Privacy Policy.

What we hold.

We collect the minimum data needed to run the platform. Concretely, that means:

• Account data: your Discord user ID, display name and avatar, made available to us when you sign in via Discord OAuth, plus the email address Discord shares with us. We do not see or store your Discord password.
• Content you submit: spot and tech posts, updates, votes, comments, reports, group memberships and group join requests. These are tied to your account and form part of the public (or group-private) archive.
• Technical data: standard server logs (request paths, response codes, timestamps, IP address) generated by our hosting providers for security, abuse and rate-limiting purposes.
• Anonymous usage data: aggregate page-view and performance metrics from Vercel Analytics and Speed Insights. These do not use cookies and are not linked to your identity.

What it's for.

Your data is used to:

• Authenticate sessions and display your contributions under your handle.
• Maintain the integrity of the archive: ties spots, tech, votes and reports to an accountable identity.
• Enforce visibility on group-private content.
• Prevent abuse: rate-limit user writes, detect spam, block ban evasion.
• Operate the site itself: measure load times, debug errors, plan capacity.

Where it lives.

The database is hosted on Supabase, in the EU (Frankfurt) region. Static assets and serverless functions run on Vercel's edge network. Both are GDPR-compliant processors. Data is encrypted at rest and TLS-encrypted in transit.

User-submitted content (spots, tech, updates, comments) is retained indefinitely as part of the archive, that's the entire point of the platform, and the hard rule that broken/deprecated entries stay under their original ID applies to user data too. If you delete your account, your handle and avatar are removed and your past contributions are reattributed to an anonymised ID.

Who else sees it.

We do not sell data. We share it only in the following circumstances:

• Service providers: Supabase (database, auth, storage), Vercel (hosting, analytics), Discord (OAuth identity provider), Cloudflare R2 (media storage). All operate under their own GDPR-compliant terms.
• Public archive: your handle, avatar and submission timestamps are publicly visible. This is intentional and disclosed at sign-up. Group-private content is only visible to members of that group.
• Legal requirement: if compelled by law, or to prevent imminent harm. We will notify affected users where we are permitted to do so.

Cookies.

We set first-party cookies for authentication only, the session cookie issued by Supabase Auth, plus a small CSRF token.

Discord may set its own cookies during the OAuth flow when you log in. We have no control over those, see Discord's privacy policy.

What you can do.

Under GDPR (and equivalent laws), you have the right to:

• Access a copy of all data we hold about you.
• Correct inaccurate data, most profile fields can be edited directly from your account.
• Delete your account. Personal identifiers are removed; archived contributions are anonymised, not deleted, in keeping with the archive policy disclosed at sign-up.
• Object to processing or request restriction.
• Receive your data in a machine-readable format.

To exercise any of these rights, email us at the address below. We'll respond within 30 days.

Questions.

Privacy queries, data requests and concerns go to: