SkriptlyThis policy explains what Skriptly collects, why, and what you can do about it. [COMPANY NAME] ([REGISTERED ADDRESS]) is the controller of your personal data. Questions go to [PRIVACY EMAIL].
What we collect
Your account. Username, Discord notification settings, whether you've confirmed a Discord bot DM code, and Discord's stable account ID so the same Discord account returns to the same Skriptly account. Discord is the only sign-in method; we don't receive or store a password, and we don't request or store your email address (or Discord's). We also don't store the Discord access token, avatar or display name.
What you do on Skriptly. Scripts, versions, screenshots and descriptions you upload; reviews and reports you write; which free scripts you download while signed in; the scripts you save to your wishlist (and when we last Discord-DMed you about a price drop on one); and the moderation history of your content.
Breakage reports. If you tell a creator that a script broke after an update, we keep your report: the script version, the Skript and Minecraft versions and addons you chose, what you wrote, the creator's answer and the dates. The creator and our moderators can see it, including your username. It doesn't include your server's address or ID.
Purchases. What you bought, when, the price, Skriptly's fee, the payment provider's reference, and refunds. Card and bank details go to [PAYMENT PROVIDER] directly; we never receive them.
Licensed scripts, through the loader. Each time the Skriptly Loader loads a licensed script or checks in, it sends:
- the license key and the script and version it's loading;
- a server ID: a random value the loader creates the first time it starts
and keeps in
plugins/SkriptlyLoader/server-id. It isn't based on your hardware and doesn't identify you; - your server's public IP address, which reaches us with every request.
We store, per server on a license, the server ID, the most recent IP address, and when it first and last checked in. The loader doesn't send anything about your players, worlds, chat, other plugins or server settings.
Page views. When a script's page is opened, the site adds one to that script's count for the day, so its creator can see how many times it was viewed. The count holds only the script, the date and a number: no cookie, no browser storage, no IP address and no account or visitor ID. Visits from creators to their own scripts and from moderators, from known bots, and from browsers that send Do Not Track or Global Privacy Control aren't counted. The count can't tell one visitor from another.
Seller+ and profile links. If you're a creator and buy Seller+, we keep a record of the purchase (the plan, the price, the provider's reference and the dates it covers). If you add a website or Discord invite to your profile, we store those links and show them publicly on your profile while Seller+ is active.
Minecraft skin. If you link a Minecraft Java account in your settings, we look up that account's skin from Mojang once, when you link it or choose to refresh it, and keep our own copy of the image along with the account's username and ID. The username and ID are never shown to anyone. Visitors' browsers get the picture from us, not from Mojang. The skin is visible only to you unless you choose to show it on your profile and next to your name. Remove it in your settings and our copy is deleted, as it is if you delete your account.
Discord alerts. If you're a creator and add a Discord webhook address in your settings, we store it encrypted, along with which alerts you chose. We use it only to post those alerts (sales, review decisions and breakage reports) to your channel. The alerts name the script and, for sales, your share; they don't name buyers or people who report problems. Remove the webhook in your settings and it's deleted.
Technical data. IP addresses of visitors, used briefly to stop abuse (rate limits on sign-up, login and similar), and server logs kept for [30] days.
Why we use it
| Purpose | Data | Lawful basis |
|---|---|---|
| Running your account and the marketplace | Account, content, breakage reports | Contract |
| Signing you in through Discord when you choose it | Discord account ID | Contract |
| Confirming your account and sending receipts or notices by Discord DM | Discord account ID, bot messages | Contract |
| Selling and delivering licenses, refunds | Purchases, loader data | Contract |
| Enforcing seat limits and tracing leaked copies | Loader data, watermarks | Legitimate interests: protecting creators' work |
| Showing the skin you linked as your character and avatar | Skin image, Minecraft username and ID | Consent (you link it, and showing it to others is off until you turn it on) |
| Posting alerts to a creator's Discord channel, when they ask for it | Webhook address, alert choices | Contract |
| Showing creators how many times their scripts were viewed | Daily view counts (no personal data) | Legitimate interests: creators running their listings |
| Stopping fraud and abuse, moderating content | Technical data, reports | Legitimate interests: keeping Skriptly safe |
| Discord DMs about your account, purchases, reviews and price drops on scripts you saved | Discord account ID, saved scripts | Contract; optional review and update DMs can be turned off in your settings |
| Tax and accounting records | Purchases | Legal obligation |
We don't sell your data, show ads, or use tracking or analytics cookies.
Watermarks
Each copy of a licensed script is marked with an identifier tied to its license, and with your username in a comment at the top. If a copy leaks, we can trace it to the license it came from.
Who else sees it
- Other users see your username, your public profile, your published scripts and your reviews.
- Creators see how many licenses of their scripts have sold and how many servers are running them, and are Discord-DMed the username of each buyer. They don't see your server's IP address.
- Service providers who run parts of Skriptly for us: hosting ([HOSTING PROVIDER]) and payments ([PAYMENT PROVIDER]). They only process data on our instructions.
- Discord, when you sign in or we send you a bot DM. Discord receives the
OAuth request and handles your sign-in under its own privacy policy; we
request only your identity (the
identifyscope), never your email. - Authorities, when the law requires it.
[LEGAL REVIEW: international transfers and safeguards, once providers are chosen.]
How long we keep it
- Account data: while your account is open, and up to [30] days after you close it.
- Purchase records: 6 years, for tax and accounting.
- Loader data for a server: while its license is active, and [12] months after the server is removed or the license ends.
- Daily view counts: as long as the script exists, since they hold no personal data.
- Rate-limit data: a few hours at most.
Cookies
Skriptly sets a session cookie that keeps you signed in. During Discord sign-in it also sets short-lived, essential cookies (up to ten minutes) that bind the callback to the browser that started it and remember where to return you. These are essential to the site, so there's no cookie banner.
If you pick the light or dark theme, your browser also remembers that choice in its local storage on your device. It's not a cookie and it's never sent to us.
Your rights
Under UK data protection law you can ask to see the data we hold about you, correct it, delete it, restrict or object to how we use it, or get a copy to take elsewhere. Email [PRIVACY EMAIL]. We'll answer within a month. Some data (like purchase records) we have to keep even if you ask us to delete it.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Skriptly isn't meant for children under [13], and we don't knowingly collect their data. [LEGAL REVIEW: age threshold, and the ICO Children's Code.]
Changes
If we change this policy in a way that matters, we'll tell you by Discord DM or on the site before it applies.