Privacy Policy

This policy explains what personal data Romoslayer collects through this website, why it is collected, who it is shared with, and what you can do about it. It covers this website and the account area on it.

The short version

You can read every public page of this site without signing in and without an account. Nothing is collected for advertising, and there are no analytics or tracking scripts on any page.

If you sign in with Discord, the site stores the profile information Discord provides, the reviews you choose to write, and any plugin entitlements attached to your account. Licences for plugins that need one are also held on Romoslayer’s own licence server, which those plugins contact while they run to confirm the licence. Your data is not sold, and it is not shared with anyone beyond the infrastructure providers that run the site and the licence server.

Who is responsible

This site is operated by Romoslayer, an independent developer of plugins for ARK: Survival Ascended servers. Questions about this policy, or requests concerning your data, can be sent through the contact channels in the Contact section below.

Browsing without an account

No account is needed to read anything on this site, and no cookie is set for visitors who do not sign in.

Like any website, requests reach a web server and are logged by the hosting provider. Those logs are produced and retained by the provider, not by Romoslayer, and typically include an IP address, the page requested, a timestamp and a browser user agent. Romoslayer uses them only to keep the site running and to investigate errors and abuse.

One exception, for abuse protection. So that the sign-in endpoints cannot be flooded with requests, the site counts recent requests against the IP address they came from. That record holds the IP address, which endpoint was called, a count and a timestamp. It is not linked to your account, it is never used to identify or track you, and it is deleted automatically once the counting period has passed.

Download counts. When you use a download link for a free plugin, the site adds one to a running total for that plugin. The record is a single number per plugin per day and nothing else — no address, no identifier, no cookie, and no way to connect one download to another or to you. Plugin files themselves are hosted on GitHub, so following a download link takes you to GitHub, whose own privacy policy then applies.

When you sign in with Discord

Signing in is entirely optional. It exists so that reviews are written by real, identifiable accounts and so that plugin entitlements can be attached to someone.

Authentication happens through Discord. Romoslayer never sees or receives your Discord password. When you authorise the sign-in, Discord provides your profile and email address, and the site stores:

• Your Discord account ID — the permanent numeric identifier for your Discord account. This is the key your account is tied to, which is why renaming yourself on Discord does not affect your access.
• Your Discord username, display name and avatar URL — refreshed each time you sign in, because they change.
• Your email address — as provided by Discord, with whether Discord reports it as verified. It is used to identify your account and to contact you about it if necessary; the verified flag is checked before a free trial can start. Romoslayer does not send marketing email and there is no mailing list.
• Access and refresh tokens issued by Discord — held so the sign-in can be completed and maintained. They are stored on the server and are never exposed to the browser.
• The date your account was created here.

The site requests only the basic identity and email permissions from Discord. It cannot read your messages, see your servers, or act on your behalf.

Sessions

While you are signed in, the site stores a session record containing a session token, the IP address and browser user agent the session was created from, and its expiry. The IP address and user agent are kept so that a session can be recognised and, if needed, investigated for abuse.

Sessions expire 30 days after they are last used. Signing out ends the session.

Reviews you write

If you write a review, the site stores the rating, the text, the plugin it is about, and the times it was created and last edited.

Reviews are public. Your review is displayed with your Discord display name and avatar on the plugin page and on the reviews page, where anyone can read it. Your email address and Discord account ID are never shown publicly.

The site also records how you became eligible to write it — whether you held a paid entitlement, a trial, or reviewed a free plugin — so that the badge shown alongside your review stays accurate. Reviews can be edited or deleted at any time from My reviews in your account.

Reviews may be hidden from public pages if they breach the terms of use. A hidden review is retained rather than erased so the decision stays reversible; you can still delete it yourself.

Plugin entitlements

If a plugin licence is attached to your account, the site stores which plugin it is for, its status, when it was issued, when it expires, any reference used to reconcile it with the transaction that created it, and settings Romoslayer applies to it — such as how many maps may run at once, or whether debug logging is allowed and until when.

Changes made to a licence by an administrator are also recorded — what changed, when, and who did it — as are map places you release yourself. This exists so that questions about your entitlement can be answered from a record rather than from memory.

If you start a free trial, the site records that you did, when, and which version of the trial terms you accepted. That record is kept even after the trial ends or its licence is removed, so each account gets one trial; it is deleted with your account.

No payment processing exists on this site at present. When it does, card and billing details will be handled by the payment provider and not by Romoslayer, and this policy will be updated before that goes live.

Licensed plugins and the licence server

Some of Romoslayer’s plugins need a licence to run — at present, ClusterSync. A licence for one of these licensed plugins is also held on a licence server that Romoslayer runs. It stores the licence key, the licence’s status and expiry, and the settings above. It holds no names, email addresses or Discord details: it is linked to your account on this site only by an internal licence number. Your licence key is kept there, never stored on this website, and shown to you only when you ask for it on your licences page.

While a licensed plugin runs, it contacts the licence server to confirm the licence. Each time, the server receives the licence key, the identifiers the plugin uses to tell your installations apart, and the time of the check-in. For ClusterSync, those identifiers are the ClusterId and map tag set in a map’s configuration and a random install id the plugin creates on its first start. Like any server, it also sees the IP address the request comes from, and that address may appear in the licence server’s operational logs, which are used only to run and troubleshoot it. The licence server does not keep a searchable record of requests. This is used only to confirm the licence and to count how many installations are using it. Each one is listed under your licence — for ClusterSync, each running map, by its ClusterId, map tag and install id — and you can see that list on your licences page.

