Plysken PZ Hub

Who is responsible

The publisher of the site (see the legal notice), reachable at contact@plysken.com.

Without an account

You can browse everything without an account, and without one the site is read-only: it then keeps nothing about you, except the keyed fingerprint of your address if you try to sign in (security journal, 180 days).

Mod creators and server admins, even without an account here

The catalogue takes, from Steam's Workshop API, what Steam publishes about each mod: its title, its description and its creator's SteamID. The page of a mod leads to a page listing that creator's mods; their Steam name is read from Steam when shown, never kept. A page removed from Steam stays, marked as removed.

The server list comes from Steam's public list (address, name) and from what each server publishes itself (its description and rules); never the name of a connected player. A server the collection no longer sees for 30 days is erased, unless someone follows it on the site (claim, favorite, vote, Premium watch, featured days).

Why: our legitimate interest in keeping a catalogue of mods and a directory of public servers (GDPR, article 6.1.f). You can object or ask for a correction at contact@plysken.com.

With an account (Steam sign-in)

Steam confirms who you are: no password goes through this site. The site keeps your SteamID, your Steam name as it is displayed, the date the account was created, the date of your last sign-in and the date you accepted the terms of use. No real name and no country, even when your Steam profile shows them.

One session per signed-in browser: a random identifier, valid for 30 days.

What you do with your account: the servers you claim (the code and the date of each step), your Top servers votes (the server and the time), the links of your public profile, your theme and language if you choose them, and your role (member or moderator). To claim a server you send its log: the site keeps its mod list, tied to the server, never the file. A server page you fill in (description, game settings, links) is tied to the server, and your account is noted as its last author.

A compatibility review (it needs an account): the two mods, the verdict, the game version, the context, your sentence, its date, and, if you give one, the list of one of your logs as proof. It is public only once a person has checked it; who published or refused it, and when, is kept.

A bug you report (it needs an account): the mod, the game version, the context, your text, its date and, if you give one, the list of one of your logs; who published, refused or marked it fixed, and when. An “I have the same bug” keeps your account and the date. If you are a mod's author and give a Discord webhook, it is kept encrypted, with the name Discord gives it, and used to tell you of a new bug on your mods and, if you subscribe, to send you the Premium alerts you kept.

A review of a server (it needs an account): the server, your rating, your text, the month you state, its dates and, if you give one, the list of one of your logs tied to this server; if it is removed, the date, the reason and who removed it. It is shown without your name; the site's owner and moderators see who wrote it. If you are a server's verified admin: your reply under a review and its date, and your flags (the reason, the date, and who handled them). A flag tells the site's owner on Discord, with nothing from the review or about you.

Your votes and the admin API: the verified admin of a server you vote for can read, through the site's API, whether your SteamID voted within the last 24 hours and at what time, and claim that vote to give you an in-game reward (the date of the claim is kept with your vote); they can also read the ranking of their voters of this month and of the previous one (your Steam name, your SteamID, your number of votes). This is our legitimate interest and theirs (GDPR, article 6.1.f). You can object to the ranking at any time, in “Account and data”: you leave it at once (article 21). If you are that admin: your API key is kept as a fingerprint, never in clear, with the date it was created and last used; revoked or replaced, it is erased.

A log you send (it needs an account): the site keeps its mod lists, the game version, the context written in the log, its size, the time the game last wrote it (it places the log against the mod's updates), a fingerprint of the file (so it is not counted twice), the errors and warnings it carries cut down to their signature and their message (short extracts, 200 characters at most, without your home folder, SteamIDs or IP addresses) and the mods they name, and your account as its sender — that is what counts one declaration per account. Public, as soon as it is sent: each error tied to a mod, with its message, its severity (error or warning), its context (solo or multiplayer), the game version, the number of accounts that declared it and the days of the first and the last declaration — never who sent it. It does not keep the file. Deleting your account removes your name from the log; its lists stay, its errors no longer count.

Premium (the subscription)

When you order: the e-mail address you give (used for the confirmation and the acknowledgements of receipt, nothing else), the version of the sales terms you accepted, and whether you asked for your Premium to start right away. Then: the state of your subscription and its dates, read at PayPal, and each payment received (amount, date, PayPal reference, the payer's name as PayPal gives it).

If you cancel or withdraw: the name and e-mail address you declare, the subscription reference, the date and time, and the amount refunded.

