CodeCraft Support

Privacy Policy

Last updated: 5 August 2026  ·  Operated by CodeCraft Support (Netherlands)

This Privacy Policy explains what personal data CodeCraft Support collects, why we collect it, how long we keep it, and what rights you have under the General Data Protection Regulation (GDPR) and the ePrivacy Directive.

We do not use advertising networks, marketing trackers, or analytics services. We only collect data that is strictly necessary to operate the website securely and fairly.

1 Who we are (data controller)

OrganisationCodeCraft Support
CountryNetherlands (EU)
Websitehttps://codecraft.support
ContactVia our Discord server — use the #support-ticket channel or DM an administrator.

A formal Data Protection Officer (DPO) is not required for this organisation given the scale and nature of the processing activities. Privacy enquiries are handled directly by the site administrators.

2 What data we collect and why

2a. Login & session data

DataPurposeLegal basisRetention
Discord account ID, username, avatar hash Identify you when you are logged in; display your name and avatar Legitimate interest / contract performance Stored in your account record indefinitely (until account deletion is requested)
Email address (if provided by Discord OAuth) Account identification; administrator contact Legitimate interest Account record; can be deleted on request
Discord OAuth access token Verify your identity at login and load Discord guilds you manage for the dashboard. Exists only in your server-side session. Legitimate interest / contract performance Session lifetime (max 30 days)
Guild membership cache (IDs / names of Discord servers where you have Manage Server) Show the server picker in the bot dashboard Legitimate interest / contract performance Short-lived cache in session (refreshed periodically); cleared on logout
Session cookie (codecraft_session) Keeps you logged in between page requests and between visits Strictly necessary (essential functionality) Up to 30 days from your last activity, or until logout
Last login timestamp Account activity record Legitimate interest Updated on each login; kept in account record

2b. Security & duplicate-account detection data

To protect the platform from abuse, ban evasion, spam, and duplicate accounts, we collect technical data when you are logged in. Anonymous visitors are not fingerprinted. This data is used only for security and abuse-prevention purposes.

DataPurposeLegal basisRetention
IP address (HMAC hash + partially masked value, e.g. 1.2.3.xxx) Identify accounts from the same network; detect ban evasion. The full raw IP is not stored. Legitimate interest (fraud/abuse prevention) Maximum 30 days, then deleted or anonymised
Device / browser fingerprint (hashed) Detect the same device across multiple accounts Legitimate interest (fraud/abuse prevention) Maximum 30 days, then deleted
Browser user-agent, screen size, platform, timezone, hardware info Source signals used to generate the fingerprint hash above. Not stored in raw form in the database. Legitimate interest Only the resulting hash is stored; raw values are processed in-browser and discarded
Login timestamp & action type Security audit trail Legitimate interest Maximum 30 days, then deleted
Security and detection data is automatically deleted or anonymised after 30 days by a scheduled daily cleanup job. An exception may apply if data is needed for an active abuse investigation or legal obligation; in that case the data is retained only as long as strictly necessary.

2c. Browser storage

Storage type & keyPurposeDuration
Cookie: codecraft_cookie_consent Remembers that you acknowledged the privacy/cookie notice 30 days
sessionStorage: device_fp Temporary fingerprint hash generated locally while you are logged in; sent to the server for abuse detection Current browser session only — cleared when the tab or window closes

2d. Public comments (Void ideas)

DataPurposeLegal basisRetention
Display name, comment text, IP hash Public discussion on the Void ideas page; IP hash for rate limiting Legitimate interest Maximum 90 days, then deleted by cleanup job

3 Third-party services

ServiceRoleData sharedTheir policy
Discord (discord.com) OAuth2 identity provider; avatar/CDN images; optional guild list for the dashboard Your Discord account ID, username, avatar, email, and (when using the dashboard) guild membership data are returned by Discord after you authorise login. Browser requests for avatar images may send your IP to Discord’s CDN. discord.com/privacy
Cloudflare (cdnjs) Content delivery network used to load Font Awesome icons (CSS + web fonts only) Your IP address is sent to Cloudflare as part of the HTTP request — this is standard for any CDN. We do not share personal data with Cloudflare beyond what is inherent to loading a public resource. cloudflare.com/privacypolicy
Hosting provider (server infrastructure) Stores the website, database, and encrypted/hashed personal data All data processed by this site is hosted on our EU/NL hosting environment under our control Available on request
Void bot API (our own bot backend) Server-to-server calls for dashboard guild settings, reminders, and staff tools Guild/server IDs and related bot configuration — not used for advertising Operated by CodeCraft Support
We do not use Google Analytics, Meta/Facebook Pixel, advertising networks, third-party tracking pixels, or any other optional analytics or marketing services. We do not sell or rent your personal data.

