How we handle your data

1. Data we collect

Account data (Discord sign-in)

Verse Island uses Discord as its sign-in provider. When you sign in, Discord asks for your consent and shares with us (OAuth scopes identify, guilds.members.read, guilds.join): your Discord account ID, username, display name, and avatar; your membership and roles in our Discord server (used to determine your access tier); and your email address only if you choose to share it. We never see or store your Discord password. Discord's own privacy policy governs Discord's handling of your data.

Data you create here

Lesson and quiz progress, saved lesson plans, bookmarks, votes, comments, community contributions, your credits ledger, API-key metadata (never the secret in recoverable form), an uploaded avatar, and a referral code if you use one. We collect no payment card details — Verse Island has no on-site payment processing.

Usage analytics (cookieless, no personal profile)

Our self-hosted analytics records the page path (query strings stripped, identifiers normalized), request method/status/duration, your country (from Cloudflare's edge header — not your IP), and the referring site's hostname. Unique visitors are counted with a salted hash whose salt is destroyed every day — it cannot be reversed or linked across days. Your raw IP address is never stored in analytics. Analytics records are deleted on a rolling ~35-day basis. We also view aggregate edge statistics from Cloudflare.

Cookies & browser storage

One strictly-necessary session cookie keeps you signed in; Cloudflare may set its own security cookies. Your browser's localStorage holds some data on your device (generated lesson plans, progress caches, interface preferences) — it stays in your browser unless a feature you use expressly sends it (e.g. requesting a rendered video of your plan). We run no advertising cookies and no third-party analytics trackers, which is why there is no cookie-consent banner.

Server & security logs

Our infrastructure keeps short-lived technical logs (including IP addresses) for security, abuse-prevention, and debugging — separate from analytics, access-restricted, routinely rotated.

2. TikTok Data Handling

Verse Island offers an optional integration with the TikTok Content Posting API that can upload or publish short-form videos to a connected TikTok account. This section applies only when a TikTok account is connected — the integration is off and collects nothing otherwise.

Authorization. Connecting happens on TikTok's own consent screen via OAuth: you explicitly authorize each connection and TikTok shows you the exact permissions before you approve. We never see or store your TikTok password. We request the scopes video.upload (upload a video to the connected account's TikTok inbox/drafts, where the account holder reviews and publishes it inside TikTok) and video.publish (publish a video directly to the connected account's profile, and query the creator's posting settings).

TikTok data we access. Only: the connected account's basic creator information from TikTok's Creator Info endpoint (display name, username, avatar, available privacy-level options, duet/stitch/comment settings, maximum video duration) — which TikTok requires us to show you before every post; OAuth tokens (access + refresh) for the authorization you granted; and the identifiers and status of the posts this integration itself creates. We do not access your followers, messages, watch history, likes, analytics, or any other content on your TikTok account.

What we do with it. One purpose only: transmitting videos created or approved on Verse Island to the TikTok account that authorized us, with the caption, privacy level, and interaction settings chosen at posting time. Before any direct post we display the privacy selector and duet/stitch/comment options TikTok returns for your account, plus a branded-content disclosure where applicable. We do not use TikTok data for advertising, profiling, or AI/ML training, and we never sell or share TikTok user data. Our handling complies with TikTok's Developer Terms of Service, Developer Guidelines, and Data Sharing Agreement.

Storage & security. TikTok OAuth tokens are stored only on our internal, non-public backend server — never on the public-facing web server, never in client-side code, never in our source repositories.

Retention & revocation. Tokens are kept only while the connection is active; on disconnection we delete them promptly (within 30 days at most), and refresh tokens expire on TikTok's schedule (~365 days) if not renewed. Creator info is fetched fresh when needed and not retained beyond operational caching. You can revoke access at any time: disconnect on Verse Island, revoke inside TikTok (Settings and privacy → Security → Apps and websites), or email [email protected]. Revoking on TikTok's side immediately invalidates our tokens.

3. How we use data

Only to: run your account (sign-in, sessions, access tier from Discord roles); provide features (progress, saved plans, credits, attributed contributions); publish content you direct us to publish (Section 2); keep the service working and safe (aggregate traffic measurement, abuse prevention, security); and respond to you. Where GDPR applies, our legal bases are performance of a contract, legitimate interests (security, abuse prevention, cookieless analytics), and consent (the TikTok connection, optional email sharing) — withdrawable at any time. We do not use your personal data for advertising, do not sell it, and do not use members' personal data to train AI/ML models. (Community content you choose to publish is licensed under the contribution licence shown at submission and on Sources & Licensing.)

4. How we share data

Only with the services needed to operate Verse Island: Discord (our authentication provider — the OAuth sign-in exchange); TikTok (videos, captions, and post settings you direct us to post — only when connected, Section 2); Cloudflare (CDN, TLS, and security proxy our traffic passes through); and our own hosting infrastructure (we self-host on servers we control). No data brokers, no ad networks, no third-party analytics companies. We may disclose data if legally compelled, and would tell you unless legally barred.

5. Security

All traffic is encrypted in transit (TLS). Sensitive credentials — including TikTok and other social tokens — live only on internal servers not exposed to the public internet; the public web server holds no social-platform tokens at all. Analytics hashes are salted with a key destroyed daily. Production access is limited to Biloxi Studios operators. No internet service can promise perfect security; if we discover a breach affecting your personal data, we will notify affected users and any required regulators without undue delay.

6. Data retention

• Account, profile, progress, plans, credits: until you delete your account.
• Published contributions: retained under the contribution licence; anonymised on account deletion (or attributed, at your request).
• Cookieless analytics: ~35 days, rolling.
• Server/security logs: short-lived, routinely rotated.
• TikTok OAuth tokens: until disconnection/revocation (deleted within 30 days) or token expiry.
• Erasure audit record: retained — it records only that an erasure happened, with no profile data.

7. Your rights & controls

Self-service (fastest): signed-in members can export a complete portable copy of everything we hold about them and permanently delete their account and personal data from the Privacy & Data controls on your account page. By email: [email protected].

Depending on where you live, you may: access/know, correct, delete, and export your data (GDPR Arts. 15–17, 20; CCPA rights to know, correct, delete); restrict or object to legitimate-interest processing (GDPR Arts. 18, 21); withdraw consent at any time (e.g. the TikTok connection); opt out of sale or sharing (CCPA/CPRA — we do not sell or share personal data as those laws define, so there is nothing to opt out of); exercise rights without discrimination; and complain to your supervisory authority (GDPR). We answer verified requests within 30 days (GDPR) / 45 days (CCPA), verifying through the account itself or the contact channel on record.

8. Children

Verse Island is not directed to children under 13 and we do not knowingly collect personal data from them. Signing in requires a Discord account (Discord requires users to be at least 13, older in some countries); connecting TikTok additionally requires meeting TikTok's own minimum-age requirements. If you believe a child under 13 has provided us personal data, email [email protected] and we will delete it.

9. International transfers · 10. Changes

Our servers are in the United States; if you use Verse Island from elsewhere (including the EU/EEA and UK), your data is transferred to and processed in the U.S. Where GDPR applies we rely on appropriate safeguards, including standard contractual clauses with our providers where applicable. Changes to this policy are posted here with an updated date; material changes get advance notice on the site (or by email where we have one). Earlier versions are available on request.