Privacy Policy

What I actually store

Everything kept about you, and where it lives:

Your username

So I know which mod list is yours. Your device remembers it too, so you're not asked to sign in every time.

Your password

Scrambled before it's saved, in a way that can't be undone. Nobody can read it back — not me, and not anyone who got hold of the database.

Your mod list

The list you build. Kept on the server so it's the same everywhere you sign in, and copied to your device so it opens without waiting.

Your email optional

Only if you add one. It lets you reset your own password and lets me reach you if something about your account needs your attention. Clicking the link I send is what confirms the address works — without that, a reset email would go nowhere. Change or remove it whenever you like.

When you last used it

The date, the version you were running and the internet address you connected from. This is how I can tell whether an update would leave anyone stranded on a version that no longer works.

Sign-in records

When you signed in, from which internet address, and using which browser or app. Kept for a year — more on why below.

Lists you've shared

If you create a share link, the link and a snapshot of the mods it showed are stored so the page keeps working. They go when you delete the link, or when you delete your account.

What I don't collect

Things people reasonably worry about, that simply aren't here:

Your browsing

The extension only runs on wgmods.net. It cannot see any other site you have open, and it doesn't record which mods you look at or what you search for.

Who you are

No real name, no address, no age, no date of birth. An email is the only contact detail there is, and it's optional.

Advertising and analytics

No tracking pixels, no analytics company, no ad network, nothing sold or shared. There is no advertising side to this at all.

Where you are

No location access of any kind. An internet address hints at roughly which city someone is in, but I never look one up or store anything beyond the address itself.

What you type

Nothing you type is read or sent anywhere. On a mod page the extension looks at the mod's name and version so its button can say something useful, and that is the whole of it.

Why I need this data

Your username, and the bit that keeps you signed in, exist for one reason: to fetch your mod list and let you add to it without logging in every time. That's the entire purpose.

If you add an email, it's for two things only — letting you reset your password yourself, and letting me reach you about your account. Not newsletters, not promotions, not anything else.

The date you last used the app tells me whether it's safe to retire an old version. Without it the only way to find out would be to switch something off and wait for complaints.

I'm not selling any of this. I'm not sharing it. I'm not building a profile of you or targeting you with anything. I built this for myself first and shared it because it seemed useful; that hasn't changed.

Sign-in security logs

Registering, signing in, verifying a Microsoft Store purchase and deleting an account each leave one line behind: when it happened, the internet address it came from, and which browser or app was used.

That exists to catch people attacking accounts — guessing passwords, burning through invite codes — and to slow down anyone trying it. The address is never looked up to find out where you are, none of it is matched against anything else, and none of it leaves the server. Lines are deleted automatically after a year, or straight away if you delete your account.

How I keep your data safe

Your password travels to the server over an encrypted connection and is scrambled the moment it arrives, in a way that cannot be reversed. The extension never sees it and the app never keeps it. If the database were ever stolen, the passwords in it would still be unreadable.

What your browser holds to keep you signed in is stored where other extensions and websites can't reach it. On your PC the app keeps the same thing encrypted, so that a copy of the file is useless on anyone else's machine. It renews itself while you keep using it and stops working once you've left it untouched for 90 days. Changing your password takes away every other device's ability to stay signed in, so they drop out as soon as they next check in.

The desktop app also keeps ordinary local things — where your game folder is, which mods you've installed and turned off, your language and theme. None of that is sent anywhere.

Third parties

The extension talks to two things: my server, and — only if you allow it — the desktop app on your own computer, over an address nothing outside your machine can reach. That local conversation is how it knows which mods you already have. No analytics company, no error-reporting service, no ad network, no tracking libraries anywhere in either.

Email is the one genuine exception. If you add an address, messages are delivered through Resend, a mail service with servers in Ireland. They see your address only when a message is going out to you, they handle it on my behalf, and they use it for nothing else. Add no email and they never see you at all.

The desktop app can show what you're doing in Discord, which is off unless you switch it on. While it's on, Discord shows your status the way it does for any other program. Turn it off in settings and that stops.

What you can do

Sign out

From the extension popup or the app, whenever you like. Everything held on your device goes immediately.

Change your email

Change it or remove it any time in account settings. Removing it turns off password reset by email, since there'd be nowhere to send it.

Delete a shared link

Any link you've created can be revoked in the app. The page it pointed at stops working straight away.

Delete your account

In the extension's Account tab, or in the app's account settings. Nobody needs to be contacted. Signing in stops working at once and everything is erased for good after 7 days.

Ask me anything

If something here isn't clear, or you want to know what's held about your account, write to [email protected].

If this changes

If how I handle any of this changes, the date at the top of this page changes with it, and anything significant gets a line in the release notes. I don't expect the approach to shift — I'm still one person trying to make a useful tool, and the less I hold, the less there is to worry about.