Privacy

contact@fsmodworks.com

We store your email address, optionally a display name, your language and your password as a bcrypt hash — we do not know the password itself. The basis is performance of the user contract (Art. 6(1)(b) GDPR). If you delete your account, this data is deleted.

If you sign in with Discord, we receive your Discord ID, display name, email address, language and profile picture from Discord once. We copy the profile picture to our own server — your browser does not connect to Discord while you use the site. No password is created. The basis is performance of the user contract (Art. 6(1)(b) GDPR).

When you register, sign in or request a new confirmation mail, Cloudflare Turnstile checks that a human is filling in the form. Cloudflare, Inc. (USA) receives your IP address and technical characteristics of your browser; you usually do not have to solve a puzzle. The basis is our legitimate interest in preventing automated accounts and abuse of download keys (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. Turnstile sets no cookies to recognise you across websites.

Embedded videos are hosted by YouTube (Google). They only load once you release them with a click — before that, no request goes to Google. With the click you consent to your browser loading the video from YouTube, in the course of which Google receives your IP address (sec. 25(1) German TDDDG, Art. 6(1)(a) GDPR). We embed in privacy-enhanced mode via youtube-nocookie.com; your “remember” choice stays in your browser.

On the community page, the Discord panel can be loaded with a click (Discord Netherlands BV, Netherlands). Before that, no request goes to Discord. With the click you consent to your browser loading the panel, in the course of which Discord receives your IP address (sec. 25(1) German TDDDG, Art. 6(1)(a) GDPR); your “remember” choice stays in your browser. The count of members currently online shown elsewhere on the site is fetched by our own server — your browser does not talk to Discord for it.

We advertise this site via Google. For that, gtag.js is loaded from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). That request alone transmits your IP address to Google; data may reach the USA, safeguarded by the EU standard contractual clauses and the EU-US Data Privacy Framework.

Without your consent, Google Ads runs in “denied” consent mode with ad identifiers redacted and sets no cookie. Only with your consent (Art. 6(1)(a) GDPR, sec. 25(1) German TDDDG) is the _gcl_au cookie set and used to measure whether an ad led to a purchase.

You can withdraw your consent at any time via “Cookie settings” in the footer. Withdrawal takes effect for the future; the lawfulness of processing carried out until then is unaffected.

For visitors without a membership we show ads via Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). For that, your browser loads the adsbygoogle.js script from Google; that request alone transmits your IP address to Google, and data may reach the USA, safeguarded by the EU standard contractual clauses and the EU-US Data Privacy Framework. Members with an active membership see no ads; the script is not loaded for them. We do not load it on the mod pages either.

Whether and how ads are tailored to you is your choice in Google's consent dialog shown on your first visit (Art. 6(1)(a) GDPR, sec. 25(1) German TDDDG, IAB TCF 2.2). Without consent, Google shows non-personalised ads only, or none. You can change your choice at any time via “Cookie settings” in the footer. Which cookies Google sets in the process is described in Google's privacy policy at policies.google.com/technologies/ads.

If you turn on push notifications on our site and allow them in your browser, we store your browser's address at its push service (endpoint), two technical keys for encryption and the language of the page. If you are logged in, we link the subscription to your account. We also store which button you used to sign up (for example the one on a mod page), so we can see which buttons people use. We don't store an IP address or browser fingerprint for this. Purpose: to tell you about new mods, updates and important news.

The legal basis is your consent (Art. 6(1)(a) GDPR, sec. 25(1) TDDDG), which you give with the click and in the browser dialog. Delivery goes through your browser's push service: Google (Firebase Cloud Messaging), Apple (Apple Push Notification service), Mozilla (Autopush) or Microsoft (Windows Push Notification Services). Data may reach the USA, safeguarded by the EU-US Data Privacy Framework.

You can turn it off any time at fsmodworks.com/push, and we delete the subscription right away. If you turn it off in your browser settings instead, we delete it as soon as the push service tells us on the next send that it no longer exists.

For confirmation, password and contract emails we use our hosting provider's mail server (Hostinger). Confirmation and password links are stored only as a hash with an expiry date; once used or expired they are removed.

Notifications (replies, mentions, private messages, new followers, new threads by people you follow) and, at most once a day, a digest about reactions and profile visitors are sent only to confirmed addresses and only as long as the respective boxes in your settings are ticked. Each of these emails contains the way to switch it off (Art. 6(1)(b) GDPR).

For every download we store which file was fetched, when and by which account, plus the IP address. That is the basis for acting against redistribution and, later, for paying creators (Art. 6(1)(b) and (f) GDPR).

Download ID: every file you download here contains a small text file with an ID that we can match to your account. It contains neither your name nor your email address, and third parties cannot read it. We use it only to identify the source of copies that were redistributed without permission (legitimate interest in protecting our copyright, Art. 6(1)(f) GDPR). The same ID is part of your download key.

What you write in the forum or under a post is publicly visible — together with your display name and the time. Uploaded images are re-encoded and stored without metadata (such as location data); they are publicly accessible too. We also store which threads you have read (for the unread counter) and your reactions.

If you report a post, we store the report with your account so we can act on it and trace it. That is our notice-and-action mechanism under Article 16 DSA.

If you delete your account, the link to your posts is removed — they then show as “Deleted account”. The text stays so conversations do not fall apart. If you also want individual posts removed, write to us.

Your public profile shows your display name, picture, About me, your recent forum activity and reactions received — each of these sections can be switched off in your settings. If you follow someone, we store that connection as long as both accounts exist; who follows you is shown on your profile.

If you open another member's profile while signed in, we store visitor and time so that person sees you in their visitor box; these entries are deleted after 90 days, and with “Hide my profile visits” nothing is stored at all. Profile views are counted only as a number. If you report a user, the same applies as for reported posts. The basis is performance of the user contract (Art. 6(1)(b) GDPR); all of this data is deleted together with the account.

When you visit the site, technical log data is created (IP address, time, requested address, browser). It serves operation and abuse prevention (Art. 6(1)(f) GDPR) and is deleted after a short period.

No tracking, no analytics services, no advertising cookies, no selling of data. Images and fonts come from our own server — which is why this site does not call out to third parties while you read it. The only exception is YouTube videos, and they load only after your click.

Access, rectification, erasure, restriction, portability and objection. An informal email is enough: contact@fsmodworks.com. You may also complain to a data protection supervisory authority.