Privacy Policy

This policy explains what data Spawnlist collects, why, and the rights you have over it. We keep data collection minimal: we hash IP addresses, run no advertising or third-party tracking, and never store your card details.

1. Who is responsible

Spawnlist is the data controller for the personal data described here. For any privacy request, contact support@spawnlist.gg.

2. What we collect

Account data

When you register, we store your email, a username and display name, and either a securely hashed password or an identifier from the sign-in provider you choose (Discord, Google or Apple). Auth is handled by Better Auth on our own infrastructure.

Listings you submit

The server details you provide — name, address/IP, port, description, tags, version, region — and any media you upload (banner, icon, screenshots) and announcements.

Reviews & votes

The text and rating of reviews you post. When you vote, we record the game username or Steam ID you provide and a salted hash of your IP address combined with the day — never your raw IP — solely to enforce one vote per player per day and detect fraud.

Usage analytics (for server owners)

We count page views and IP-copies for each listing, deduplicated to one per visitor per day using a salted hash of the IP (not the raw IP). For owners on Premium we also record the referring site's host (e.g. "google.com") — never a full URL or personal identifier. We use no third-party analytics or advertising trackers.

Payment data

If you buy featured placement or Premium, payments are processed by Stripe. Stripe handles your card data directly; we only store your Stripe customer and subscription identifiers and a record of the order (plan, amount, date). We never see or store your full card number.

Technical data

Our hosting provider processes connection metadata (including IP address) transiently to deliver the site and protect it from abuse. We use Cloudflare Turnstile to tell humans from bots when you vote.

3. Why we use it (legal bases)

• To provide the Service (accounts, listings, purchases) — performance of a contract.
• Security & anti-fraud (hashed IPs, Turnstile, moderation) — our legitimate interest in a trustworthy, non-manipulated directory.
• Automated moderation of text and images you submit — legitimate interest in keeping content safe and lawful.
• Legal obligations — e.g. keeping payment/tax records.
• Consent — where we rely on it, you can withdraw it at any time.

4. Who we share it with

We don't sell your data. We use a small set of service providers ("processors"), each only for its stated purpose:

• Cloudflare — hosting, storage (database, media) and bot protection.
• Stripe — payment processing.
• OpenAI — automated moderation of listing text and uploaded images.
• Fly.io — the service that checks whether listed servers are online.
• An email provider — to send verification and account emails.

We may also disclose data if required by law or to protect our rights, users, or the public.

5. International transfers

Some providers (such as Stripe, OpenAI and Cloudflare) may process data outside the European Economic Area. Where they do, transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

We keep account data while your account exists, and listings, reviews and media while they're published. Vote hashes and analytics counters are kept only as long as needed for their purpose and then reduced or removed. Payment records are retained as long as required by tax and accounting law. Deleting a listing removes its content and media; deleting your account removes your personal data, except where we must keep some records by law.

7. Cookies & local storage

We use a strictly necessary session cookie to keep you signed in, set by our auth service. Cloudflare Turnstile may set short-lived anti-bot tokens. Your light/dark theme preference is stored in your browser's local storage. We use no advertising or cross-site tracking cookies, so there's no consent banner to click through.

8. Your rights

Under the GDPR you can request to:

• access the data we hold about you;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw any consent you've given.

To exercise any of these, email support@spawnlist.gg. You also have the right to lodge a complaint with your local data-protection authority — in Spain, the Agencia Española de Protección de Datos (aepd.es).

9. Children

Spawnlist isn't directed at children below the age of digital consent that applies where they live. If you believe a child has given us personal data, contact us and we'll remove it.

10. Changes

We may update this policy; we'll revise the "last updated" date and, for significant changes, give notice.

11. Contact

Privacy questions or requests: support@spawnlist.gg.