Privacy policy

This page explains what this website stores about you, why, and what you can do about it. We don’t sell your data, and we don’t use advertising or tracking.

What we store

Your account

• Username, display name, email address, and the bio, website and avatar you add.
• Your password, stored only as a one-way hash (argon2id). We can’t read it.
• Two-factor secrets and backup codes, stored encrypted or hashed.
• Accounts you connect for sign-in (GitHub, Discord): their account ID and username.

When you’re signed in

• For each active session: your IP address, your browser’s user agent, and when you signed in and were last active. This lets you see and end your sessions in Settings → Sessions. A session is removed when you sign out or after 30 days without use.

What you create

• Projects, versions, files, images, descriptions, follows, reports, support tickets, portfolios and resumes, and messages you send to moderators.

Downloads

• To count each download once per day, we store a keyed hash of your IP address, browser and the file. It can’t be turned back into your IP address, and it is deleted the next day. The download totals themselves are anonymous.

Security records

• Important account and staff actions (sign-up, password changes, moderation decisions) are logged with the time and IP address, to protect accounts and investigate abuse.

Store

• Your orders (which cosmetic, amount, payment provider, status) and what’s in your wardrobe. You enter card or PayPal details on Stripe’s or PayPal’s own pages; we never see them.
• If you sell cosmetics: the Stripe or PayPal keys you connect, stored encrypted, and the payment events your provider sends us about your sales.

Emails

• Copies of emails we send you (confirmation links, password resets, notifications from moderators), so staff can check that they arrived.

Cookies

We use one cookie to keep you signed in, and a short-lived cookie during two-factor or GitHub/Discord sign-in. There are no advertising or analytics cookies.

Services we use

• Email delivery: to send confirmation, reset and notification emails.
• Cloudflare Turnstile (when enabled): to stop automated sign-ups.
• GitHub and Discord (only if you choose to sign in with them).
• Stripe and PayPal (only when you buy or sell a paid cosmetic): the payment runs on the creator’s own account, under the provider’s own privacy policy.
• VirusTotal (when enabled): we send the SHA-256 fingerprint of uploaded mod files to check them against antivirus engines. The file itself isn’t sent.

Your choices

• Change or remove your profile details at any time in Settings.
• Delete your account in Settings → Account. This removes your account, profile, follows, sessions and portfolios. Projects must be transferred or deleted first.
• To get a copy of your data, or for any other privacy question, open a support ticket.

Changes

If this policy changes in an important way, we’ll show a notice on the website.