YOUR SAVE DATA
What we store about you, why, who else sees it, how long we keep it, and how to get it back or deleted. We collect as little as we can to run your club.
Last updated: [DATE]
Who's responsible
SYNA1, CVR 36680113, [ADDRESS], Denmark is the data controller for radclub.gg. Questions or requests about your data: support@radclub.gg.
What we store
Only what Radclub needs to work:
- Your account: a display name, your email address if you give one (and when you confirmed it), and, if you use Discord, your Discord user id, username and avatar.
- Game names, if you add them: your Minecraft (Java) username and your SteamID64, so your club's worlds can let you in.
- Clubs: the club's name and look, its worlds and their settings, mods and plugins, who's a member and with which role, and invite links (who made them and when they expire).
- Money: the fund log (who chipped in, how much, when, and Stripe's reference for the payment) and your monthly chip-ins. Card details are handled by Stripe and never reach us.
- Discord connection, if your club connects a server: the server's id and name, the channel Radbot posts in, and the club role.
- Radbot and game nights: the game nights your club plans (world, day, time and time zone), which Radbot features your club has switched on, your answers to Radbot's "Who's in?" and game-night buttons in Discord (I'm in, in 20 minutes, not tonight), and when a world was awake, for the session recap Radbot posts. Radbot posts display names only, never email addresses.
- Waitlist: your email address and when you joined, if you signed up before launch.
- Sign-in links: the address a link was sent to, when it expires, and a scrambled (hashed) copy of the link and of your browser's sign-in cookie. We never store the link itself.
- Technical data: your IP address, used briefly to stop abuse (rate limits) and not saved in our database, plus error logs and performance traces. Our logs never contain email addresses, sign-in tokens or payment details.
What your club can see
Other members of your club can see your display name, your role and your chip-ins in the fund log. Owners and admins can see your game names on the worlds' whitelists. If the club connected Discord, the club's Discord server shows who has the club role. People outside your club see none of this.
Why we use it
- To run Radclub for you: your account, your clubs, payments and the game servers. (Legal basis: our contract with you, GDPR art. 6(1)(b).)
- To keep the books: payment records are kept because Danish bookkeeping law requires it. (Legal obligation, art. 6(1)(c).)
- To keep Radclub safe and working: preventing abuse, rate limits, fixing bugs. (Our legitimate interest in a secure service, art. 6(1)(f).)
- To email you about the launch, if you joined the waitlist. (Your consent, art. 6(1)(a), which you can withdraw at any time.)
We don't sell your data, we don't show ads, and we don't use your data to profile you.
Who helps us
These companies process data for us, only to provide their part of Radclub:
- DigitalOcean hosts our website and database, on servers in [DATA CENTRE LOCATION, e.g. Frankfurt, Germany].
- Stripe handles payments and receipts. Stripe also has its own duties as a payment provider; see stripe.com/privacy.
- Resend sends our emails: sign-in links and waitlist news.
- Discord, if you sign in with Discord or your club connects Radbot: we receive your Discord id, username and avatar, and we give and take the club role and post messages in the club's server.
- [GAMECLUB OPERATOR] runs the game servers. We send your game names (for whitelists) and an internal account number (to record who changed what), never your email. Servers are located in [GAME SERVER LOCATION].
- Modrinth provides the mod and plugin catalogue. Our server searches it without any personal data, but their pictures load straight from cdn.modrinth.com, which sees your IP address like any website would.
- [MONITORING PROVIDER, if enabled] stores error logs and performance traces.
Data outside the EU
We keep data in the EU where we can. Some of the companies above (Stripe, Discord and Resend, for example) are based in the US. Where data leaves the EU, it's protected by the EU–US Data Privacy Framework or the EU's standard contractual clauses. [LAWYER: confirm the transfer basis for each provider.]
How long we keep it
- Your account and game names: as long as you have an account. Ask us to delete it at any time.
- Guest setups that never got an email or Discord: deleted after 30 days, along with clubs that only they belong to, unless the club has a world, money in its fund or a monthly chip-in.
- Sign-in links: they work for 15 minutes once and are deleted 14 days after that.
- Emails we send: the address and link are wiped from our queue as soon as the email is delivered, and the delivered message is deleted after 14 days.
- Invite links: they stop working after 7 days.
- The fund log: kept for [5 years from the end of the financial year], as bookkeeping law requires. If you delete your account, the entries stay but [DECIDE: are no longer linked to your name].
- Waitlist: until [LAUNCH + X MONTHS], or until you ask us to remove you.
- Backups of our database: made nightly and kept for 14 days, so deleted data is gone from backups within 14 days.
- Error logs and traces: [LOG RETENTION].
Your rights
Under the GDPR you can ask us for a copy of your data (also in a format you can take elsewhere), to correct it, to delete it, to restrict or object to how we use it, and you can withdraw consent at any time. Email support@radclub.gg; we'll answer within one month and may send a sign-in link first to make sure it's really you.
Some things you can do yourself: change your display name and game names, stop monthly chip-ins on the Fund page, leave a club, and disconnect Radbot.
If you're unhappy with how we handle your data, you can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or the authority where you live.
Keeping it safe
Everything goes over HTTPS. There are no passwords to leak: sign-in links work once, expire in 15 minutes, and are stored only as hashes. Card details stay with Stripe. Only the people who run Radclub can reach the servers and the database.
Children
Radclub isn't meant for children under [MINIMUM AGE] without a parent's or guardian's permission. If you think a child has given us data without it, tell us and we'll delete it.
Changes
When this policy changes in a way that matters, we'll tell you by email or on the site before it applies. The date at the top shows the latest version.