Privacy policy

Account information

If you register with email, you provide your first name, last name and email address. Supabase Auth handles the password and email confirmation; BrowseRP does not store your password as profile text. When you choose Google sign-in, Google supplies your provider identifier, name, email address and profile image. When you choose Discord sign-in, Discord supplies your provider identifier, username, email address and avatar; BrowseRP requests your Discord community list only when a server-ownership check needs it. We use this information to create and secure your account, show your chosen identity, connect accounts at your request, communicate about account or moderation actions and verify server claims.

BrowseRP does not request access to Gmail, Google Drive, Google Calendar, Discord messages or unrelated provider data. Provider access and refresh tokens are used only for the requested sign-in or ownership-check flow and are never copied into operational logs.

Information you send us

We store the details, links and images you send with listing submissions, ownership claims, reports, appeals and advertising enquiries so we can review them and respond. Approved public listing and profile information can be seen by visitors. Claim evidence, reports, data requests and advertising enquiries are handled through the relevant account and authorised staff tools; they are not published as directory content. Advertising replies stay on BrowseRP with the account that sent the enquiry.

Content checks and appeals

We check comments, proposed display names and profile pictures before publication. We keep the submission, decision, reason and any appeal so the rules can be applied and a decision reviewed. Pending or blocked submissions and appeal statements are available to the submitting account and authorised reviewers, not published to visitors. Your previously approved name or picture stays in use while a replacement is reviewed.

Clear abuse or spam can be blocked with a reason. Uncertain results and unavailable or failed checks go to staff review. When automatic checks are enabled, BrowseRP sends submitted comments, proposed display names and profile pictures to OpenAI for safety classification. This includes names and pictures imported when you sign in. The checks receive the submitted text or picture without adding your account details or browsing history; submitted content may itself contain personal information. If automatic checks are disabled or cannot finish, new submissions wait privately for staff review. With automatic checks enabled, clearly acceptable comments and names can be published without waiting for staff. Profile pictures need staff approval before publication, even when an automatic check finds no concern. Applications remain manually reviewed.

You can ask for a free staff review of a blocked submission through your signed-in account. We do not charge for an appeal or put a public warning label on your profile because of a content decision. Content checks are separate from optional recommendations. Private review does not make previously published copies or older public image links private. Review records and uploaded files must be considered separately when handling a data-removal request; a decision or replacement does not itself confirm their deletion.

Storage and service providers

Account, listing and moderation records are stored with Supabase. BrowseRP runs on Vercel, with Cloudflare helping protect the domain and website traffic. Google and Discord process the information involved when you choose their sign-in services. We share data with these service providers only as needed to operate and protect BrowseRP; we do not sell account information or use it for cross-site advertising.

Security information

For abuse prevention we use a random first-party device token, coarse browser, operating-system and device labels, a masked network range and keyed hashes. The full network address is separately encrypted. Staff see the masked range by default. The Owner, Management and Head Admin may approve access to protected network evidence and make an audited view themselves. Other authorised staff need an approved, time-limited request for a single view. Every view is audited. Our own account-restriction controls use this random device identifier instead of hardware or canvas fingerprinting.

Cloudflare separately helps protect BrowseRP against bots and attacks. Its essential security checks may process IP addresses, request and browser characteristics, and browser signals, and may set a cf_clearance security cookie. These checks are separate from BrowseRP’s account device identifier. See Cloudflare’s privacy policy and security cookie information. BrowseRP does not use these checks for advertising or cross-site marketing profiles.

Retention and your choices

After 45 days without recorded activity, an account may receive an in-app reminder. After 60 days, it may appear in a staff review list. Inactivity alone does not delete your account, remove your server ownership or close an appeal. Any requested account deletion requires a separate review of the data that must be removed or retained. Security evidence may be pseudonymised or retained where needed for abuse prevention, legal obligations or appeals.

