Privacy Policy

• We store what is needed to run accounts, host resources and keep the site safe, and nothing for advertising.
• There are no ads, no third-party analytics and no tracking scripts. The only cookies are for signing in (plus a short-lived one while you set up or use two-factor sign-in) and, for a few minutes while you link it, for connecting Discord.
• Passwords are stored only as Argon2id hashes, two-factor secrets only encrypted and backup codes only as keyed hashes. IP addresses are stored only as keyed hashes, never in readable form.
• Your email address is never shown publicly.
• You can delete your account yourself. Retention and deletion explains exactly what that removes and what stays.

The Vault is run by the operators of this installation (“we”, “us”). The data described here is stored on the servers they run it on. How to reach them is in the contact section.

• Account details: your username, email address and whether it is verified, and your password as an Argon2id hash (the password itself is never stored).
• Profile: the bio, website and avatar you choose to add. Avatars are re-encoded on upload, which strips camera and location metadata.
• Roles and status: your roles (such as Member, Trusted or Moderator), and any suspension or upload restriction a moderator places on the account, with its reason.
• Security records: when the account was created and its password last changed, a count of recent failed sign-ins and wrong two-factor codes, and any lockout or block that follows them.
• Two-factor sign-in, if you turn it on: your authenticator secret, encrypted with a key only the server holds; when you turned it on; the time step of the last code you used, so a code can't be used twice; and your backup codes, stored only as keyed hashes, with which of them have been used.
• Terms acceptance: which version of the Terms of Service and this policy you accepted, and when.
• Discord, if you link it: your Discord user ID, username, display name and avatar reference, and whether you chose to show it on your profile. Linking asks Discord for the identify scope, so no email, server list or messages. If you choose to join the community server while linking, it also asks for guilds.join, which lets the site's bot add you to that one server. The access token is used only during that sign-in, to read your ID and add you to the server if you asked, and is then revoked; it is never stored.

• Resources you upload: titles, descriptions, tags, licence and credits, versions and changelogs; for each file, its original name, size, SHA-256 checksum, detected type, the list of files inside a ZIP and the results of inspection and malware scanning. Screenshots are re-encoded, which strips their metadata. Previews and 3D models generated from your files are cached on the server, and so are the requirements read from their fxmanifest.lua files (frameworks, dependencies, game and escrow) and the results of the script safety check.
• Comments and forum posts, with when they were posted or edited, and whether you posted them anonymously.
• Rewards: the XP you earn and what earned it, your level, and the rewards you hold and show. For download XP the server also checks the downloader's account age, email verification and a scrambled form of the addresses involved, so an account can't farm XP from its own downloads.
• Saved resources (visible only to you) and your notifications.
• Reports you file (what you reported, the reason and any details you add) and reports made about you or your content.
• Moderation records: each decision on a resource with the message sent to its author, internal notes moderators write about it, and reasons for removed comments or posts.
• An audit log of security and moderation events: registration, sign-ins, password and email changes, lockouts, two-factor changes and wrong codes, Discord linking, terms acceptance, uploads and edits, and staff actions. Each entry records who, what and when, and for sign-in and account events a keyed hash of the IP address. Passwords and tokens are never logged.
• Downloads: each counted download records the file, the time, your account if you were signed in, and a keyed hash (HMAC) of your account ID or, when signed out, of your IP address. That hash is only used to count one download per person per file per day and to limit how much download XP one downloader can give an author; the raw IP isn't kept.

Signing in sets a single session cookie containing a random token. It is HttpOnly (page scripts can't read it), limited to this site with SameSite=Lax, sent only over HTTPS in production, and expires after 30 days. The server keeps only a SHA-256 hash of the token, with when the session started and was last used, a keyed hash of your IP address and your browser's user-agent string, so you can recognise your devices under Account → Settings.

Two-factor sign-in uses two more short-lived cookies with the same protections. After a correct password, one holds a random token for up to 10 minutes while you enter your code (the server keeps only its hash). While you set up an authenticator, the other holds the new secret, encrypted, for up to 15 minutes. Both are removed when that step finishes.

Linking Discord sets a cookie for up to 10 minutes, which ties Discord's reply to your account. There are no other cookies, and nothing is stored in your browser to track you.

Your IP address reaches the server with every request. The site uses it in two ways without storing it: keyed hashes as described above, and in-memory counters that limit how often an address or account can sign in, register, upload, comment, post, report or download. Those counters are never written to the database and disappear within minutes to a day, or when the server restarts. The hosting setup in front of the site (for example a reverse proxy) may keep its own access logs; that depends on how the operators run it.

• To run your account: signing in, keeping you signed in, verifying your email and resetting your password.
• To publish what you share, under your username, and to send you notifications on the site about replies, comments and decisions.
• To show what each resource needs to run, read automatically from its manifest.
• To keep the site safe: reviewing uploads, handling reports, limiting abuse, locking accounts under attack and investigating problems.
• To count downloads.

