Last updated: on the date this page was published.
This policy explains what personal data we process when you use the website, in accordance with Regulation (EU) 2016/679 (GDPR).
1. Data controller
The data controller is MGT Studios. For any question or request about your data, write to us at contact@mgtstudios.net or through the Contact page.
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, username, email, password (stored only as an irreversible hash) | Creating and managing your account | Performance of a contract (terms of use) |
| Profile picture, bio, favourite games and links you add | Public profile | Performance of a contract |
| IP address, browser type, sign-in date | Account security: active sessions, protection against unauthorised access | Legitimate interest (security) |
| Account activity log (e.g. sign-ins, password changes) | Security and abuse investigation | Legitimate interest (security) |
| Data sent through the contact form | Replying to your request and preparing a quote | Steps taken at your request before entering into a contract |
| Page views and referring websites | Traffic statistics | Legitimate interest; we do not use cookies for statistics and do not keep data that identifies you |
| Discussions, posts, images, PDF presentations and reactions published in the community | Running the community (public content, visible to all visitors) | Performance of a contract |
| Topic subscriptions, notifications and notification preferences | Notifying you of replies and mentions, including by email if you chose so | Performance of a contract; you can turn emails off in settings |
| Published mods: files, screenshots, descriptions, versions, ratings and followed mods | Publishing and distributing mods, review by moderators | Performance of a contract |
| Download counter (an anonymous fingerprint, changed daily, with no plain IP address) | Accurate download counts | Legitimate interest |
| Reports sent and restrictions applied by moderators | Community moderation and enforcement of the rules | Legitimate interest (community safety) and legal obligations regarding illegal content |
Profile pictures are re-processed on upload, and hidden file data (such as GPS location) is removed.
3. Signing in with Discord, Google or Steam
If you choose to sign in with an external account, we receive the account identifier, display name, profile picture and, if available, email address from the provider. We never receive the password of the external account. You can disconnect it at any time from Account settings → Connected accounts.
4. Who we share data with
We do not sell or rent personal data. We share it only with providers that help us operate, to the extent necessary:
- the storage provider for backups kept outside the server (for example Cloudflare R2 or Backblaze B2), if this option is enabled;
- the hosting provider for the website and database;
- Cloudflare (R2 service), if mod files are stored there;
- the email service provider, for messages sent by the website (address confirmation, password reset, notifications);
- Cloudflare (Turnstile service), for protecting forms against bots, if enabled;
- Discord, Google or Steam, only if you choose to sign in with these services;
- YouTube (Google), Twitch or Vimeo, only when you start an embedded video: nothing is loaded from these providers before you click, and the preview image is served from our own website;
- authorities, only when required by law.
Some of these providers may process data outside the European Economic Area, based on the safeguards provided by the GDPR (for example standard contractual clauses).
5. How long we keep data
- Account and profile: until you delete your account. On deletion, account data is permanently removed and activity log entries are no longer linked to you.
- Sign-in sessions: until they expire (at most 30 days) or until you sign out.
- Activity log: 12 months.
- Community posts: for as long as you do not delete them. When you delete your account, discussions and posts remain visible to others but are no longer linked to you (the author appears as “Deleted account”). If you want certain posts removed completely, delete them beforehand or write to us.
- Published mods: for as long as you do not delete or withdraw them. When you delete your account, published mods remain available, unlinked from you; you can ask us to remove them. Uploaded files not used in a version are deleted after 2 days, and download fingerprints after 3 days.
- Read notifications: 6 months. Closed reports and restrictions: 2 years.
- Messages sent through the contact form: at most 3 years.
- Confirmation and reset links: until they expire (between one hour and 7 days).
- Database backups: at most 30 days.
6. Cookies
We use a single, strictly necessary cookie to keep your sign-in session (mgt.sid). We do not use advertising or tracking cookies. Cloudflare Turnstile, when it appears on a form, may use technical data needed to check that you are not a robot. Embedded videos load only after you click them; from that moment the provider (YouTube, Twitch or Vimeo) may use its own cookies, according to its policy. For YouTube we use the privacy-enhanced mode (youtube-nocookie.com).
The full list of cookies and third-party services is in the Cookie policy.
7. Your rights
You have the right to request access to your data, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest.
- You can download a copy of your account data from Account settings → Email, password and data → Download data.
- You can change your data and delete your account directly from the settings.
- For any other request, write to us through the Contact page. We reply within one month.
You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (www.dataprotection.ro).
8. Security
Passwords are stored only as irreversible hashes, the connection to the website is encrypted (HTTPS), and team access to the admin panel is protected by roles, permissions and two-factor authentication.
9. Changes
We may update this policy. The version in force is always the one published on this page, with the date of the last update.