Privacy Policy

This policy says what Statewide stores about you, why, and who else sees it. It covers statewide.gg, app.statewide.gg, api.statewide.gg, the Discord bot and community sites served by Statewide.

What we store

When you sign in we keep:

• Your Discord account: your Discord ID, username, display name and avatar, and the sign-in tokens Discord gives us, stored encrypted.
• Your email address, whether it is verified, and a password hash if you sign in with email and password.
• Your sessions: the IP address and browser user agent each session started from, and when it expires. Sessions are extended while you use them and expire after 30 days of inactivity.
• Rate-limit entries: short-lived counters keyed by IP address that slow down repeated sign-in attempts and similar requests. They are kept only for the length of their window.
• Audit rows: a record of changes you make inside a community (what changed, when, and the IP address it came from), which that community's owner can read.
• What you add to a community: your memberships, roles, applications, characters, roleplay records and anything else you enter. The community's staff see it as their permissions allow.

Cookies

Every cookie we set is needed for Statewide to work:

• Session cookie: keeps you signed in. Each host you sign in on gets its own, including a community's own domain after you sign in there.
• Sign-in state cookies: short-lived cookies that tie a sign-in step to your browser: the hand-off between statewide.gg, the app and a community's own domain, and the Discord sign-in and bot-install steps. They expire within 10 minutes.
• Preference cookies: statewide-theme remembers whether you chose the dark, light or system theme, and sidebar_state remembers whether you collapsed the admin sidebar.

We do not use advertising or tracking cookies, and we do not sell your data.

Why we use it

To sign you in and keep you signed in, to show you the communities you belong to, to let community staff manage their members, to keep an audit trail communities and moderators can rely on, to stop abuse, and to send you account email.

Who else sees it

• Communities you join see your Discord username, display name and avatar, and what you enter in that community.
• Discord handles your sign-in, and the Statewide bot reads and updates your roles and nickname in a community's Discord server when that community turns it on.
• Resend sends our account email (verification and password reset) on our behalf, and receives your email address to do so.
• Platform moderators at Statewide Software can read community data when they investigate a report or a security issue; every such read is recorded in that community's audit log.

How long we keep it

Account data stays while you have an account. Sessions end when you sign out, or expire after 30 days of inactivity, and are removed afterwards. Rate-limit entries are kept only briefly. Audit rows are kept for as long as the community exists, because they are its record of what happened.

Your choices

You can sign out of every session from your account page, leave any community, and ask a community's staff to remove what you entered there. To ask for a copy of your data, or to have your account deleted, email legal@statewide.gg from the address on your account.

Children

Statewide is not for children under 13. If you believe a child under 13 has an account, email legal@statewide.gg and we will remove it.

Changes

If we change what we store or who sees it, we update this page and the date at the top before the change takes effect.