Privacy Policy
Last updated: 29 July 2026
This explains what the Magnificent Bastages website and Discord bot ("the Service") know about you, why, and how to get rid of it. It is written in plain English on purpose. If anything here is unclear, ask — that is a fault in the writing, not in you.
The short version: we collect what the site needs to work, we do not sell any of it, there are no advertising trackers, and you can delete your account yourself at any time.
What we collect
When you sign in
You can sign in three ways, and what we get depends on which you pick.
With Discord — your Discord user ID, username and display name, avatar, the email address on your Discord account, and the list of servers you share with us (used only to check you are in the community).
With an email address and password — your email address and a password *hash*. A hash is a scrambled one-way fingerprint: we can check a password against it, but we cannot read your password back out of it, and neither can anyone who steals the file.
With Google — your Google account identifier and email address.
We never see your Discord or Google password.
If you turn on two-factor authentication, we store the secret your authenticator app needs and a set of one-time backup codes (also hashed).
What you type in
- Display name, bio, pronouns, timezone, birthday
- Theme, motion and layout preferences
- Avatar and banner images you upload
- Contact email, links and notes on creator pages
- Membership application answers, if you apply
- Contact-form messages, ban appeals, suggestions and clip submissions
- Trivia answers, game-vote ballots and event RSVPs
Everything in this list is optional except what a given form asks for.
Accounts you connect
- Steam — if you link Steam, we store your public games list. We use
Steam's official sign-in, so we never see your Steam password, and we only ever receive games you have set to public.
- Twitch — your Twitch username and user ID, if you link it.
- Game servers — the identifier that ties your Discord account to your
character on our game servers, if you link one.
Your games list is private by default. It only appears on your public profile if you switch that on yourself.
What the community features record
Taking part in the community creates records, because that is what makes the scores and history work:
- Bastage Bucks — your balance and a ledger of every change, including
gifts between members (both sides of a gift are recorded)
- Levels and XP — messages counted, and time spent in voice channels,
recorded per day
- Streaks — daily activity and trivia streaks
- RPG progress — character, inventory, skills, spells, pets, quests,
achievements, and combat history
- Badges, titles and ranks you have earned
- Purchases from the in-site store (Bucks only — see below)
We record that you were in a voice channel and for how long. **We do not record audio, and we never listen to voice channels.**
What is collected automatically
- Your IP address, used for rate-limiting, for blocking abuse, and recorded
against privileged actions in the audit log
- A session cookie so you stay signed in
- Audit-log entries when you or a staff member do something significant —
signing in, changing a role, adjusting a balance, revealing a contact email
What we never take payment for
The in-site store and everything called "Bucks" use a made-up currency with no cash value. We do not take card numbers or bank details anywhere on this site. If money is ever involved (tips, subscriptions), it happens on Twitch, PayPal or another platform under that platform's own privacy policy — not here.
Who else sees your data
We do not sell your data, we do not share it with advertisers, and there are no advertising or analytics trackers on the site.
A handful of companies necessarily handle some of it in order for the site to work at all:
| Who | What they see | Why | |---|---|---| | Vultr | Everything, as our host | The server lives on their machine, in Illinois, USA | | Cloudflare | All traffic to the site, including IP addresses | Keeps the site fast and blocks attacks. May set a security cookie. | | Discord | Your Discord account, bot interactions | The community runs there | | Resend | Your email address and the emails we send you | Delivers our email | | Twitch / Steam / Google | Only what you authorise when you link them | Optional connections you choose |
Each of these has its own privacy policy governing what they do with it.
Who can see your data inside the community
- You — everything we hold about you. Download the lot from your dashboard.
- Anyone, signed in or not — your public profile: display name, avatar, bio,
pronouns, badges, titles, rank and level, plus your creator card if you are a creator. Your games list only if you switched that on.
- Moderators — the above, plus moderation history and masked IP addresses in
the audit log.
- Administrators — everything, including contact messages and application
answers. Email addresses in the staff inbox stay hidden until someone clicks to reveal one, and every reveal is written to the audit log.
How long we keep it
- While your account is open — as long as it is open
- After you delete it — anonymised after a 7-day grace period (below)
- Audit log — 12 months, then deleted automatically
- Machine logs (bot heartbeats, server polls) — 14 days
- Uptime checks — 30 days
- Contact messages, appeals and applications — kept until staff delete them,
because they are correspondence addressed to us. Ask and we will redact yours.
Deleting your account
Go to your dashboard and choose Delete Account. It happens in two stages:
1. Seven days' grace. Your account is marked for deletion but nothing is erased yet. Sign in again during this window to cancel it. 2. Anonymisation. Your username becomes a placeholder; your email, avatar, bio, pronouns, timezone and birthday are cleared; linked accounts are dropped; and the account is locked so nobody can reuse it.
Some things survive, and you should know which:
- Audit-log entries, for the remainder of the 12-month window, so that a
security investigation already under way can be finished
- Messages you sent us — contact forms, appeals, applications — because they
are letters addressed to us. Ask and we will redact your name and email.
- Totals and counters that no longer point at you (for example, "how many
people hold this role")
If you want something removed that account deletion does not cover, use the contact form and pick "Support". We will deal with it within 30 days.
Under-13s
The Service is not for children under 13, and we do not knowingly collect their data. If you think we have, tell us and we will delete it.
If you are outside the United States
The server is in Illinois, USA, and Cloudflare's network is worldwide. Using the site means your data is transferred to and processed in the US. If you are in the UK or EU, you still have the right to see your data, correct it, delete it, and take it elsewhere — the export and delete buttons in your dashboard do the first and third immediately, and the contact form covers the rest.
When this changes
If we change something that materially affects you, you will be asked to read and accept the new version before carrying on.
Contact
Questions about any of this? Use the contact form and pick "Support".
_Written by the people who run this community, not by lawyers, and deliberately in plain language rather than legalese. It describes honestly and accurately how the Service actually handles your data. It is not legal advice, and it has not been reviewed by an attorney._