4 Legal bases for processing

Processing activityLegal basis (GDPR Art. 6)
Session cookie and login state Legitimate interest (Art. 6(1)(f)) — necessary to provide the service you requested. Also falls under the ePrivacy "strictly necessary" exemption for which no separate consent is required.
IP address & device fingerprint for abuse / alt-account detection Legitimate interest (Art. 6(1)(f)) — protecting the platform, its users, and the integrity of the community from fraud, ban evasion, and abuse. A Legitimate Interest Assessment (LIA) is available on request.
User account record (ID, username, email) Legitimate interest / contract performance (Art. 6(1)(b)/(f)) — required to provide the authenticated service.
Privacy-request deletion log Legal obligation / legitimate interest (Art. 6(1)(c)/(f)) — accountability under GDPR Art. 5(2).

5 Retention periods

Data categoryRetention period
Login session (server-side)30 days from last activity, or until logout
Session cookie in browserUp to 30 days from last activity, or until logout
IP hash / masked IP & device fingerprint hashesMaximum 30 days — automatically deleted or anonymised by daily cleanup job
Login audit timestamps (anonymised after cleanup)Anonymised after 30 days; row may remain without personal-data fields for aggregate statistics
User account record (Discord ID, username, encrypted email)Until full account removal is requested via Discord support (self-service delete removes security logs only)
Privacy request audit logsMaximum 90 days
Void ideas commentsMaximum 90 days
Cookie consent acknowledgement30 days (browser cookie)
Browser sessionStorage fingerprint (logged-in only)Until tab / window is closed

6 Your rights (EU / EEA residents)

Under GDPR you have the following rights regarding your personal data:

  • Right of access — You may request a copy of the personal data we hold about you.
  • Right to rectification — You may ask us to correct inaccurate data.
  • Right to erasure ("right to be forgotten") — You may request deletion of your personal data. We will delete eligible data; some minimal records may be retained temporarily if required for an active security investigation, legal obligation, or abuse-prevention purpose.
  • Right to restriction — You may ask us to pause processing of your data while a dispute is resolved.
  • Right to data portability — You may request a machine-readable copy of the data you have provided to us.
  • Right to object — You may object to processing based on legitimate interest. We will honour objections unless we can demonstrate compelling legitimate grounds.
  • Right to lodge a complaint — You may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your country of residence.

To exercise any of these rights, contact an administrator via our Discord server. We aim to respond within one calendar month as required by GDPR Art. 12.

7 Manage your privacy data

You can request a copy of eligible personal data linked to your account, or request deletion of eligible personal data, from your Privacy & Data settings page. For security, you must log in with Discord again before sensitive actions are allowed.

Request a copy of my data Delete security & login data
Self-service deletion removes eligible security and login logs (IP hashes, fingerprints). It does not delete your Discord account or your core site account record (Discord ID, username, encrypted email). Request full account removal via our Discord server. Data exports include masked IP addresses only — full raw IPs are not stored.

If you prefer to submit a manual request, you can contact us through our Discord server. We may ask you to verify ownership of your Discord account before providing or deleting data.

We aim to respond to manual privacy requests within one month where manual review is required.

8 Security measures

  • Session cookies are set with HttpOnly, Secure, and SameSite=Lax flags.
  • CSRF tokens protect all state-changing forms.
  • Passwords are not collected — login is handled exclusively via Discord OAuth2.
  • Admin and moderator access is restricted to authorised Discord accounts.
  • Sensitive security data is protected using hashing, masking, and access controls where appropriate. IP addresses are stored as an HMAC-SHA256 hash (for duplicate-account matching) and a partially masked value (e.g. 1.2.3.xxx) — the raw IP is not stored or recoverable. Device fingerprints used for duplicate-account detection are stored only as HMAC hashes. Email addresses are encrypted at rest using AES-256-GCM. Raw plaintext security values are not exposed in admin or user-facing views.
  • IP address data is visible only to administrators and moderators for abuse-prevention purposes.
  • Security logs are automatically deleted after 30 days by a scheduled cleanup job.

9 Data selling and sharing

We do not sell, rent, or otherwise commercially exploit your personal data. We do not share your personal data with third parties except as described in Section 3 (Discord as login provider, Cloudflare as CDN for public assets) and as required by applicable law or a binding court order.

10 Changes to this policy

We may update this policy when we change how we process data. Material changes will cause the cookie/privacy notice to reappear so you are informed. The "Last updated" date at the top of this page always reflects the current version.

Back to home