Privacy Policy

• Account data when you sign in: email address, display name, and (if you connect Discord) your Discord user id and avatar.
• Session cookies issued by Better Auth, used only to keep you signed in across requests.
• API key requests: name, email, and the purpose you describe on /api-access. We use this to evaluate the request and to email you back.
• API usage: per-key request counts and the last-used timestamp, retained for ratelimit and abuse prevention. We do not log per-request payloads or IPs beyond ratelimit windows.

• Raw API keys: we keep only the SHA-256 hash with a per-deploy salt. If you lose your key, we can revoke and re-issue but cannot recover the original.
• Public server data on this site is sourced from the CFX master list and per-server info.json endpoints; no personally identifying data is collected from servers themselves.
• Tracking pixels, third-party advertising scripts, or session replay tools.

Transactional email (sign-in magic links, API request confirmations, key approvals) is delivered via Resend. Resend processes the email address and message body solely to deliver the email. We do not use email for marketing.

Application data (accounts, sessions, server snapshots) lives in a Postgres database. Cache and ratelimit counters live in an Upstash Redis instance. Both are hosted in the EU / us-east-1 region depending on routing.

You can delete your account from /profile at any time; deletion cascades to your sessions and Discord link, and is irreversible. To request a copy of all data associated with your account, email privacy@metrics0.dev; we respond within 30 days.

We set one functional cookie (the Better Auth session). We do not set analytics or advertising cookies. Closing the browser ends the session for non-persistent logins.

Questions or concerns: privacy@metrics0.dev.