Privacy Policy

Transparent data practices for the UnionCrax ecosystem. We only collect what we need to run the site, keep accounts secure, and power the community surfaces you opt into.

What we collect

Account identity: user ID, username, display name, avatar, bio, and any linked Discord ID, Google ID, or email address you sign in with.

Authentication state: hashed password (only if you registered with email), session tokens and expiry, and pending-link tokens used during OAuth linking flows.

Community content: comments, forum topics and posts, votes, likes/dislikes, reports, replies, mentions, and the timestamps for each.

Library and activity: wishlist, favorites, collections (including shared collection tokens), view history, and download history.

Notifications: in-app notification records and, if you subscribe, Web Push endpoints (browser-specific keys used to deliver pushes).

Hardware and playtime (via UC.Direct, opt-in): system specs, device fingerprints, and playtime sessions uploaded by the desktop client.

Requests: request type, note, link, status, resolver activity, and request IP — used to resolve country/city for moderation.

Moderation and abuse metadata: rate-limit counters, auth-attempt logs, and audit records of staff actions.

UC Plus / billing references: subscription status flags and external billing identifiers (we do not store card numbers).

User-uploaded media: avatars, profile images, and attachments on comments or forum posts.

Why we collect it

Every category above maps to a feature you can see in the product:

Authenticating sessions across Discord OAuth, Google OAuth, and email/password sign-in — including link/unlink between providers on a single account.
Running personal features: library, wishlist, favorites, collections, view and search history, profile preferences, and UI settings.
Powering community surfaces: comments, forums, blog comments, profile pages, leaderboards, and moderation tooling.
Delivering notifications (in-app and, if subscribed, Web Push for replies, mentions, follows, and moderation events).
Processing requests end-to-end and showing public and personal request status views.
Driving hardware/playtime features (sysreq match, leaderboards, profile cards) when you opt in via UC.Direct.
Enforcing anti-abuse protections: rate limiting, auth-attempt tracking, report handling, and staff audit logs.
Sending transactional email (account verification, password reset) when email is configured.

Cookies, Storage & Retention

uc_session: HTTP-only authentication cookie, rotated and expiring after up to 30 days of inactivity. Cleared on logout.
discord_id: browser-readable helper cookie (legacy convenience for Discord-linked accounts) — used only as a UX hint, never as a proof of authentication. Cleared on logout.
uc_pending_link / uc_pending_discord_link: short-lived cookies set during OAuth linking flows; deleted as soon as the link is confirmed.
unioncrax_history: optional browser cookie for recent searches and viewed/downloaded items, up to 365 days. Can be cleared from Settings.
localStorage: client-side preferences (NSFW display, profile visibility, navbar mode, theme, cookie consent, etc.). Stays in your browser until you clear it.
Account-level records (profile, library, history, comments, posts) persist until you ask us to delete them or the account is removed. Some surfaces hide older states automatically: personal completed/declined requests for 7 days, public completed/declined feed items for 24 hours.
Hardware/playtime data uploaded by UC.Direct is deleted when you turn the public profile tier off and delete the device entry, or when the account is deleted.

Third Parties

Discord OAuth — sign-in, account linking, and avatar/username sync.
Google OAuth — sign-in and account linking.
Resend — transactional email (verification, password reset) when email is configured.
ip-api.com — country/city lookup from a request's IP address (used for moderation context on submissions only).
Cloudflare — CDN, anti-bot, and traffic security for this site.
Steam, IGDB, ProtonDB, SteamGridDB — read-only game metadata, images, and compatibility data. We do not share your personal data with them.
External file hosts (e.g. Pixeldrain, VikingFile) — used to surface downloads. They receive only what is needed to fetch the file you requested.
Web Push providers (your browser's push service) — receive your subscription endpoint so we can deliver notifications you opt into.
We do not sell personal data, and we do not run third-party advertising trackers.

Public Profile

When you turn on Public profile (in UC.Direct or your account settings), you grant UnionCrax permission to use the data attached to that profile — including your username, avatar, hardware specs, playtime, and other public activity — for any purpose across the entire UC Ecosystem. That includes leaderboards, public profile pages, community surfaces, comments, forums, promotional and marketing material, analytics, and any other UC product or feature, existing or future.

Opt out at any time by turning Public profile off. From that point forward, your profile data will no longer be surfaced on public UC properties. Content already published with a snapshot at post time (e.g. specs attached to a comment) is preserved per the snapshot model used by the community surfaces.

UC.Direct & Hardware

The UC.Direct desktop client can scan your PC's specs and capture playtime for games you launch through it. Nothing is uploaded by default — uploads only start once you sign in and toggle a visibility tier (comments, forums, or public profile). The active spec lives on our servers as a single row per user; multi-rig history is stored separately so you can switch active devices. Each comment or forum post that displays specs is pinned to an immutable snapshot taken at post time, so re-scanning won't rewrite older posts.

Removing a device or setting all visibility tiers to "off" stops new aggregation immediately.

Notifications & Push

In-app notifications are generated for replies, mentions, follows, moderation outcomes, and similar events. If you enable Web Push, your browser provides a unique subscription endpoint (handled by Google, Mozilla, Apple, or your browser vendor) that we store so we can deliver pushes. You can revoke it any time by disabling notifications in the site or in your browser's site settings — the endpoint becomes unusable as soon as you do.

Your Controls

Session Control

Log out from any device to revoke the uc_session cookie. You can also revoke individual sessions from your account.

Linked Accounts

Link or unlink Discord, Google, and email/password sign-in independently. Unlinking removes the provider ID from your account.

History & Preferences

Clear browser history and preferences from Settings, and clear server-side search history from your account.

Public Profile & Hardware

Toggle visibility tiers in UC.Direct or your account settings. Turn them all off to stop appearing on public surfaces.

Notifications

Manage in-app and Web Push notifications from notification settings, or disable site permissions in your browser.

Data Export & Deletion

For an export or deletion of your account-level data, contact us directly. Deletion removes your profile, library, history, hardware/playtime data, and notification subscriptions.

Moderation Visibility

Reports you file and staff actions on your content are visible to UC staff for audit purposes. We do not share that audit log publicly.

Children

UnionCrax is not directed at children under 13. If you believe a child has provided personal data, contact us and we will remove it.