Data controller
The controller is the publisher named in the legal notice.
Data we process
- Settings, private imports and CUI drafts are saved in your browser. JSON imports are validated in the browser; they are not sent to a C# analysis service. The catalogue stores official public source metadata and reviewed forms, never your private files.
- When you choose synchronisation or saving to your account, the relevant configurations, backups and CUI projects are stored privately and encrypted before storage. SFTP and RCON credentials are also encrypted; stored passwords are not sent back to the browser.
- RCON and PimpMyRust plugin observations may include installed plugins, permissions, groups, Steam IDs, player names and positions, buildings, performance and routine status. The map and these observations may be retained for the selected server’s tools; their content is not sent to analytics.
- Aggregated technical measurements (duration, transferred volume, load and operation outcomes) monitor service performance and limits. They contain no account identifiers, commands or file contents.
- JSON or project exports may include secrets entered by you. You control the downloaded file and its storage.
- For accounts, we retain the email address, a hashed password verifier or linked Google identifier, and sessions needed to sign in. For previously linked Codefling accounts, we retain the member ID and timestamped purchase-verification result; the token used to link is not retained.
- Technical logs may contain minimal details (date, route, status, error), but not complete configurations or secrets.
- After consent, Google Analytics receives tool names, action outcomes and recognised public campaigns. Hub pages use generic paths without server IDs. Files, commands, player identifiers, free-form input and account data are never sent.
Purposes
- Provide and secure the site: performance of the service and legitimate interest in its security.
- Measure visits, traffic sources and tool action outcomes: consent withdrawable through analytics preferences.
- Temporarily retain older data where needed for security, backups and data-subject requests.
Recipients and third parties
Only authorised operators and the hosting provider access necessary technical data. After consent, Google Analytics receives bounded events from public pages and Hub tools; its advertising features remain disabled. Purchases on Codefling follow that third party’s policy.
If you display an externally hosted image in the editor (including a sample image), your browser may contact that host directly to load it. That host may receive your IP address and technical request data. Check the host before previewing a custom URL.
An SFTP/RCON action sends the necessary files or commands to the server you chose. Private configuration, project or server-credential content is not sent to Google Analytics.
Account emails
Resend receives your address and the message needed for signup or password recovery. Each link expires in one hour, works once and is stored as a hash. New email registrations do not store an account or password before confirmation. Google is involved only when you choose Google sign-in.
Retention
- Local drafts remain in the browser until you, the browser or the tool removes them; they are not portable backups.
- The analytics choice expires after 180 days. GA4 user and event data retention is set to two months, without resetting on new activity. This setting does not delete Google's aggregated reports.
- Technical logs are subject to size-limited rotation.
- Older account data and backups are not erased by this release.
- Synchronisation backups are bounded by count, size and age when the service is used. Saved projects, their backups and connections can be deleted from your account. Copies already transferred to your server remain under your control.
Your rights
Depending on applicable law, you may ask the publisher for access, correction, deletion, restriction or portability of your data and object to certain processing. You may complain to the CNIL. Proof of identity is requested only where there is reasonable doubt.
Changes
This policy will evolve with the site. Its update date and material changes will be shown here.