1. Who runs this
friendslop.wtf ("we", "us", "the site") is run by an independent developer. Questions, requests, and complaints about this policy go to max@snaptechrepair.com.
2. What we collect
Account details. When you create an account we store your username, your email address, and, if you chose a password, a salted scrypt hash of it. We never store the password itself. If you sign in with Google or Discord, we store the account identifier that provider gives us so we can recognise you next time.
Things you post. Game submissions (title, link, description, player counts, tags, who made it, an optional cover image) and crew calls (game, how many players you have and need, when, platform, region, a note, and the contact details you choose to publish, such as a Discord username or invite link). Crew calls are public by design, including the contact details you put in them.
Activity. Which games you upvoted, which crew calls you joined or reported, and any reason or note you attached to a report.
Technical data. Your IP address is used at the moment of a request for rate limiting (for example to slow down password guessing) and appears in our hosting provider's short-lived request logs. We do not build profiles from it. Your browser's user agent string is stored with each login session so you can recognise your own sessions.
Cookies and local storage. We set one cookie, fs_session, which keeps you logged in for up to 30 days. It is strictly necessary for the account features and carries no tracking. During a Google or Discord sign-in we set a second cookie, fs_oauth, for ten minutes to protect the sign-in against forgery. We also use your browser's local storage to remember small conveniences such as which games you have voted on. We do not use analytics, advertising, or third-party tracking cookies.
3. Signing in with Google or Discord
If you use "Sign in with Google", we request the openid, email, and profile scopes. Google sends us your Google account ID, your email address, whether Google has verified that address, and your name. If you use Discord, we request the identify and email scopes and receive your Discord user ID, username, display name, email address, and whether it is verified.
We use this information only to create your friendslop.wtf account or to match you to an existing account with the same verified email, to suggest a username, and to keep you signed in. We do not receive access to your contacts, files, messages, servers, calendars, or anything else, and we cannot post or act on your behalf on Google or Discord. We do not use this information for advertising, and we do not sell it.
friendslop.wtf's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke friendslop.wtf's access at any time from your Google account permissions or your Discord Authorized Apps settings. Revoking access does not delete your friendslop.wtf account; see section 6 for that.
4. How we use what we collect
- To run the site: accounts, sessions, showing your posts, counting votes, listing crew calls.
- To email you about your own account and posts: verifying your address, resetting a password, and telling you when a game you submitted is approved. We do not send marketing email unless you separately sign up for the newsletter, and you can leave that at any time.
- To keep the site usable: moderating submissions, acting on reports, limiting abuse, and preventing one person from voting more than once.
5. Who we share it with
We do not sell personal data, and we do not share it with advertisers. We share it only with:
- Vercel, which hosts the site and stores its data. Vercel's servers are in the United States.
- Resend, which delivers the emails described above, when that service is configured.
- Google Fonts, from which your browser loads the site's typeface. Google receives your IP address as part of that request.
- Anyone, in the case of content you chose to make public: game listings, crew calls, and the contact details you put in them.
- Authorities, if the law requires it.
6. How long we keep it, and how to delete it
- Login sessions expire after 30 days, or immediately when you log out or change your password.
- Email verification links last 24 hours and password reset links one hour; both are deleted when used.
- Crew calls expire on their own, between 6 hours and 7 days after posting depending on the time you chose, and are deleted about a day later. You can delete your own calls sooner.
- Rate-limit counters are kept for at most 24 hours.
- Your account and everything tied to it stay until you delete them.
Deleting your account. Open your profile and use "Delete my account". This removes your account record, email, username, password hash, provider links, sessions, votes, crew joins and reports, and all of your crew calls. Games you submitted stay listed, because other people may already be playing them, but they are unlinked from your account and your email is removed from them. If you want a game listing taken down as well, email us and we will remove it.
If you can no longer log in, email us from the address on the account and we will delete it for you.
7. Security
Everything is served over HTTPS. Passwords are hashed with scrypt and never stored in plain text. Session tokens are stored hashed. Sign-in with Google and Discord uses the authorization-code flow with PKCE. No system is perfectly secure, and if we learn of a breach affecting your data we will tell you.
8. Children
friendslop.wtf is not for children under 13, or under the minimum age for online services in your country if that is higher. We do not knowingly collect data from them. If you think a child has an account, email us and we will delete it.
9. Your rights
Depending on where you live you may have rights to access, correct, export, restrict, or delete personal data we hold about you, and to object to certain uses. You can see and change most of it from your profile, and delete all of it as described in section 6. For anything else, email us. We will respond within 30 days. If you are in the EU, UK, or another place with a data protection regulator, you also have the right to complain to that regulator.
10. Changes
If we change this policy in a way that matters, we will update the date at the top and, for significant changes, tell registered users by email or with a notice on the site.