What we keep

Who we are

Null Ossuary is a small community: a Discord server, game servers, and the website and forums at nossuary.com. It is run by one person, with volunteer staff who moderate. It is a hobby, not a company, and nobody here is a lawyer. What follows is a plain account of what the code actually does.

Most of what we store is held by Chamberlain, the server's own bot. The forums keep their own small database. Where this page says "we", it means the person who runs Null Ossuary.

What we collect, and why

We identify you by your Discord account ID — a number. Chamberlain does not store your username, display name or avatar, and it cannot read what you write: Discord's message-content access is switched off, so it sees that a message was sent, not what it says.

Levelling and achievements

Why we're allowed to: it's the point of being in the server, and it only counts things you can see reflected back at you. (Legitimate interests.)

• XP: points, when you last earned some, how many messages earned XP.
• Achievement progress: counts of messages, active days and streaks, voice minutes, reactions your messages received, forum threads started. Counts only — not which channels, not who reacted, not what was said.
• Achievements earned, and when. Earning one posts your name and avatar in #accolades; we don't keep a copy of that post.

Linked game accounts — only if you link

Why we're allowed to: you asked us to. You're told what's stored before anything is saved, and you can take it back at any time with /unlink. (Consent.)

• Your Steam account ID (or your Project Zomboid account name, if the server reports no Steam ID), which of our game servers confirmed it, when you linked, and when you were last seen in game.
• Your in-game account name, taken from our own game servers' player list.
• Play time on our servers may be recorded for a linked account. It is erased by /forgetme.

Linking exists so your ranks and achievements can follow you into our games and back. That's all it's used for. The linked set (Discord ID, in-game name, Steam ID) is sent to the bot that runs each of our Project Zomboid servers, and it is sent again whenever it changes, so an unlink reaches the game servers within minutes.

Moderation records

Why we're allowed to: keeping the community safe. These are kept even if you'd rather they weren't — a ban record that vanished on request wouldn't be much of a record. (Legitimate interests.)

• Notes, warnings, timeouts, kicks, bans and unbans: the action, the reason, which staff member took it (or that it was automatic), when, and when it ends if it's timed.

Join safety signals

Why we're allowed to: spotting raids and throwaway accounts before they do damage. (Legitimate interests.)

• When you joined, when your Discord account was created (worked out from the ID), a few bits of the ID that bot batches tend to share, whether you'd been in the server before, which invite you used, how long you took to accept the rules, and a resulting score.

The score only raises an alert for staff to look at. Nothing acts on it automatically.

Supporter status

Why we're allowed to: it's a record of a real payment. Supporting unlocks nothing; the record is just our thank-you. (Legitimate interests.)

• Donations go through Ko-fi, which handles the payment. We never see your card or bank details.
• We store a supporter tier set by hand, which staff member set it and when, and a short staff note (for example, which Ko-fi payment it was for).
• Whether you're boosting the server, and since when, as Discord reports it.

The forums

Why we're allowed to: running the forums you chose to sign in to, and moderating them. (Legitimate interests.)

• Your Discord ID, the name you show in our server, your avatar reference (so posts show who wrote them), whether you're staff, and whether you're currently a member or timed out (so we know whether you can post).
• Sign-in sessions, which last 14 days. Your Discord sign-in tokens are stored encrypted and are only used to re-check that you're still a member.
• The threads and posts you write. A post removed by you or by staff is hidden from everyone but kept for moderation, until your forum account is deleted (see below).
• Which posts you've reported, and when (the reason you give goes to staff in Discord and isn't kept by the forum), and a log of staff actions on posts and threads.

Sign in with Steam

The link flow on nossuary.com asks Discord who you are (only your ID is used; the rest of Discord's answer is thrown away, and the sign-in token is used once and revoked), then sends you to Steam's own sign-in page. Steam tells us your Steam ID and nothing else. The finished sign-in waits on Cloudflare until Chamberlain collects it — usually within a minute, never more than 24 hours.

What we don't collect

• The content of your Discord messages.
• Email addresses, real names, or payment details.
• IP addresses, in any database we run.
• Tracking or advertising cookies. The site has no analytics. The forums keep your sign-in in your own browser's storage; that's the only thing they put there.

We don't sell data, don't advertise, and don't use any of this to build a profile of you.

Where it's kept, and how it's protected

Chamberlain's database lives on hardware we run ourselves and is encrypted at rest. Only the operator can reach it directly. Staff see the parts they need to moderate — moderation records and join alerts — through Discord.

The forum database runs on Cloudflare. Sign-in tokens there are encrypted, and session tokens are stored only as a one-way hash.

How long we keep it

• Linked accounts: until you /unlink or /forgetme, or automatically 12 months after you leave the Discord server.
• Levelling, achievements, play time, links and join signals: until you run /forgetme, or automatically 12 months after you leave the Discord server (for departures the bot recorded).
• Moderation records: for as long as they serve their purpose. Nothing deletes them automatically, and a warning or ban has no end date.
• Supporter records: kept as a record of payment, including after /forgetme.
• Forum account: until you delete it from the forums, or automatically once it has gone unused for 12 months (checked daily). Sessions end after 14 days, or when you sign out.
• Steam sign-in hand-off: minutes, and never more than 24 hours.

Who else is involved

• Discord — the community lives there, so Discord sees everything you do in it under its own policy. The home page's "who's online" panel and forum avatars load directly from Discord.
• Cloudflare — runs the forums, the live server status, and the Steam sign-in hand-off.
• GitHub — hosts the website's pages.
• Steam — only if you use Sign in with Steam. You sign in on Steam's own page; we receive your Steam ID.
• Ko-fi — only if you donate. Ko-fi handles the payment under its own policy.

That's the whole list. We share nothing with anyone else unless the law makes us.

Your choices

• /mydata in Discord — everything Chamberlain holds about you, as a file only you can see. Moderation records are included.
• /unlink — removes your linked game accounts, here and on our game servers. Your levelling history stays.
• /forgetme — erases your XP, achievements, activity progress, playtime, links and join signals. Moderation records (for as long as they serve their purpose) and supporter records stay, for the reasons above.
• Delete my account on the forums (at the top of every forum page, next to Sign out, while you're signed in) — deletes your forum account, your sessions and the reports you filed, and revokes the forum's access to your Discord account. Your posts are emptied and marked deleted, and your threads and posts are shown as from "[deleted member]". The log of staff moderation actions is kept. This can't be undone.
• Anything else — a correction, a question, an objection — open a ticket in our Discord.

If you think we've got something wrong and we can't sort it out, you can complain to your data protection authority.

Children

You need to meet Discord's minimum age to use Discord, and therefore to use anything here. We don't knowingly keep data about anyone younger. If you think we are, tell staff and we'll erase it.

Changes

If what we store or why changes, this page changes with it, and we'll say so in the Discord. The date at the top is the last time it changed.