A licensed plugin’s debug logs, when allowed, are written on your own server. Romoslayer sees them only if you send them, for example when asking for support.

What is not collected

• No analytics, tracking pixels, session recording or advertising. The only thing measured anywhere on this site is the per-plugin download total described above, which counts events rather than people.
• No third-party scripts of any kind on public pages.
• No location data beyond what an IP address implies.
• No payment card details.
• Nothing is sold, rented, or shared with data brokers or advertisers.

This policy covers the website and the licence server. Plugins you install on your own server are separate software running under your control. Licensed plugins contact the licence server as described under Licensed plugins and the licence server; if a plugin ever sends Romoslayer anything beyond what is described there, that will be documented here before it does so.

Cookies

Cookies are used only to keep you signed in. There are no analytics or advertising cookies, which is why the site does not show a cookie banner.

• A session cookie, set when you sign in. It is HTTP-only, meaning scripts in the browser cannot read it, and is transmitted only over HTTPS.
• A short-lived cache of your session, valid for five minutes, which avoids a database lookup on every page you load.

Both are removed when you sign out. Blocking them means you cannot sign in; everything else on the site still works.

Who your data is shared with

Romoslayer does not sell your data or share it for anyone else’s marketing. It is handled by the services that run the site:

• Discord — the identity provider used to sign in. Your use of Discord is governed by Discord’s own privacy policy.
• Vercel — hosting and content delivery. Requests to this site pass through their infrastructure and are logged there.
• Neon — the managed PostgreSQL database where accounts, reviews, sessions, entitlements and the download totals are stored.
• Cloudflare — the network service in front of the licence server. Licensed plugins’ licence checks, and the site’s own licence changes, pass through Cloudflare on their way to it, and the request itself reaches Cloudflare as any connection to a website does.
• GitHub — where plugin files are hosted. Following a download link sends you there; the site passes nothing to them about you, but the request itself reaches them as any visit to a website does.

Romoslayer may also disclose data where legally required to, or where it is necessary to investigate abuse or protect the security of the site.

Where your data is processed

The site is hosted in the United States (US East), and the database is hosted in the same region. The licence server runs on equipment Romoslayer operates in the United States. If you use this site or a licensed plugin from outside the United States, your data is transferred to and processed there.

How long it is kept

• Account data is kept for as long as your account exists.
• Sessions expire 30 days after they were last used.
• Reviews are kept until you delete them, or until they are removed under the terms of use. One exception: if a moderator had hidden your review and you then delete it, its text and rating are removed, but a record that your review of that plugin was hidden is kept, so a new review of it also stays hidden until a moderator looks at it. Deleting your account removes that record too.
• Entitlement records are kept after a licence lapses or is revoked, since they record what was issued.
• Administrative action logs are kept for as long as the account exists. When a licence attached to your account is granted, changed, extended, revoked or deleted, the site records what changed, when, and which administrator did it, and it records map places you release yourself — so that questions about your entitlements can be answered accurately. These entries are not edited or deleted individually.
• Licence-server records are kept for as long as the licence exists, and deleted when the licence or your account is deleted. A map’s entry is removed when it is released, or automatically once the map has stopped checking in for a few hours.
• Licence-server operational logs, which can include the IP address of a game server that contacted it, do not yet have a fixed retention period. This policy will state one once it is set.
• Network logs at Cloudflare, for traffic to the licence server, are retained by Cloudflare under its own retention schedule.
• Abuse-protection counters are short-lived and removed automatically once their counting period has passed.
• Hosting logs are retained by the hosting provider under their own retention schedule.

When an account is deleted, the sessions, reviews and entitlements attached to it are deleted with it, including its licences on the licence server.

Your choices and rights

Depending on where you live, you may have rights over your personal data — including access, correction, deletion, and objecting to certain processing. Regardless of where you live, you can do the following here:

• See what is held. Your account page shows the identity data attached to your account, and My reviews shows everything you have written.
• Correct it. Your name, username and avatar come from Discord and refresh on each sign-in — changing them on Discord updates them here.
• Delete your reviews yourself, at any time.
• Delete your account yourself, using Delete account on your account page. The account and everything attached to it are removed and you are signed out. If you can no longer sign in, ask through the contact channels below instead and Romoslayer will delete it for you — the same data is removed either way.
• Withdraw access. You can revoke this site’s authorisation from your Discord account settings at any time, which prevents future sign-ins.

Security

Authentication is handled by an established authentication library rather than hand-written code. Credentials and tokens are held server-side and are never sent to the browser. Account pages are served only after the session is validated on the server, and are marked so they are never stored in shared caches. Traffic is served over HTTPS. Licence keys are never stored on this website; a key is fetched from the licence server only when its holder asks to see it, and the site’s access to the licence server stays on the server, never in your browser.

No system is perfectly secure. If you find a security problem with this site, please report it through the contact channels below rather than disclosing it publicly.

Children

This site is not directed at children. Discord requires its users to be at least 13 years old, or older where local law sets a higher minimum, and an account here can only be created through Discord. If you believe a child has provided personal data here, get in touch through the contact channels below and it will be removed.

Changes to this policy

If this policy changes, the effective date shown at the top of this page will change with it. Material changes to how data is collected or shared — in particular the introduction of payments — will be reflected here before they take effect.

Contact

For questions about this policy, or to request access to or deletion of your data:

• Discord — the fastest way to reach Romoslayer. Ask in the Romoslayer Discord server.
• Or through the support page.

Requests about your own data — a copy of it, a correction, or deletion of your account — are handled through the same channels. Say what you are asking for and Romoslayer will confirm once it is done.