We don't sell your data, show ads, build advertising profiles or share your data with anyone for marketing.

Everyone, including visitors without an account, can see your username, avatar, bio, website, join date and role badge; your published resources and their files; your comments and forum posts; and download counts. If an account is suspended, its profile shows a “Suspended” label (the reason stays private). Your Discord name and avatar appear on your profile only if you switch that on. Your level, XP and the badges, title, name colour and frame you choose to show appear on your profile and next to your posts. Your level, total XP and the XP you earned this month also appear on the public leaderboard, with your avatar, title and name colour; suspended and deleted accounts aren't listed there. Comments and forum posts you make anonymously show as “Anonymous” with a short tag instead of your name.

Staff with the matching permissions can see more: your email address and whether it is verified, your account status and roles, whether two-factor sign-in is on, your linked Discord account, resources that aren't public (pending, rejected or removed), reports, moderation records and the audit log. Moderators can see who wrote an anonymous comment or post, and staff who manage rewards can see your XP history and the rewards you hold.

Outside services, only where the operators have set them up:

• Email: account and security emails go through the mail server the operators configure, so it handles your address and the message. If no mail server is configured, no email is sent at all.
• Discord: linking sends you to Discord to approve it. Where a linked Discord avatar is shown (your Discord settings page, and your profile if you chose to show it), your browser loads the image from Discord's servers.
• Discord server roles: if the operators run the site's Discord bot and you link your account, the bot gives your Discord account roles in the community server for your level, your site roles and whether you have a public resource, and updates them once a day. Discord, and everyone in that server, can see those roles. Members of the server can also look up your level and XP with the bot's /level command. Levels use XP as of the start of the day, as on your profile. Unlinking or deleting your account removes the roles the bot gave you.
• Staff notifications: the operators can have short notices posted to a Discord channel when a resource is submitted (its title and the uploader's username), reported (what was reported and why, but not by whom), or decided on by a moderator (the title, the moderator's username and their message).
• Malware scanning: if a ClamAV scanner is configured, uploaded files are sent to it for scanning. Only the file contents are sent.

The site loads no scripts, fonts or images from other companies apart from the Discord avatars above. We may also disclose information when we believe the law requires it.

Only account and security emails: a verification link when you register or change your email address, and a password-reset link when you ask for one. Verification links expire after 48 hours and reset links after 1 hour; both are stored only as hashes and work once.

If you use two-factor sign-in, you are also emailed when it is turned on or off, when staff reset it, when a backup code is used to sign in, and when wrong codes after your correct password lock or block signing in. Other notifications stay on the site and are not emailed.

• Sessions end when you sign out, after 30 days, or when you change or reset your password, sign out other devices, are suspended, or staff reset your two-factor sign-in. Turning two-factor sign-in on signs out your other sessions.
• Content stays until you or a moderator removes it. Deleting a comment or post hides it everywhere, but its text is kept for moderation records. Withdrawing a resource takes it down, but its record and files are kept for the same reason.
• Moderation records, reports, the audit log and download records have no automatic expiry, so past decisions can be checked. The operators may remove old records.

You can delete your account under Account → Settings by entering your password and typing your username. This:

• replaces your username and email with a placeholder, removes your password hash, and clears your bio, website and avatar;
• deletes your sessions, sign-in links, two-factor secret and backup codes, Discord link, roles, saved resources and notifications;
• takes down all of your resources.

Your comments and forum posts stay visible, shown as from [deleted user] (or a deleted-… placeholder in some lists), so conversations still make sense. Moderation records, reports, audit log entries, download records and the files of taken-down resources are kept, linked only to the anonymised account; the Discord ID you linked and your earlier usernames are removed from the audit log. If you want something specific removed as well, contact us.

Passwords are hashed with Argon2id, session tokens and one-time links are stored only as hashes, IP addresses are hashed with a secret key, and repeated failed sign-ins lock an account temporarily. Changing or resetting your password signs out your other sessions. You can turn on two-factor sign-in with an authenticator app, and staff accounts must use it. No system is perfectly secure, so use a password you don't use anywhere else.

You must be at least 13 to create an account. If you believe someone younger has one, tell us using the contact below and we will delete it.

You can edit your profile, change your email address or password, sign out other devices and delete your account under Account settings, turn two-factor sign-in on or off and make new backup codes under Account → Security, and show, hide or unlink your Discord account under Account → Discord.

Depending on where you live, you may also have legal rights to get a copy of your data, have it corrected or deleted, or object to how it is used. Contact us to make a request.

When this policy or the Terms of Service change, the date at the top is updated and signed-in users are asked to accept the new version before they can upload, comment, post or report again. Browsing and downloading never require it.

For privacy questions and requests, email [email protected].