Deletion is not an automatic purge. A review must address reports involving other people, moderation and security evidence, staff duty records, any financial evidence, server ownership and uploaded files. Request status alone does not confirm that these records, sign-in identities or files have been removed. Backups have separate retention and recovery handling; immediate removal from every retained backup is not promised. You may request access, correction or deletion subject to security, legal-hold and fraud-prevention exceptions. You can change your profile and its visibility from your signed-in account. Restriction appeals are available on our appeal page. Send and follow a request for a copy, correction or deletion from Your data on your profile. Staff review each request; submitting one does not immediately export, change or delete your data.

Optional discovery recommendations

If you enable personalised recommendations, BrowseRP stores up to 80 server-view records for up to 30 days in this browser’s local storage. Each record contains a BrowseRP listing reference, game, region and viewing time. Older records expire and are removed when you next use BrowseRP. We use these records on your device to prioritise regions you enjoy; only a normal region/game directory query is sent to our server, not your viewing history. We do not read your browser history or track activity on other websites.

This is off by default and is not used for targeted advertising. Turn it off and clear its history from Cookie preferences in the footer, the recommendation section or your profile preferences. Guests choose for this browser, including anyone sharing it. When signed in, your account stores the recommendation choice, its version and when it changed, so active devices can check it. Viewing history is never synchronised. A rejection on this browser keeps recommendations off until you explicitly accept here; a saved acceptance from another device cannot override it. Recommendations pause while we check the account or preference, when those checks fail and while the page is inactive. Other devices check when active; offline devices cannot receive a changed choice immediately. Account changes clear the optional history on this browser. Essential sign-in and security storage and your theme choice are separate from this optional setting. The separate Recently viewed list is a local shortcut to the last eight BrowseRP listings you opened.

Older comparison data

Earlier versions could store up to three public listing addresses and names in this browser for a comparison shortlist. The comparison feature has been removed. Existing local data may remain until you clear BrowseRP site data in your browser. Saved favourites are separate and belong to your signed-in account.

Optional listing statistics

Listing statistics stay off until you separately allow them in the Listing statistics controls on a server listing. This browser-only choice is independent of recommendations. When allowed, BrowseRP sends only the listing reference and whether you viewed it or clicked a community or join control. We store daily totals per listing and activity type, without visitor, account or device identifiers or individual event records. Owners can view the last 7 or 30 days for their own listings. These counts cover opted-in activity; they are not unique visitors, player counts or confirmed joins.

You can turn future recording off in the same controls on any listing. Global Privacy Control and Do Not Track signals keep recording off. Turning it off stops future collection; existing combined totals cannot be identified as yours or removed individually. No recommendation history is sent. Normal hosting and security processing still applies, including the separate short-lived network rate limit used to prevent abuse.

Optional visits and link clicks

When configured, Google Analytics can count visits to selected public pages and clicks on their Browse, List a server and Advertising links. A click does not confirm a completed listing, enquiry or purchase. These optional counts stay off until you allow them separately in Cookie preferences. Your choice lasts up to 30 days on this browser and does not follow your account to other devices. Accepting recommendations does not accept these counts. Global Privacy Control and Do Not Track keep them off.

Counts are limited to selected public landing pages after a successful guest-session check. Account, sign-in, recovery, staff, checkout, member profiles, individual listings and article pages are excluded. Pages containing a query string or fragment and arrivals from private or sensitive BrowseRP pages are excluded. Arrivals from other websites can count, but we do not supply their referring address. We supply fixed page and link labels, excluding search text, account identifiers, email addresses and tokens. Advertising features, Google signals and automatic interaction measurement remain disabled.

If you allow these counts, Google receives ordinary connection and device information and uses a pseudonymous Analytics cookie identifier. The cookies use the brp_ga prefix and last at most 30 days. Use Turn optional counts off in Cookie preferences to stop further collection and clear this integration's cookies on this browser. A small rejection-preference cookie can preserve that choice if browser storage is unavailable. Revoking consent does not erase information already received by Google. An earlier choice to allow page counts alone does not enable link-click counts; we ask for a fresh choice.

Microsoft Clarity session recording is unavailable. No Clarity script, recording or cookies are enabled. Audience eligibility and recording privacy checks must be resolved before any separate recording feature can be offered.