Privacy Policy

Last updated: June 30th 2026

This page explains what information The Keanan Demon List ("we", "the site") collects, why, and how it's handled.

1. Account Information

When you register an account, we collect:

• Username and email address (used for login and account verification)
• Password — stored as a one-way cryptographic hash. We never store or have access to your actual password.
• A verification code sent to your email to confirm it's really you. This code expires after 15 minutes and is deleted once used.

If you reset your password, the same email-verification process applies, and old reset codes expire after 15 minutes.

2. Profile Information (Optional)

You may choose to add the following to your public profile:

• Profile picture and banner image
• A short bio
• Social media links
• A custom username (changeable)

This information is visible to anyone who views your profile and is entirely optional.

3. Level & Record Submissions

If you submit a level or a completion record, we store:

• The level name, difficulty, gamemode, and related metadata you provide
• A YouTube/video link, attempt count, and enjoyment rating, if provided
• An optional uploaded .gmd level file, if you choose to upload one instead of providing a level ID

This data is used to review and (if accepted) publish your submission to the relevant list.

4. Sessions & Cookies

We use a single cookie (sid) to keep you logged in. This cookie:

• Is marked HttpOnly (inaccessible to page scripts) and SameSite=Lax
• Expires automatically after 7 days of inactivity, or immediately when you log out
• Contains only an internal session identifier — no personal data is stored in the cookie itself

We do not use third-party advertising or tracking cookies.

5. Security Logging

To help keep the site secure and prevent abuse, we automatically record basic technical information when you visit, including the time of your visit, the page or feature you accessed, and a one-way anonymized identifier generated from your connection. This identifier cannot be reversed to reveal your original connection details under normal circumstances, and is used only to detect unusual or abusive activity (for example, an unusually high number of requests in a short time). We do not use this data for tracking, advertising, or profiling.

Raw logs are periodically compressed and rotated, and are not shared with third parties except as described in this policy.

6. Payments & Premium Access (Ko-fi)

If you purchase premium access or support the site via Ko-fi:

• Ko-fi (a third-party payment processor) handles your actual payment details — we never see or store your card/payment information.
• We receive your email address and, if you choose to link it, your Discord user ID, in order to deliver an activation key and/or assign a Discord role.
• This information is used solely to fulfill your purchase and is not shared beyond what's needed for that (e.g. assigning a Discord role via the Discord API).

7. Email Communications

We use a third-party email service to send:

• Account verification codes
• Password reset codes
• Notifications about your submitted records (e.g. acceptance)
• Premium activation keys, if purchased

We do not send marketing emails, and your email address is never shared with or sold to other third parties.

8. Anti-Spam Protection

We use Cloudflare Turnstile, a privacy-focused CAPTCHA alternative, to verify you're human during registration and login. Cloudflare may process limited technical data as part of this check, governed by Cloudflare's own privacy policy.

9. Admin-Visible Information

Site administrators and list moderators may have access to additional account details (such as your submission history) strictly for moderation purposes — for example, reviewing submissions, handling support requests, or addressing rule violations. Administrators may also record internal moderation notes about an account; these are not visible to other users.

10. Data Retention & Deletion

You can delete your own account at any time from your account settings, which removes your account record and any uploaded profile images. Submitted levels/records that have already been published to a public list may be retained for list integrity, but will no longer be linked to your personal account information beyond what's already publicly displayed (e.g. your username, if credited).

11. Your Rights

Depending on your location, you may have rights to access, correct, or request deletion of your personal data. To exercise these rights, contact us at [email protected].

12. Changes to This Policy

We may update this policy occasionally. Significant changes will be noted with an updated "Last updated" date at the top of this page.

13. Contact

Questions about this policy? Reach out at [email protected].