What we store

Account data: email address, username, an optional display name, bio and avatar, and a hashed password. Passwords are hashed with bcrypt and never stored in a readable form.

Listing data: everything you enter about a server, plus any artwork you upload.

Activity: the votes, reviews and favourites tied to your account.

Technical data: a salted hash of your IP address, a random device identifier stored in a cookie, and your browser user agent.

Why we store it

Accounts exist so listings have an owner and votes have an identity.

The hashed IP and device identifier exist to enforce vote cooldowns and catch abuse. They cannot be reversed into an IP address, and we do not use them for advertising profiles.

Aggregate counts (views, clicks, votes per day) power the dashboards that server owners use.

Cookies

A session cookie keeps you signed in. It is http-only, so page scripts cannot read it.

A device cookie holds a random identifier used for vote abuse protection.

If the operator has enabled Google Analytics, that service sets its own cookies. IP anonymisation is switched on where it does.

Retention

Monitoring history and analytics events are pruned on a schedule set by the operator.

Deleting a server removes its votes, reviews, screenshots and statistics.

Ask the operator to delete your account and we remove your personal data; listings you owned are unlinked or removed with it.

Sharing

We do not sell personal data.

If a server owner enables vote postback, we send the voter IP and the player id they attached to the vote link to the callback URL that owner configured. We do not store the raw IP ourselves.

Payment processing, email delivery and file storage may be handled by third-party providers configured by the operator. Card details are handled by the payment provider and never reach this application.