topspawn.

Privacy Policy

Last updated: October 11, 2026

1. Data Controller

The data controller for personal data collected on the topspawn.com website is TOPSPAWN.

DPO contact: contact@topspawn.com

2. Data Collected

In the course of operating the service, we collect the following data:

  • Account data: email address, username, password (hashed); when signing in with Google or Discord: identifier, email address and avatar provided by the provider
  • Profile data: profile picture (optional)
  • Server data: name, IP/domain, description, images, tags
  • Technical data: hashed IP address and user agent at the time of a vote (anti-abuse), sign-in history (hashed IP, browser, OS), recognised devices (browser + OS fingerprint, hashed and salted)
  • Contact data: name, email, message (via the contact form)

3. Purposes of Processing

Your data is processed for the following purposes:

  • User account management and authentication
  • Directory operation (server publication and display)
  • Voting system (one vote per IP every 2 hours to prevent abuse)
  • Anti-spam and abuse prevention (Cloudflare Turnstile, rate limiting)
  • Responding to contact requests
  • Audience analytics (with consent)

4. Legal Basis

  • Contract performance: account management, server publication
  • Legitimate interest: website security, anti-spam, vote fraud prevention
  • Consent: audience measurement cookies (Google Analytics) and advertising measurement cookies (OpenAI pixel), each subject to a separate consent

5. Retention Periods

  • Account data: retained for as long as the account is active; upon a deletion request the profile is anonymised at once (username, avatar, game nicknames, preferences, Stripe link) and the account is permanently deleted 30 days later
  • Vote IP addresses and user agent: anonymised 30 days after the vote (the vote itself stays counted, without personal data)
  • Contact messages: retained for a maximum of 12 months
  • Recognised devices: deleted 30 days after their last use (new sign-in alert, trusted 2FA device)
  • Technical logs: sign-in history 30 days; notifications 90 days; administration action log 12 months
  • Invoices and payments: kept by Stripe for 10 years (accounting obligation), unlinked from the account once it is deleted

6. Cookies and Trackers

The website uses the following cookies and trackers:

  • Essential cookies: authentication session (“sb-…” cookies, Supabase Auth, session lifetime), language (NEXT_LOCALE, session), session expiry (ts_session_start, 30 days), trusted 2FA device (ts_mfa_trust, 30 days, only if you tick “remember this device”), password reset (ts_recovery, 15 minutes), consent choices (topspawn-consent and topspawn-consent-ads, 13 months), anti-spam protection (Cloudflare Turnstile). These cookies are necessary for the website to function and do not require consent.
  • Analytics cookies: Google Analytics 4 (GA4), enabled only with your consent. These cookies allow pseudonymized measurement of website traffic (random browser identifier).
  • Audience measurement: We use Vercel Web Analytics to measure site traffic anonymously (page views, country, device type, referring site). This tool sets no cookies and collects no data that can identify you. Member area and admin pages are not measured. Vercel Speed Insights likewise measures, without cookies or personal data, the display performance (Core Web Vitals) of every page; only the page pattern is sent, never the full address.
  • Advertising measurement: OpenAI measurement pixel and Google Ads (through Google Analytics), enabled only with your specific consent, separate from the audience measurement one; for Google, audience measurement must also be accepted. They tell us whether a TOPSPAWN ad led to a sign-up, a server being added or a Boost purchase; the related data is sent to OpenAI and Google. Ad personalization stays refused. Details are in the cookie policy.

You may manage your cookie preferences at any time via the consent banner or your browser settings.

7. Hosting and Sub-processors

Your data is hosted by:

  • Vercel Inc. — website hosting (United States, compliant with EU standard contractual clauses)
  • Supabase Inc. — database, authentication and storage (servers in the European Union)
  • Upstash — Redis cache for rate limiting (European Union)
  • Cloudflare — anti-spam protection via Turnstile
  • Stripe Inc. — payment processing (Boost). Stripe is responsible for processing your banking data in accordance with its own privacy policy; invoices are kept by Stripe for 10 years (accounting obligation), even after the account is deleted.
  • Resend — sending transactional emails (sign-up confirmation, password reset, welcome, sign-in alert, contact form, notifications about servers, events and payments) — United States, compliant with EU standard contractual clauses. Data processed: email address and message content.
  • proxycheck.io — VPN/proxy check of the IP address at the time of a vote (United Kingdom, EU adequacy decision); TOPSPAWN only keeps a hash of it, for 30 days at most
  • BattleMetrics and mcsrvstat.us — game server status queries (server IP address and port, no member data)
  • Google and Discord — identity providers if you choose to sign in with these services (identifier, email, avatar)

8. Your Rights (GDPR)

In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

  • Right of access: obtain a copy of your personal data
  • Right of rectification: correct inaccurate or incomplete data
  • Right of erasure: request deletion of your data and account
  • Right to data portability: receive your data in a structured, machine-readable format
  • Right to object: object to the processing of your data on legitimate grounds
  • Right to restriction: request restriction of the processing of your data

To exercise these rights, please contact us at contact@topspawn.com. We will respond within 30 days.

You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés — French data protection authority).

9. Security

We implement appropriate security measures to protect your data:

  • HTTPS encryption across the entire website
  • Passwords hashed using secure algorithms (bcrypt)
  • Authentication via secure JWT tokens
  • Protection against CSRF and XSS attacks
  • Rate limiting to prevent abuse

10. Amendments

We reserve the right to amend this privacy policy at any time. Any material changes will be communicated via a notice on the website. The last updated date is shown at the top of this page.

11. Contact

For any questions regarding the protection of your personal data, please contact our DPO at contact@topspawn.com.