Privacy policy

Collection and use

We minimize data collection to support sign-in, the features you use and abuse prevention. We do not sell or rent user data. We do not use it for advertising profiles or marketing email.

• Accounts: account identifiers, display names and linked sign-in identities. Native registration uses an email address and password. Supabase verifies the email address and manages password hashing. PWND does not store passwords. Sign-in providers may return an email and public profile information. Supabase's X provider requests email access; PWND does not need email for X giveaway entry.
• Features: profiles, posts, messages, tickets, form responses, role requests, moderation records, giveaway entries and key-delivery records you create or participate in. Creators can ask for additional information through their forms. Submit only what is needed.
• Security: session and CSRF cookies, request metadata and network identifiers used for rate limits and abuse prevention. Hosting and authentication services process IP addresses. We do not log plaintext passwords or private message bodies.

Supabase Auth stores passwords as salted hashes. PWND does not store plaintext passwords. PWND does not save provider contact lists or follower lists, or fetch X posts for sign-in.

Discord sign-in and account linking request your basic Discord profile and email address through Supabase. Adding the Discord Bot is a separate action with permissions shown by Discord.

When PWND enrollment sync is enabled, pwnd.live shares a member's linked Discord user ID, whether they are enrolled, and their Creator or Developer enrollment roles with PWND at app.pwnd.live to keep membership access up to date. Enrollment sync does not send email addresses, passwords, provider tokens or private messages.

Visibility and protection

Public profiles, forum posts, published creator and contractor pages and pCards are public and can be indexed or copied. Contractor availability uses a recent workspace heartbeat. Aggregate first-response history and request counts are public for published contractors. Form responses are available to the creator managing that form.

PWND caches creator images only for active, verified PWND Creators. External image hosts control their own caching.

Direct chats, contractor tickets and bundle proposal threads are restricted to participants. A participant report lets administrators review the entire reported conversation, including later replies. Administrators manage support tickets. Private messaging and Bundles content are encrypted at rest with AES-256-GCM. Routing metadata, such as account IDs, status and timestamps, remains queryable. This is not end-to-end encryption: the application decrypts authorized reads.

Service providers and external content

Microsoft Azure hosts PWND. Supabase provides authentication and database storage. Connected providers handle sign-in and the integrations you enable. Steam checks receive game app IDs. Public channel statistics use Twitch, TwitchTracker and YouTube. External images and links connect your browser to their hosts, which receive request information and apply their own policies.

We share data to operate requested features, investigate abuse or meet legal requirements. The commitment not to sell user data applies to all PWND features.

Retention and requests

Account and activity records have no automatic expiration. Administrators handle access, correction and deletion requests through support tickets. Security records and backups can retain older copies after live data is removed. We do not promise immediate removal from backups.

Unrefreshed YouTube statistics are cleared by the scheduled worker after 29 days and are not displayed after 30 days. See the YouTube privacy and terms notice. Session, CSRF and preference cookies support account security and selected features. Clearing cookies signs you out or resets preferences.

Changes to this policy will update the effective date on this page. See the terms of service.