Privacy notice

What we collect

We only collect what the application process actually needs. There is no advertising, no analytics, no tracking pixels and no profiling of any kind on this site.

From your Discord login

Your Discord user ID, your Discord username and the reference to your avatar image. We ask Discord only for the 'identify' scope. We never see your Discord password, and we do not request your email address.

What you write

The answers you type into the whitelist or staff application form. Please do not put anything in there that you would not want staff to read — only enter what the question asks for.

Staff records about you

Whether your application was approved or declined, the reason a staff member gave, private staff notes attached to your application, and entries in our audit log recording which staff member took which action and when.

Ban and blocklist records

If you are banned or flagged, we store your Discord ID together with the reason and who recorded it.

How the answers were written

When you submit an application your browser tells us, per question, how many characters you pasted, roughly how many you typed, and how long the field was open. We do not record what you typed, only how much. Staff see it as a hint that an answer may be worth reading closely — it is never a decision on its own, and it is deleted with the rest of your application.

Technical data

Your IP address is used to rate-limit logins and submissions so the site cannot be flooded; for that it is held only in the server's memory. When you log in we also keep a one-way fingerprint of it, described under "Linked accounts". Separately, our web server keeps standard access logs that include IP addresses; those rotate daily and are deleted after 14 days.

Linked accounts

To spot one person using several Discord accounts — most often to get around a ban — we keep one-way fingerprints of the IP address you log in from and, when you connect to the game server, of your Rockstar, Steam, FiveM and Xbox identifiers and your PC's hardware tokens. We store a salted SHA-256 hash, never the values themselves: it can tell us two accounts match, not what the address or identifier was. Staff see only which accounts match and how (for example "same PC"); a match is a reason to ask, never an automatic decision.

Your streaming channel (only if you ask us to list it)

If you ask staff to list your Twitch or Kick channel on the Streams page, we store the platform, the channel name and usually your Discord ID. The channel is shown publicly on that page, and while you are connected to the game server it is marked "In the city". Ask staff to remove it at any time.

Why we process it, and our legal basis

Under the GDPR (Regulation (EU) 2016/679) we rely on the following grounds:

Running the application process

Article 6(1)(b) — taking steps at your request before entering into the arrangement that gives you access to the game server, and performing it once you are whitelisted.

Showing your stream

Article 6(1)(a) — your consent, given when you ask us to list your channel. You can withdraw it at any time by asking staff to remove it, and it is deleted straight away.

Keeping the community safe

Article 6(1)(f) — our legitimate interest in reviewing applications, moderating the community, preventing abuse, enforcing bans, spotting the same person behind several accounts, detecting cheating and keeping an audit trail of staff actions. We have weighed this against your interests; the data involved is limited and the alternative is being unable to run a whitelisted server at all.

Legal obligations

Article 6(1)(c) — where we are legally required to retain or disclose something, for example in response to a lawful request from a competent authority.

Who else sees it

We do not sell your data, we do not share it for advertising, and we do not transfer it to anyone beyond the following:

Discord

You sign in through Discord, and our bot sends you a direct message about your application and assigns your role. Discord Inc. is based in the United States, so this involves a transfer outside the EEA under Discord's own terms and safeguards. Note also that avatar pictures are loaded straight from Discord's servers, so Discord can see your IP address when a page displays one.

Our hosting provider

The site and its database run on a rented server. The provider can technically access the machine and acts as our processor.

Twitch and Kick

To show who is live, our server asks Twitch and Kick about the channels listed on the Streams page — only the channel names, nothing about you. On that page, preview pictures and avatars load straight from their servers, so they can see your IP address. Their video player and chat only load after you press play, and from then on their own privacy policies and cookies apply. Both companies are based outside the EEA.

Our staff

Only accounts we have created can read applications, and each staff account only has the permissions it has been granted. Every consequential action is written to an audit log.

How long we keep it

Your application

For as long as it is open, and for as long as you remain whitelisted. You can delete it yourself at any time from your application page, or ask us to.

Linked-account fingerprints

For as long as you have an application with us. Deleting your data deletes them too — unless you are banned, in which case they are kept with the ban for the same reason the ban is.

Your streaming channel

Until you ask us to remove it, delete your data, or staff remove it.

Ban and blocklist records

For as long as the ban stands. A ban we deleted on request would simply be circumvented by re-applying, so we keep these under Article 17(3) even after an erasure request, and tell you when we do.

Audit log

Records of staff actions are kept so that decisions remain accountable and abuse of staff powers can be detected. These are retained under Article 17(3)(e).

Web server access logs

14 days, then automatically deleted.

Your rights

Under the GDPR and the Bulgarian Personal Data Protection Act (Закон за защита на личните данни) you have the right to ask us for a copy of your data, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable form. You will never be treated worse for exercising any of them.

The fastest route for erasure is the 'Delete my data' button on your application page — it removes your application, your answers and any staff notes about you immediately, without needing to ask anyone. For anything else, contact us using the details above and we will answer within one month.

If you think we have handled your data badly, you can complain to the Bulgarian supervisory authority, the Commission for Personal Data Protection (Комисия за защита на личните данни): Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., kzld@cpdp.bg, www.cpdp.bg. You may also complain to the authority in your own EU country of residence.

Cookies and browser storage

We use no advertising or analytics cookies, so there is no consent banner on this site. Everything below is either strictly necessary to sign you in, or something we store only because you clicked a control that asks us to remember your choice.

ul_session

Cookie, 7 days. Keeps you signed in after you log in with Discord. Strictly necessary.

ul_admin_session

Cookie, 12 hours. Keeps a staff member signed in. Strictly necessary.

ul_oauth_state

Cookie, 10 minutes. A one-time value that protects the Discord login against request forgery. Strictly necessary.

ul_login_next

Cookie, 10 minutes. Remembers to bring you back to the department roster after you log in with Discord. Strictly necessary.

Twitch and Kick players

Nothing from Twitch or Kick is loaded into the Streams page until you press play on a stream. Their player and chat may then set their own cookies, under their own policies.

ul_locale

Cookie, 1 year. Remembers whether you chose English or Bulgarian. Only written when you press the language switch.

ul_music_on, ul_music_vol

Browser local storage. Remembers whether you started the background music and how loud you set it. Only written after you press play or move the slider.

ul_last_saying

Browser local storage. Remembers the last message shown on a declined application so you do not see the same one twice. Contains no information about you.

Age

The game this community plays is rated 18+. Please do not apply if you are younger than that.

In Bulgaria the age at which a person can consent to online services on their own is 14. We do not knowingly process the data of anyone below that age without a parent's or guardian's consent; if we discover we have, we delete it.

How we protect it

The site is served only over HTTPS. Staff passwords are stored as bcrypt hashes and never in readable form. Sign-in sessions are signed tokens in cookies that JavaScript cannot read. Staff access is limited by per-account permissions, the staff panel cannot be embedded in another site, and every meaningful action is written to an audit log. Login attempts are rate-limited.

Changes to this notice

If we change how we handle your data we will update this page and the date above. Material changes will be announced in our Discord.