Privacy

What we collect

Registering with email: your email address, a password, the callsign you choose, your guild tag and server, and a preferred language.

Registering via Discord: your Discord account ID and display name — nothing else. We request Discord's identify scope only, which means the census never sees your email address, your servers, your friends or your messages. No password exists for these accounts at all.

While you use the site: the time you last signed in, and the census entries you create (for example AFK board entries, which are bound to your account). The web server keeps ordinary access logs (IP address, pages requested) as every website does.

That is the whole list. There is no advertising, no analytics service, no tracking pixels, and nothing is ever sold or shared with anyone.

How it is protected

Email addresses are encrypted at rest — AES-256-GCM with a key that is never stored in the database. Even someone holding a full copy of the database cannot read them. Sign-in lookups use a keyed digest, not the address itself.

Passwords are not stored at all — only a bcrypt hash, which cannot be reversed by anyone, including us. We can check a sign-in attempt; we can never recover or read your password.

Inside the site, addresses are on a need-to-know basis: guild admins never see them; the site operator sees a masked form (s•••@example.com) that must be deliberately revealed per account. Verification and recovery mail is sent through an authenticated relay over TLS.

What it is used for

Your email address is used for exactly three things: verifying that it is yours when you register, resetting your password when you ask, and one notice when your clearance is approved. Nothing else — no newsletters, no announcements, no marketing.

Callsign, guild and server are shown where the census needs them — boards, rosters, the AFK board. Your language preference shapes how pages are presented to you.

Cookies & third parties

Two cookies: a session cookie that keeps you signed in, and — only if you pick a language — a googtrans cookie that drives translation. A display preference (holographic motion) lives in your own browser's storage and never leaves it.

Third parties touch your data only when a feature you chose requires it: Discord (if you register or sign in with Discord), Google Translate (if you translate a page), and the mail relay that delivers verification email. None of them receive anything beyond what that feature needs.

Your controls

You can change your callsign, language and password in the Personal Registry at any time. If you want your account and its data removed, tell guild command — the account is deleted, and with it the encrypted address; denied registration requests are deleted outright. Questions go to guild command in Discord.

The Plan holds — and it does not need your inbox to do it.