Privacy Policy

The controller under the GDPR is:

When you open a page, your browser sends your IP address, the page requested, the time and technical details such as the browser type. The server needs these to deliver the page.

• To stop abuse, the server counts requests per IP address. The count is held in memory for one minute and never written to disk.
• Roster Vault does not store IP addresses in its database.
• The site and its database are hosted by Hetzner Online GmbH (Germany).
• Uploaded files are stored in Hetzner Object Storage in Falkenstein, Germany.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in running a secure website.

You can browse, download and import without an account. To upload, rate, comment or report, you sign in with Discord or Google. We then receive and store:

• your account ID at Discord or Google,
• your display name and the address of your profile picture,
• your email address.

Your name and picture appear next to your uploads and comments. Your email address is never shown publicly; we use it only to contact you about your account or your uploads. We update name, picture and email each time you sign in.

Legal basis: Art. 6 (1) (b) GDPR, providing the account you asked for. Discord and Google process the sign-in under their own privacy policies: Discord, Google.

Profile pictures are loaded directly from Discord (cdn.discordapp.com) or Google (googleusercontent.com). Your browser connects to their servers for this and sends them your IP address, which can include a transfer to the USA. Legal basis: Art. 6 (1) (f) GDPR, our interest in showing who shared a file.

• Uploads, their files, descriptions, tags and versions are public and linked to your name.
• Comments are public and linked to your name.
• Ratings are stored with your account; only the average is shown.
• Reports are seen only by the moderators.
• Download counts are plain numbers; we do not record who downloaded a file.

Legal basis: Art. 6 (1) (b) GDPR, publishing what you chose to share.

We use only what the site needs to work, so no consent is required (§ 25 (2) TDDDG):

• nuxt-session: keeps you signed in, encrypted, until you sign out or close the browser.
• nuxt-auth-*: protects the sign-in against forgery, deleted after at most 10 minutes.
• auth_redirect: remembers the page to return to after sign-in, deleted after at most 5 minutes.
• nuxt-color-mode (local storage): remembers light or dark mode if you switch it.

• When you import a file by URL, the ZenGM game in your browser loads it from Roster Vault. We do not send anything to ZenGM.
• Some uploads link to files on other sites. Once you follow such a link, that site's privacy policy applies.

• Account data: until your account is deleted.
• Uploads and comments: until you or a moderator delete them, at the latest with your account.
• Deleting your account deletes your uploads with their files, your ratings, comments and reports.
• Files that were uploaded but never published are deleted after about an hour.

You have the right to:

• access the data we hold about you (Art. 15 GDPR),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict its processing (Art. 18) and receive it in a portable format (Art. 20),
• object to processing based on our legitimate interest (Art. 21),
• lodge a complaint with a data protection supervisory authority (Art. 77).

To use these rights or to delete your account, write to ulithebison@web.de. You can delete your own uploads at any time on the upload page.

We update this policy when the site changes. The date at the top shows the current version.