Skip to content

Privacy Policy

Last Updated: August 2026

Who We Are

Railroader Modding Hub is operated by Alina Shumann. This service provides a platform for distributing Railroader game modifications with role-based access control. For any privacy-related question, use the Privacy Request category on our contact page, or email admin@alinanova.dev.

Data We Collect

We collect the minimum data necessary to provide authentication, access control, and mod distribution:

  • Discord Profile Information: When you log in via Discord OAuth, we collect your Discord user ID, username, and avatar. This data is used for authentication, access control, and to attribute mods to their uploaders.
  • Session Cookies: We use an HTTP-only, secure session cookie to maintain your login state. It expires after 24 hours and is strictly necessary for the service to function.
  • Download Activity: We log download activity (user ID, username, file downloaded, timestamp) to maintain system integrity and provide download statistics to mod authors. We do not store IP addresses or browser details in our application databases.
  • Uploaded Mod Metadata: When you upload a mod, your username is displayed publicly on the mod page, author page, and RSS feed for attribution. This name is captured at upload time and is also refreshed from your current Discord name.
  • Contact Form: If you contact us, we collect your name, email address, and message to respond to your inquiry.
  • Usage Statistics: We collect aggregate download statistics to provide mod authors with download counts for their content.

How We Use Your Data

  • Authentication: To verify your identity and maintain your login session
  • Access Control: To determine which files you have permission to download based on your Discord roles
  • Security Monitoring: To enforce access control policies and maintain system integrity
  • Attribution: To credit mod authors on public mod listings

We do not sell, share, or use your data for advertising purposes.

Legal Basis

We process your data on the following legal bases:

  • Performance of the service: Authentication and access control are necessary to provide the service you use.
  • Legitimate interest: Security monitoring, abuse prevention, and public attribution of uploaded content.
  • Your request: Contact form submissions are processed at your initiative so we can respond to you.

We do not rely on consent for any processing, and we do not process data for marketing purposes.

Discord Bot Permissions

Our Discord integration uses the following permissions:

  • Read Guild Members: To verify which Discord servers you are a member of and which roles you have been assigned.
  • Read Guild Roles: To display role names and enforce role-based access restrictions.
  • Send Messages: To post update notifications about new mod releases to subscribed channels.

Guild membership and role data is used only for access control decisions. Cached membership and role data is deleted automatically within 4 hours. The integration does not read your messages or perform moderation actions.

Third-Party Services

This service relies on the following third-party platforms:

  • Discord: Used for authentication via OAuth. Please review Discord's Privacy Policy.
  • Cloudflare: Provides hosting infrastructure (Pages, Workers, D1, R2, KV), bot protection via Turnstile, and email routing for the contact form. Cloudflare processes IP addresses as part of operating the service. Please review Cloudflare's Privacy Policy.
  • Fastmail: Our email provider. Contact form messages are delivered to our mailbox at Fastmail. Please review Fastmail's Privacy Policy.

Data Retention

We retain data for the following periods:

  • Session Data: Automatically expires after 24 hours and is deleted by routine cleanup.
  • Download Logs: Deleted after 90 days. Download counts and statistics are preserved in aggregate form. We do not store IP addresses or browser details.
  • Admin Activity Logs: Retained for 12 months for security and accountability; IP addresses are not stored.
  • User Profiles: Retained while your account is active. Deleted when you delete your account.
  • Cached Discord Data: Membership and role caches are deleted automatically within 4 hours.
  • Contact Messages: Deleted within 30 days of the matter being resolved.

Your Rights

If you are located in the EU/EEA (and to the extent applicable to all users), you have the right to:

  • Access: Download a copy of the data we hold about you at any time from your account page, or request it via the Privacy Request contact category. This includes correspondence you have sent us, which we will provide together with the structured data. We respond to requests within 30 days, free of charge.
  • Rectification: Correct inaccurate data about you.
  • Erasure: Delete your account and data at any time from your account page (including your uploaded mods, if you choose), or request deletion via the Privacy Request category. When you request deletion, we delete the data we can identify as yours, including correspondence from an email address you provide. We cannot delete correspondence we cannot associate with you (for example, messages sent from an email address you do not disclose).
  • Restriction and objection: Restrict or object to processing in the circumstances provided by law.
  • Portability: Receive your data in a structured, machine-readable format.
  • Complaint: Lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, use the Privacy Request category on our contact page or email admin@alinanova.dev.

Cookies

We use one cookie: an HTTP-only, secure session cookie that stores your session identifier. This cookie is strictly necessary for authentication and cannot be disabled without losing access to the service. No analytics, advertising, or tracking cookies are used.

Access to Download Data

Download information is accessed as follows:

  • Mod Authors: Can view aggregate download counts for their own mods. No user information is shared with mod authors.
  • Site Administrator: Has access to download logs for security monitoring and terms enforcement. Logs contain no IP addresses or browser details and are purged after 90 days.

Cross-Border Processing

Your data is stored on Cloudflare's global network and in our email provider's systems, which may process data in the United States, Australia, or other regions. Where required, this is covered by Cloudflare's and Fastmail's data processing agreements.

Contact

For privacy-related questions or concerns, please visit our Contact page (use the "Privacy Request" category) or email admin@alinanova.dev.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Material changes that affect your rights will be communicated where reasonably possible.