Privacy Policy

This policy explains what data Spawnlist collects, why, and the rights you have over it. We keep data collection minimal: we hash IP addresses, run no advertising trackers, and never store your card details. We use Google Analytics only if you allow it — nothing is loaded until you do. See Site analytics and Cookies.

1. Who is responsible

Spawnlist is the data controller for the personal data described here. For any privacy request, contact support@spawnlist.gg.

2. What we collect

Account data

When you register, we store your email, a username and display name, and either a securely hashed password or an identifier from the sign-in provider you choose (Discord, Google or Apple). Authentication runs on our own infrastructure; passwords are never stored in readable form.

Listings you submit

The server details you provide — name, address/IP, port, description, tags, version, region — and any media you upload (banner, icon, screenshots) and announcements.

Reviews & votes

The text and rating of reviews you post. When you vote, we record the game username or Steam ID you provide and a salted hash of your IP address combined with the day — never your raw IP — solely to enforce one vote per player per day and detect fraud.

Listing statistics (for server owners)

We count page views and IP-copies for each listing, deduplicated to one per visitor per day using a salted hash of the IP (not the raw IP). For owners on Premium we also record the referring site's host (e.g. "google.com") — never a full URL or personal identifier. These counters are ours; they stay on our infrastructure and are shown only to the owner of that listing.

Site analytics

Only if you allow it. We ask once, on your first visit. Until you say yes, no analytics script is loaded and your browser never contacts Google at all — declining is a single click and costs you nothing on the site.

If you do allow it, we use Google Analytics 4 to understand how the site is used in aggregate — which pages get visited, roughly where visitors come from, which devices they use. To do that, Google sets first-party cookies in your browser (named _ga and _ga_*) that give your browser a random identifier, and receives your IP address, page URLs, referrer and user-agent. Google anonymises IP addresses for EU traffic before storing them, and we have not enabled Google Signals or advertising personalisation, so this data is not used to build ad profiles or follow you across other sites.

We never send Google your email, username, or anything else that identifies you to us. If you'd rather not be counted, see Cookies below for how to opt out.

Payment data

If you buy featured placement or Premium, payments are processed by Stripe. Stripe handles your card data directly; we only store your Stripe customer and subscription identifiers and a record of the order (plan, amount, date). We never see or store your full card number.

Technical data

Our hosting provider processes connection metadata (including IP address) transiently to deliver the site and protect it from abuse. We use Cloudflare Turnstile to tell humans from bots when you vote.

3. Why we use it (legal bases)

• To provide the Service (accounts, listings, purchases) — performance of a contract.
• Security & anti-fraud (hashed IPs, Turnstile, moderation) — our legitimate interest in a trustworthy, non-manipulated directory.
• Automated moderation of text and images you submit — legitimate interest in keeping content safe and lawful.
• Site analytics — your consent. Analytics does not run until you allow it, and you can withdraw that at any time from the "cookies" link in the footer (see Cookies).
• Legal obligations — e.g. keeping payment/tax records.
• Consent — where we rely on it, you can withdraw it at any time.

4. Who we share it with

We don't sell your data. We use a small set of service providers ("processors"), each only for its stated purpose:

• Cloudflare — hosting, storage (database, media) and bot protection.
• Stripe — payment processing.
• OpenAI — automated moderation of listing text and uploaded images.
• Fly.io — the service that checks whether listed servers are online.
• Google (Google Analytics) — aggregate site-usage measurement.
• An email provider — to send verification and account emails.

We may also disclose data if required by law or to protect our rights, users, or the public.

5. International transfers

Some providers (such as Stripe, OpenAI, Cloudflare and Google) may process data outside the European Economic Area, including in the United States. Where they do, transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision — for US transfers, the EU–US Data Privacy Framework where the provider is certified under it.

6. How long we keep it

We keep account data while your account exists, and listings, reviews and media while they're published. Vote hashes and listing counters are kept only as long as needed for their purpose and then reduced or removed. Google Analytics data is retained for 14 months and then deleted by Google automatically. Payment records are retained as long as required by tax and accounting law. Deleting a listing removes its content and media; deleting your account removes your personal data, except where we must keep some records by law.

7. Cookies & local storage

Strictly necessary. A session cookie keeps you signed in, set by our auth service. Cloudflare Turnstile may set short-lived anti-bot tokens. Your light/dark theme preference is stored in your browser's local storage, not in a cookie. If you vote, the in-game name you typed is also kept in local storage so you don't have to retype it the next day — it stays in your browser and is only sent when you submit a vote.

Analytics — only with your consent. If you allow analytics, Google Analytics sets_ga and _ga_* cookies to tell repeat visits apart. They expire after up to two years and hold a random identifier, not your name or email. If you decline, they are never set and the script is never loaded.

We use no advertising or cross-site tracking cookies. Your choice is remembered in your browser's local storage and you can change it whenever you like from the"cookies" link in the footer — declining later also deletes the analytics cookies already set. Nothing on the site stops working either way: analytics is not needed to browse, vote or manage a listing.

8. Your rights

Under the GDPR you can request to:

• access the data we hold about you;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw any consent you've given.

To exercise any of these, email support@spawnlist.gg. You also have the right to lodge a complaint with your local data-protection authority — in Spain, the Spanish Data Protection Agency, Agencia Española de Protección de Datos(aepd.es).

9. Children

Spawnlist isn't directed at children below the age of digital consent that applies where they live. If you believe a child has given us personal data, contact us and we'll remove it.

10. Changes

We may update this policy; we'll revise the "last updated" date and, for significant changes, give notice.

11. Contact

Privacy questions or requests: support@spawnlist.gg.