Privacy

This page describes exactly what the site stores. It is short because the site collects very little: there is no advertising network, no third-party analytics and no tracking pixel anywhere on it.

What is stored

• Your email address, because it is how you sign in and how we reach you about a listing.
• A display name, shown next to your reviews.
• Your Discord user id and avatar URL, if you signed in with Discord. We never receive your Discord password and we do not read your messages or servers.
• A SHA-256 hash of your session token. The token itself lives only in a cookie in your browser, so a copy of our database cannot be replayed as a login. Magic-link login tokens are stored the same way.
• A salted HMAC of your IP address against each vote, which is what stops the same person voting for a server twice in one day. It is a one-way hash keyed with a server-side secret, so it cannot be turned back into an address.
• Your IP address in raw form on active login sessions and on unused login links, kept so that a compromised account can be investigated. It goes when the session or link does.
• What you submit: server listings, reviews, reports, contact messages, and the times they were created.

What is not stored

• No passwords. There are none to steal, because sign-in is by emailed link or Discord.
• No advertising or analytics cookies. The only cookies set are the session cookie and the CSRF token, both first-party and both necessary for the site to work.
• No payment details. Nothing on the public site takes a payment.
• Nothing is sold, rented or handed to data brokers.

Cloudflare

Cloudflare sits in front of this site, terminates the TLS connection and filters abusive traffic. That means your request reaches Cloudflare before it reaches us, and Cloudflare sees the connection metadata that any network operator would: your IP address, the URL and your browser's user agent. Their handling of it falls under Cloudflare's own privacy policy.

How long it is kept

• Login links expire after 15 minutes and are deleted shortly after use.
• Sessions expire after 30 days, and expired rows are deleted by a nightly job.
• Server ping history is pruned to the last 30 days.
• Votes are kept as hashes for as long as the server is listed, because the monthly ranking is computed from them.
• Account data, listings and reviews are kept until you ask us to remove them.

Deleting your data

Email [email protected] from the address on the account, or send the same request through the contact form while signed in. Say whether you want the whole account gone or only your reviews. We action it within 30 days and confirm by email when it is done.

Deleting an account removes the email address, display name, Discord id and sessions. Server listings you own become unowned rather than disappearing, so that players who use them are not left with a dead entry; ask and we will delete those too.