Privacy policy

Who we are

Statmaster is run by Statmaster, the controller of the personal data described here. For anything about your data, use the data request form or write to privacy@statmaster.net.

What we collect

• Public server and resource data from the Cfx.re server list: server names, player counts, the resources servers report, and public information about creators. This is about servers and projects, not about players.
• Your account, if you create one: username, email address, whether you run a server or make resources, which sign-in methods you connected, and when you accepted these policies.
• Connected accounts. If you sign in with Discord or GitHub, we receive your account ID, username, email address and profile picture from them. Sign-in tokens are stored encrypted and used only to sign you in.
• Sessions: the browser and device type you signed in with, so you can see where you're signed in. We don't store IP addresses for accounts; they're used only briefly, in memory, to slow down repeated login attempts.
• Your choices: notification settings and a record of each consent you give or withdraw.
• Creator profile (creator accounts, if you fill it in): your studio name, script tag and names, store, docs, YouTube and Discord links, store image and Tebex public token. It stays private until our team verifies you; to do that, admins see the ID of the Discord account you connected. Once verified, the links, image and script names appear on your public creator page.
• API key (verified creators and approved API access requests, if you create one): a one-way fingerprint of the key (never the key itself), its last four characters, and when it was created and last used. How often a key is used, and from which IP address, is counted only in memory to enforce the rate limits, and is gone within an hour.
• Forms (data requests, abuse reports, API access): what you enter, your contact email, and a one-way hash of your IP address to stop spam.
• Browsing pace: to stop automated copying of the site, we count how quickly pages are requested from your IP address (or account). The count is kept only in memory and is gone within an hour; nothing is written to our database.
• Discord servers (creators): when you connect Discord on your account page, Discord asks whether we may see your servers. If you agree, our admins can see the servers you own or manage (not others you're only a member of), to check a creator profile belongs to the studio. It's read from Discord when an admin looks and isn't stored.

We use Google Analytics only if you agree to it (see Analytics). We don't use advertising cookies, and we don't sell personal data.

Analytics

If you click "Accept analytics" in the cookie banner, we use Google Analytics 4 to understand which pages people use and how they find their way around. Nothing is loaded from Google before you agree, and if you decline nothing is loaded at all.

• What's collected: the pages you view, searches you make on the site, when you sign up or sign in, your browser, device and screen size, roughly where you are (country and city, worked out by Google from your IP address, which Google doesn't store), and how you arrived (for example a search engine or a link).
• If you're signed in: a random-looking code worked out one-way from your account, so your visits from different devices count as one person. It isn't your username, email or account number, and Google can't turn it back into them.
• Not collected: what you type into forms, your email address or other contact details. Google signals and advertising features are switched off, and the admin pages aren't tracked.
• Who processes it: Google Ireland Ltd, as our processor. Data may be transferred to the US under the EU–US Data Privacy Framework. See how Google uses data.
• How long: analytics data is kept for 14 months, then deleted by Google.
• Changing your mind: use "Cookie settings" at the bottom of any page. Declining removes the Google Analytics cookies from your browser and stops all further collection.

Why we use it

Who we share it with

• Our hosting provider, which stores the database. netcup GmbH (DE, AT)
• Our email provider, to send account emails. Google Mail
• Discord or GitHub, only when you choose to sign in with them.
• Google (Google Analytics), only if you accept analytics. See Analytics.
• Cloudflare (Turnstile), only when you're asked to confirm you're human: when browsing very fast, or when sending one of our forms. The check runs in your browser and Cloudflare processes technical data about your browser and connection to tell people from bots. See Cloudflare's Turnstile privacy addendum.

These providers act on our instructions. We don't share your data with anyone else.

How long we keep it

• Your account: until you delete it. Deleting it removes your profile, sign-in methods, sessions, settings and consent records straight away.
• Your creator profile: until you delete your account. That also removes the links and image you published on your creator page; the page itself stays, with the public statistics.
• Your API key: until you revoke or regenerate it, lose your verification or API approval, or delete your account. Revoked keys are kept as fingerprints only, and are deleted with your account.
• Sessions: up to 30 days after you last used them.
• Email confirmation links: until they expire (at most a day).
• Backups: up to 30 days, then overwritten.

Your rights

You can, at any time:

• see and download your data, from your account ("Download my data");
• correct your username and email address in your account;
• delete your account and its data in your account;
• turn notifications off and withdraw consent, which doesn't affect earlier processing;
• object to or ask us to restrict processing, using the data request form;
• complain to your data protection authority.

If you don't have an account and want data about your server or project removed or corrected, use the data request form.

Cookies and local storage

When you're signed in we set one session cookie, plus a short-lived security cookie while you sign in with Discord or GitHub. If you're asked to confirm you're human, we set a cookie for an hour that remembers you passed (it holds only an expiry time and a signature). These are strictly necessary for logging in and for security, so they don't need your consent. Your light or dark theme choice is kept in your browser's local storage and never sent to us.

We also set sm_consent, which remembers whether you accepted or declined analytics, for a year. Only if you accept analytics, Google Analytics sets _ga and _ga_… (up to two years) to recognise returning visits. Declining later deletes them. While you're signed in, your browser also remembers for the current tab only whether you were signed in, so a new sign-in can be counted; this never leaves your browser.

Age

You need to be at least 16 to create an account.

Changes

If we change this policy in a way that matters, we'll update the version above and tell signed-in users. Where the change needs your consent, we'll ask again.