Privacy Policy

Contact

Privacy requests can be sent to [email protected].

Information processed

• Account data: name, email, verification state, profile image, and account timestamps to create and operate accounts.
• Discord (third-party service): you can sign in with Discord, or connect Discord to an existing ScriptBunker account from Settings. If you do, we receive your Discord user ID, username and email address, and store the provider identity, the granted permissions and the Discord access tokens (stored encrypted) needed to sign you in and keep the connection. Where enabled, ScriptBunker also requests Discord's "join servers for you" permission (guilds.join) and uses it, right after you authorize, to add your Discord account to the official ScriptBunker community server; we then check with Discord whether your account is a member so Settings can show it. Authorizing on Discord grants all requested permissions together; if you do not want to be added, sign in with email and password instead. You can disconnect Discord in Settings, and you leave the Discord server from Discord itself. ScriptBunker is not affiliated with or endorsed by Discord.
• Creator profile: username, display name, bio, avatar/banner URLs, role, verification, and account state to display profiles and administer access.
• Uploaded content: script metadata, source, version history, URLs, and changelogs to host and publish creator submissions.
• Community data: script likes and plain-text comments, including their account author and moderation state.
• Library data: the scripts you save, and — while you are signed in — a short list of the scripts you recently opened (at most your latest 100, with only the time you last opened each), so we can show them in "My Library". This is your personal list, visible only to your account; it is not analytics, is not shared with creators, and you can clear your recent history at any time from the Library. It is deleted with your account. The same personal, account-only rules apply to the scripts you watch, the creators you follow, your private collections and the compatibility reports you submit (an executor, a platform and a worked/didn't-work answer for a release, shown to others only as aggregated counts).
• Creator integrations: for creators who use them, API token metadata (name, scopes, a one-way digest — never the token), webhook endpoints (name, URL, events, delivery status) and a project activity log of the creator's own actions. Secrets, plaintext keys and device identifiers are never recorded in these.
• Product analytics: page views, successful copy interactions, distribution requests, and recent signed-in account activity. Signed-in events may reference the account ID. Anonymous unique estimates use a rotating one-way HMAC derived server-side from IP address, coarse user-agent data, and a UTC-day bucket; raw IP addresses and full user agents are not stored in analytics rows.
• Site traffic analytics (opt-in, "Accept analytics" only): once you accept, we record page path, referring website domain (not the full URL), a two-letter country code from our hosting provider's trusted edge header, and a coarse device/browser/operating-system category. We never store your IP address, exact location, or full User-Agent string as analytics data, never perform IP-based geolocation, and never link this data to your account, email, or Discord ID — a signed-in visitor is still anonymous in site analytics. The visitor/session identifiers are random values we generate server-side, never derived from your IP address or device fingerprint, and are stored only as a one-way hash. See Cookie Policy and Analytics documentation.
• Cookie and consent preferences: whether you've accepted or rejected analytics, and when you last changed that choice, so we can honor it and avoid asking again unnecessarily.
• Service emails: your address is used only for transactional messages: address verification, password reset, a notice when a new sign-in to your account happens (it includes the time and the IP address of the sign-in), and notices about moderation actions on your content or account. There are no marketing emails. They are delivered through an email provider (Resend), which therefore receives the recipient address and message content.
• Sessions and security logs: authentication cookies, session records, IP address, user agent, and server logs to maintain sessions, prevent abuse, and investigate incidents.
• Reports: content location, category, explanation, optional name/email, IP, account association, and moderation outcome to handle safety and legal notices.

Purposes and legal bases

We rely on performance of a contract for account and publishing features; legitimate interests in operating, securing, measuring, and moderating the service; consent where specifically requested; and compliance with legal obligations.

Recipients and processors

Providers currently involved are Cloudflare (network edge, TLS and abuse protection in front of the site), Resend (delivery of the service emails above) and Discord (only if you use Discord sign-in or connect Discord). Data may also be disclosed to authorities or rights holders where legally required. No Google Analytics or third-party advertising tracker is used.

Retention

Raw product analytics targets 90-day retention; raw site traffic analytics (opt-in) independently targets its own 90-day retention with a lazy, best-effort periodic cleanup rather than a full-time automated job.

Cookie and analytics consent

Site traffic analytics is off by default and only begins after you choose "Accept analytics" in the cookie banner or Cookie settings. You can change this choice at any time from Cookie settings in the footer; turning analytics off immediately stops new tracking and removes the analytics identifier cookies from your browser. See Cookie Policy for exact cookie names and durations.

Your rights

Depending on applicable law, you may have rights of access, correction, deletion, restriction, objection, portability, withdrawal of consent, and complaint to a supervisory authority. These rights can be limited by law, including when records are needed for security, legal claims, or compliance.

Security and changes

We use access controls and server-side authorization intended to protect data, but no online service can promise absolute security. Material policy changes will be communicated appropriately.