. The purchase code is never stored as the code itself. On a provisioned device it is stored only as a keyed hash, so a copy of the registry file does not reveal the code. The public result shows part of the IMEI, not the whole number.
Operator sign-in
Failed sign-in attempts are slowed down. The limiter stores a hash of the network address, not the address, and drops it within the hour. It is not joined to an order. Operator actions are written to a private log without passwords, purchase codes, or full message contents.
If CODES LTD has configured a mail server, a new invoice is sent to the operator address, and a finished IMEI check is sent to the email on that invoice. The invoice link is not included in the mail. Mail credentials are stored encrypted and are not shown back in the operator panel.
Where the record lives
Orders are stored as files on the server CODES LTD operates for this site. They are not sent to a cloud logging product and they are not sold. A web server in front of the application may keep its own connection log. That log is not part of the order record and is not used by this application.
How long
An order is kept long enough to fulfill it and to meet accounting duties that apply to CODES LTD, then deleted. You can ask, on the same contact channel, for the contact detail to be removed once the order is closed. Records we are required to keep for accounting may outlast that request, with the contact reduced as far as the duty allows.
The invoice link
The invoice page is unlisted. Anyone with the full link can read the contact and the configuration, because the link is the key. Treat it as private. It is not published, indexed on purpose, or tied to a profile.
Provisioned devices
A finished device is built without vendor telemetry and without a cloud account joined to the handset. This website never receives a feed from devices in the field. After handover, Theta does not have a live view of the phone.