Premium for life, which only the site's owner gives (no subscription, no payment): your SteamID, the date it was given and the SteamID of who gave it. It goes when it is taken back or when you delete your account.

How long: payments and refunds are kept 10 years (accounting and tax obligation); what you declare when you cancel or withdraw, 5 years (proof, in case of a dispute). They stay after your account is deleted, detached from it, and serve only for the accounts or a dispute. The “why”, if you chose to write it, is read by the site's owner only, on the register of receipts, to improve the site; it is kept with your step and erased with your account.

Payment goes through PayPal: the site sees neither your card nor your PayPal account.

With Premium: your favorite servers, your alert choices and the record of the alerts sent (so the same one is never sent twice), and your choice for the “Supporter” badge. If you tick it, the badge makes public, on your profile and on your server's page, that you subscribe.

Featuring (buying days)

With the order: the e-mail address you give (for the confirmation and the acknowledgements, nothing else), the version of the terms of sale accepted, whether you asked for the feature to start before the end of the withdrawal period, the server and the days chosen. Then: the payment received through PayPal (its reference, amount, date and the payer's name as PayPal gives it).

If you offer days to a server you are not the admin of, your Steam name is shown publicly in the box on those days, after “offered by”: the law asks that an advertisement make identifiable the person on whose behalf it is made (French LCEN, article 20); here, the site names the person who offered it.

If you withdraw: the name and e-mail address you declare, the purchase's reference, the date and time, the days removed and the amount refunded.

How long: payments and refunds are kept 10 years (accounting and tax duty); what you declare when withdrawing, 5 years (the proof, in case of dispute). They stay after your account is deleted, detached from it; the order's e-mail address goes with the account.

What leaves our server

To Steam: your SteamID, to read your name. To PayPal: your SteamID as the reference of your subscription; PayPal gives us back the payer's name. To Discord: to a webhook you gave; and, with nothing that names you, to a mod author's (the errors of their mods) or the site owner's (the security alert). To the verified admin of a server you vote for: what the paragraph on votes says, above. To a mod's author, if they subscribe: the errors of their mods found in your log, without your name, even when only one account saw them.

The security journal

Every write (sign-in, vote, claim, log upload, profile link…) leaves one line: the action, the answer given, and a keyed fingerprint (HMAC) of your session or of your IP address. Never the address itself, never your SteamID. These lines are deleted after 180 days.

The site's owner reads this journal on a page of his own; a suspicious burst may be reported to him in a private Discord channel: the alert carries the keyed fingerprint, the route and a count, never your address nor your identity. The site blocks nobody on that basis.

The limits against abuse count requests in memory: these counters are never written.

Why (legal bases)

The account and what you do with it serve to provide the service you ask for (GDPR, article 6.1.b). The security journal and the limits protect the site against abuse: this is our legitimate interest (article 6.1.f). Premium serves to perform the contract you enter into (article 6.1.b); the payments kept after the account is deleted meet accounting obligations (article 6.1.c).

How long

As long as your account exists. “Delete my account”, in “Account and data”, immediately removes the account, its sessions, its claims, its votes, its links, its preferences, its compatibility reviews, its reported bugs, its “same bug” marks, its reviews of servers, its review flags, its webhook and its Premium for life; its admin replies under reviews are erased (the review answered stays: it belongs to someone else). A server page you filled in and the mod list of its log stay tied to the server, without your name; the page is shown only while a verified admin claims that server; a decision you made on a review stays, without your name. The security journal keeps its own 180-day period. A running Premium subscription must be cancelled before the account is deleted; its payments, cancellations and withdrawals then stay, for the accounts and as proof of your steps: 10 years for payments and refunds, 5 years for cancellations and withdrawals. The base's backups keep a copy of what it held when they were made: each one is erased after 30 days. If one of them has to be restored, the accounts erased since are erased again: for that, the site keeps a keyed fingerprint of an erased account's SteamID for 31 days, never the SteamID itself.

Where, and who has access

The data are kept in France, on the servers of the host OVH SAS, which processes them on our behalf. They are not sold; they go only to the recipients named on this page.

Your browser talks directly to Steam (Valve) when you sign in, and when it loads mod thumbnails, which Steam serves: Steam sees these requests. The link to our Discord opens a third-party site.

Your rights

You can ask for access to your data, their correction, deletion, restriction or portability, and object to a processing: write to contact@plysken.com. You can also delete your account yourself. If you think your rights are not respected, you can complain to the CNIL, the French data protection authority (cnil.fr).