Privacy

Your account

Your first sign-in with Discord or GitHub creates an account. For each account you link, it holds your user id at that provider and the user name and profile picture address the provider last reported. Your account also holds its display name, taken from the account you registered with and refreshed when you sign in with it, when it was created and when you last signed in. From Discord the site only asks for the identify scope, so it never sees your email address. GitHub's answer can name the email address you made public on GitHub; the site does not keep it. A GitHub sign-in also keeps GitHub's token for a few hours, as described under GitHub accounts and repositories. Profile pictures are loaded straight from cdn.discordapp.com and avatars.githubusercontent.com, so Discord and GitHub see your IP address whenever your browser shows one.

Cookies this site sets

All of them are needed to run the site. None of them track you, and none are read by anybody else.

Your decision

You can change your decision at any time with the cookie settings button in the bottom left corner.

What we store when you upload a party sheet

The page and the image you upload, as you uploaded them, with the title and visibility you chose and the time of the upload. From the page we also keep its play time, gold, location and the name, level, job and race of each party member, so the gallery can show and search them. A sheet is linked to your account and shown with your display name. Deleting the sheet removes all of it at once. Uploading sets no cookie.

The Party Sheet mod can also upload a sheet straight from the game, without an account. Such a sheet is linked to nobody, shows that it came from the game and is deleted automatically 7 days after the upload; until then only the admins can change or delete it. The address it came from is counted in memory for the upload limits and never stored.

Mod uploads

When you upload a mod we store its files, their SHA-256 hashes, the scan reports, when you uploaded it, that you confirmed you may share it, and your display name as its uploader, which everybody sees. Pictures you add to a mod are decoded and saved anew, which drops their metadata such as camera details or location, and are kept with who added them; everybody who may see the mod sees them. We also count downloads and keep reports other users send about a mod. Removing a version deletes its files, removing a picture deletes the picture. When an admin deletes a mod for good, its versions, files, pictures and reports go with it, and only the audit keeps its name and address.

Every upload and every picture is scanned on our own server with ClamAV, and uploads are also compared with the files of the original game. If the VirusTotal check is enabled, only the files' hashes are sent to VirusTotal, never the files themselves.

GitHub accounts and repositories

Signing in with GitHub, or linking a GitHub account on your profile, stores its numeric user id and its login name. The token GitHub hands out is kept encrypted for at most eight hours, only to check that you may push to a repository you link, and is revoked when you unlink GitHub. While you connect, the cookie mgq.github ties GitHub's answer to your attempt for at most 10 minutes. For a linked repository the site copies its releases, their notes and its README from GitHub; the README's images are fetched through this site, so GitHub does not see your address for them. Unlinking GitHub removes the account; links made with it stay. For the admins' issue mailbox the site copies the issues of the repositories admins watch: their title, text, labels, state, dates and the author's GitHub login name.

Character gallery

The gallery reads the pictures from the game folder you choose inside your browser and uploads nothing. Browsers that can remember the folder keep its handle in the IndexedDB storage of this site, in your browser only, until you press Forget folder.