This policy explains what data the UnturnedPlugins.store marketplace (unturnedplugins.store, “we”, “the site”) collects, why, who we share it with, how long we keep it, and what rights you have.
By using the site, the UnturnedPlugins loader or our Discord bot, you confirm that you have read this policy. If you do not agree with it, please do not use the service.
1. Who processes your data
The data controller is the UnturnedPlugins.store project. We are not affiliated with Smartly Dressed Games, Discord, Steam, PayPal or the other services mentioned here.
For any questions about your data, contact us on the project Discord server.
2. What data we collect
Discord account. You sign in to the site only with Discord (identify, email and connections scopes). We receive your Discord ID, username, display name, avatar, e-mail address and whether it is verified, and the ID of the Steam account connected to your Discord, if any. This data is kept in an encrypted session cookie. Your e-mail is not stored in our database and is not shown on the site. Your Discord ID, username and display name are stored in the database where the service needs them: licenses, reviews, seller profile, notifications, blocks.
Steam account. If you link Steam, we store your SteamID64.
Seller data. If you sell plugins: display name, bio and profile page, contact link, avatar and banner, seller application note, your terms of sale, and the PayPal account e-mail used to receive payments.
Purchases, licenses and servers:
- plugin licenses tied to your Discord ID;
- the game server IP addresses you set for a license, and requests to change them;
- saved servers (IP, port, label) — the site periodically queries them for status (name, map, player count);
- your secret loader key, which the loader uses to fetch your plugins;
- orders paid through Pally: buyer and seller Discord IDs, order contents, amount, status and payment identifiers.
Reviews and content. Review text, rating and your name; plugin files (.dll), icons, screenshots and descriptions uploaded by sellers; results of the automated malware scan of those files.
Notifications and settings. On-site notifications, interface language and the categories of direct messages you allow from our Discord bot.
Technical data:
- IP address — for rate limiting (kept in server memory only), to check the server address the loader requests plugins from, and to pick the site language on your first visit (see section 5);
- service logs, which may contain your Discord ID and username when you sign in, your SteamID when you link Steam, the IP address when the loader is denied access, and payment error details;
- moderator and administrator actions (moderation log).
We never receive your card or bank account details: payments are processed by PayPal and Pally. We do not use analytics or advertising trackers.
3. Why we use your data
- signing in and running your account — performance of a contract (our terms of use);
- selling and delivering plugins, licenses and updates, running the loader and the IP whitelist — performance of a contract;
- accepting payments and paying out sellers — performance of a contract;
- moderating products and reviews, scanning files for malware, protecting the service from abuse and overload — our legitimate interest in keeping the service safe;
- on-site and Discord notifications about purchases, licenses and updates — performance of a contract; you can turn off direct message categories in your settings;
- remembering your language and theme — our legitimate interest in a convenient site;
- handling payment disputes and complying with the law — our legal obligations and legitimate interest.
6. How long we keep data
- sign-in session — up to 14 days; the cookie is removed when you sign out or it expires;
- service logs — up to 7 days;
- rate limiting and language detection — in memory only, up to 12 hours;
- account, licenses, servers, seller profile, reviews and notifications — while you use the service or until you ask us to delete them;
- order and payment records — as long as needed to deliver purchases, handle disputes and refunds, or as required by law.
There is currently no automatic deletion of old records: data is deleted on request (section 8).
7. How we protect data
The site runs over HTTPS, the session cookie is encrypted and not accessible to page scripts, file storage is not exposed to the internet directly, and uploaded plugin files are scanned in an isolated environment with no network access. Only administrators and moderators can access data, to the extent their tasks require. No method of transmission or storage is completely secure, but we work to reduce the risks.
8. Your rights
You can:
- get a copy of the data we hold about you;
- correct inaccurate data;
- ask us to delete your data;
- restrict or object to processing;
- receive your data in a machine-readable format;
- withdraw consent — for example, turn off bot direct messages in your settings;
- lodge a complaint with the data protection authority in your country.
Some actions are available right away: delete a saved server or your review, regenerate your loader key, turn off notifications in your settings, or remove our app from your Discord account's authorized apps. Everything else is available on request. To make sure the request comes from you, we will verify your Discord account.
We may keep some data after a deletion request if it is needed to handle payment disputes, prevent fraud, or comply with the law.
For any questions about your data, contact us on the project Discord server.
9. Children
The service is not intended for anyone under 13, the minimum age for a Discord account. If you learn that a child has given us their data, contact us and we will delete it.
10. Changes to this policy
We may update this policy when the service changes. The date of the current version is shown at the top of this page. We will announce significant changes on the site or on the project Discord server.