Privacy Policy

What we collect

You can browse the site without an account. Everything in this section applies once you sign in.

When you sign in with Google or Discord, we store:

• Your email address.
• Your avatar URL, the profile photo from your Google or Discord account.
• The account ID your provider uses to identify you, so we can recognize you on your next sign-in.
• The sign-in tokens your provider issues, so your login keeps working.

We do not store your real name. Google and Discord send it to us during sign-in, and we discard it. Your display name on the site starts as a randomly generated pseudonym, and it stays that way until you change it.

If you fill out your profile, we store what you wrote: your display name, bio, and website URL. Those are shown publicly on your profile.

We set one cookie: a session cookie that keeps you signed in. It is not used for tracking.

What we do not collect

• We do not record your sessions, your mouse movement, or your keystrokes.
• We do not use advertising trackers or third-party ad cookies.
• We do not currently log IP addresses. We reserve the right to collect and retain IP addresses and related request metadata in the future for security, fraud prevention, abuse mitigation, and legal compliance. If we begin doing so, we will update this policy.

Analytics

We run a self-hosted copy of Umami, a cookieless analytics tool. It counts pageviews and referrers and keeps aggregate numbers on browsers and countries. It does not set cookies, does not build profiles of individual visitors, and does not store IP addresses. It has no heatmap or session replay features at all.

How we use your data

Your account data exists to run your account: signing you in, attributing the items and mods you publish, and showing your public profile. That is the whole list. We do not sell your data, and we do not share it with anyone except the service providers below, who need it to keep the site running.

Who else touches your data

• Google and Discord handle sign-in. What they collect on their own side is governed by their privacy policies, not this one.
• Umami is our analytics tool. We host it ourselves; analytics data does not go to a third-party analytics company.
• Railway hosts the site, the database, and our server logs.
• Cloudflare provides DNS for karsuscodex.com.

Our server logs usually record only the domain of your email address rather than the full address, though a few operations, such as linking a second sign-in provider, log the full address. Those logs are retained by our hosting provider.

Retention and deletion

We keep your account data for as long as your account exists. If you want your account and its data deleted, email us at contact@karsuscodex.com and we will remove it from our live systems. Copies may persist for a limited time in routine database backups before those expire.

Your rights

Wherever you live, we honor the basics: you can ask what we have about you, ask us to correct it, or ask us to delete it. To make any of these requests, email contact@karsuscodex.com. You can also edit your display name, bio, and website yourself from your profile page.

Security

Traffic to the site is encrypted over HTTPS, and your data lives in a managed database with our hosting provider. No online service can honestly promise perfect security, and we will not pretend to. If we learn of a breach affecting your data, we will tell you.

Changes to this policy

If this policy changes, we will update it here and refresh the date at the top. If a change meaningfully affects what we collect or how we use it, we will make that obvious rather than burying it.

Contact

Questions, requests, or complaints about privacy: email contact@karsuscodex.com or see the contact page.