Privacy Policy
What idd.gg collects, why, who it's shared with, and how to exercise your rights.
Who we are
idd.gg is an independent community project run by Connor Baron, an individual based in the UK — not a registered company. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), Connor is the "data controller" for personal data processed through idd.gg, its Discord server, and the Brook bot.
Questions, requests, or complaints about your data: konr@konr.work.
What we collect
We only collect what's needed to run the site, the Discord community, and Brook (the bot):
- Account data — your email address, a securely hashed password (we never store or see your actual password), and your chosen username/display name.
- Linked platform data — if you choose to link Discord, Twitch, Steam, Kick, or TikTok, we store the platform username, ID, and avatar so we can verify your membership and sync roles. Nothing is linked without you initiating it.
- Payment data — if you subscribe (Backer/Patron/Partner), Stripe handles your card details directly; idd.gg never sees or stores them. We keep your email, Stripe customer/subscription ID, and tier so we can grant the right perks.
- Content you post — messages in site chat, forum threads/replies, club posts, and direct messages.
- Technical data — your IP address and browser info are recorded against login sessions (for security) and in a security audit log (for abuse prevention). See Retention below for how long.
Why we process it, and on what basis
- Contract — to provide the account and community features you sign up for.
- Legitimate interests — to keep the community secure, prevent abuse, and maintain an audit trail of account-security events.
- Consent — linking a third-party platform account is always something you initiate and can undo at any time from your account settings.
Who we share it with
We use a small number of third-party services, each only engaged when relevant to a feature you use:
- Stripe — payment processing for subscriptions.
- Discord, Twitch, Steam, Kick, TikTok — only when you link an account, to verify your identity and sync roles/status.
We don't use any analytics or advertising trackers, and we don't sell or rent your data to anyone.
International transfers
Stripe, Discord, and Twitch are US-based companies. Where your data is transferred outside the UK, these providers operate under their own recognised safeguards (such as Standard Contractual Clauses or the UK extension to the EU-US Data Privacy Framework) — this isn't something idd.gg configures directly, it's built into using these services.
How long we keep it
- Login sessions — deleted automatically once expired (checked daily).
- Security audit log — kept for 6 months, then purged.
- Bot activity/command logs — kept for 90 days, then purged.
- Account data — kept while your account is active. If you delete your account, your login, linked platforms, sessions, and payment records are removed within 30 days (in practice, immediately). Any active subscription is cancelled automatically as part of deletion.
- Content you've posted (forum, club, chat, DMs) stays visible to others for context, but once you delete your account it's no longer attributed to you — your account record is scrubbed and shown as "[deleted user]".
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Erase your data ("right to be forgotten")
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time (e.g. by unlinking a platform)
- Complain to the UK's data protection regulator, the ICO (0303 123 1113), if you're unhappy with how we've handled your data
The fastest way to exercise most of these: sign in and use Download my data or Delete my account in your account settings. For anything else, email konr@konr.work — we'll respond within one month.
Cookies
We only use strictly-necessary cookies to keep you signed in (a session cookie, plus a couple of short-lived ones during login/2FA). We don't use any analytics, marketing, or tracking cookies, so no cookie consent banner is needed. If that ever changes, this policy — and a consent banner — will be updated first.
Security
Sensitive tokens are encrypted at rest (AES-256-GCM), passwords are hashed (never stored in plain text), and all traffic to idd.gg is encrypted (HTTPS).
Children
idd.gg isn't directed at children under 13, in line with Discord's own minimum age requirement.
Changes to this policy
If we make material changes to this policy, we'll announce it in the Discord server. The date at the top of this page always reflects the latest version.