Note legali
Privacy policy
Who is responsible#
SOTF Mods (sotf-mods.com, "we") is a community website operated by the SOTF Mods team, which is the data controller for the personal data described here. You can reach us about anything in this policy at privacy@sotf-mods.com.
The short version#
- You can browse and download without an account. We don't need your name.
- If you create an account, we store your email address, a securely hashed password and what you choose to publish.
- Our own statistics don't use cookies and never store your IP address in clear text.
- Ads are shown only to visitors who are not signed in, and only after consent where the law requires it.
- You can export or delete your account yourself, from your settings.
What we collect#
When you browse or download
- Technical request data (IP address, browser, requested page, time), used transiently to serve the page, protect the site from abuse and apply rate limits. Server logs are kept for a short time.
- For downloads: which version was downloaded, when, the kind of client (browser, mod manager) and a keyed, irreversible hash of your IP address that changes every day, so we can count unique downloads without knowing who you are.
When you have an account
- Email address, handle, display name, the password hash (we never see your password) and your settings.
- What you publish: mods, versions, images, comments, reviews, compatibility reports, Kits and your profile (bio, links, avatar and banner).
- Activity needed for the features you use: mods you follow, your download history (you can clear it and turn it off), notifications and achievements.
- Security data: active sessions (device, browser, approximate country, last activity) and sign-in events.
When you contact us or report something, the content of your message or report.
Why we use it#
- To provide the site and your account (performing our agreement with you).
- To keep the site secure, prevent spam and abuse, and moderate content (legitimate interest).
- To understand which pages and mods are used, with the privacy-friendly statistics below (legitimate interest).
- To send the emails you need (verification, password reset) and the notifications you opt into.
- To show ads to guests, based on consent where required.
- To meet legal obligations, such as answering copyright notices.
We don't sell personal data and we don't build advertising profiles.
Statistics without cookies#
Our own audience measurement (page views, searches, downloads) sets no cookies and stores no personal identifiers. Each visit is counted with a hash of the IP address and browser combined with a secret that rotates daily, so visits can't be linked across days or to a person. If your browser sends Global Privacy Control or Do Not Track, we don't record the visit at all.
Who processes data for us#
We use a few service providers, each only for its purpose and under a data processing agreement:
| Provider | Purpose |
|---|---|
| Cloudflare | Content delivery, security, file storage (R2) and bot protection (Turnstile) |
| Resend | Sending account and notification emails |
| Ads and the consent tool, for guests only | |
| VirusTotal | Scanning published mod files (files only, no personal data) |
| Sentry | Error reports, if enabled, with personal data disabled |
Moderators see what is needed to moderate (for example, the content and history of an account under review); every moderation action is logged.
How long we keep it#
| Data | Kept for |
|---|---|
| Account data (email, password hash) | As long as the account exists |
| Hashed statistics events | 90 days |
| Download records (hashed IP) | Kept for statistics |
| Sign-in events | 90 days |
| Sessions | Until they expire, plus 30 days |
| Data exports | 24 hours |
| Deleted accounts | Anonymized after a 14-day grace period |
When you delete your account, your comments and reviews stay but are shown as "Deleted survivor", and your personal data is erased. You choose whether your mods are archived or stay published without attribution.
Your rights#
Depending on where you live (for example under the GDPR), you have the right to access, correct, export and delete your data, to object to or restrict some processing, and to withdraw consent at any time.
- Export: Settings → Data → Export. You get an email with a download link, valid for 24 hours.
- Delete: Settings → Data → Delete account (with a 14-day grace period).
- Correct: edit your profile and account settings at any time.
- For anything else, write to privacy@sotf-mods.com. We answer within one month.
You can also complain to your local data protection authority.
Children#
SOTF Mods is not directed at children under 13, and we don't knowingly collect their data. Sons of the Forest itself is rated for adults in most regions. If you believe a child has given us personal data, contact us and we will delete it.
International transfers#
Our providers may process data outside your country, including in the United States. Where required, transfers rely on adequacy decisions or the European Commission's standard contractual clauses.
Security#
Sessions use secure, HttpOnly cookies and are stored only as hashes; passwords are hashed with modern algorithms; files are scanned before they are published; and access to production data is restricted and logged. No system is perfect: if you find a vulnerability, please report it privately (see our security.txt).
Changes to this policy#
We will date every change on this page and announce significant ones in News and, if you have an account, by email before they take effect.
Contact#
Privacy requests: privacy@sotf-mods.com. Other questions: our Discord.