Privacy Policy

Please read this part.

Private messages on this site are private from other members, but they are
not private from the site owner. An account holding the owner-level
oversight permission can read any conversation, and participants are not
notified when this happens.

This exists so the community can act on harassment and on serious rule-breaking
that happens out of public view. It is limited in three ways:

• Only owner-tier accounts have it — no admin or moderator role can.
• Every single access is written to the audit log at critical severity,
  recording who looked, at which conversation, and when. That record cannot be
  suppressed from within the oversight screen.
• The oversight code cannot write anything: no read receipts, no membership
  changes, no notifications.

We would rather tell you plainly than let you assume otherwise. If a
conversation genuinely needs to be private from everyone, have it somewhere
else.

To run the site: showing your profile, delivering messages, moderating content,
and keeping accounts secure.

We do not sell your data. There is no advertising on this site, no
analytics or tracking scripts, and no third-party profiling.

Email is sent through Resend, and only for things you'd expect: verification,
password resets, and notifications you've opted into.

One cookie, for your login session. It is signed, HTTP-only, and marked
secure. There are no advertising or analytics cookies, so there is nothing to
opt out of.

Registration and application forms are protected against automated abuse. When
the challenge widget is enabled, Cloudflare receives your IP address and
browser information to assess whether the submission is automated. Cloudflare's
own privacy policy applies to that check.

Site data is stored in MongoDB and uploaded files in MinIO, both hosted on
Railway. Access is restricted to the site itself and to owner-level staff.

If this policy changes in a way that matters — especially anything about who can
read what — we'll say so in a community update rather than quietly editing this
page.

We log page visits, and you should know exactly what that means.

Every page request to this site is recorded with your IP address, your browser
user-agent, the page you asked for, the page you came from, and the time. If
you are signed in, your account is recorded alongside it. This happens whether
or not you have an account.

Your IP address is also resolved to an approximate location — country, region,
city, and internet provider — using MaxMind's GeoLite2 location database, which
is kept on TKZ's own servers, so the address isn't sent anywhere to be looked
up. If that database isn't available, the address is sent instead to a
third-party geolocation service, ip-api.com, by itself: no account, gamertag,
email or page history goes with it. Either way this happens automatically the
first time we see an address, and the answer is stored here, so a returning
visitor is never looked up again.

This exists so the community can see brute-force attempts, ban evasion, and bot
traffic for what they are. An owner can also open one member's history: every
address that account has used, the devices it has used them from, the pages it
visited, and which other accounts have appeared on the same addresses.

We keep this indefinitely. An earlier version of this page said these
records were deleted after 90 days. That is no longer true and we would rather
say so than leave a comfortable sentence standing: ban evasion, returning bad
actors and alt accounts are patterns that only appear over years, and a log that
forgets is a log that can't show them. The honest trade is that data we hold is
data that could one day leak.

Two limits stay, and both are enforced in code rather than by policy:

• Only owner-tier accounts can read any of it. No admin or moderator role can
  be granted this permission, even by an owner.
• Every time it is opened — the whole log, or your history specifically — that
  is itself written to the audit log at critical severity, naming who looked.
  The people who can watch you are on the record for doing it.

Aggregate statistics — how many people registered this month, how much traffic
the site saw — are kept separately and contain no addresses, locations, or
individual histories. Staff can be given access to those numbers without being
given access to you.

This log is never sold, never shared, and never used for advertising or
analytics. Nothing about it feeds a profile of you anywhere outside TKZ.