How we handle your data

1. Data we collect

Account data (Discord sign-in)

Verse Island uses Discord as its sign-in provider. When you sign in, Discord asks for your consent and shares with us (OAuth scopes identify, guilds.members.read, guilds.join): your Discord account ID, username, display name, and avatar; your membership and roles in our Discord server (used to determine your access tier); and your email address only if you choose to share it. We never see or store your Discord password. Discord's own privacy policy governs Discord's handling of your data.

Data you create here

Lesson and quiz progress, saved lesson plans, bookmarks, votes, comments, community contributions, your credits ledger, API-key metadata (never the secret in recoverable form), an uploaded avatar, and a referral code if you use one. We collect no payment card details — Verse Island has no on-site payment processing.

Usage analytics (cookieless, no personal profile)

Our self-hosted analytics records the page path (query strings stripped, identifiers normalized), request method/status/duration, your country (from Cloudflare's edge header — not your IP), and the referring site's hostname. Unique visitors are counted with a salted hash whose salt is destroyed every day — it cannot be reversed or linked across days. Your raw IP address is never stored in analytics. Analytics records are deleted on a rolling ~35-day basis. We also view aggregate edge statistics from Cloudflare.

Cookies & browser storage

One strictly-necessary session cookie keeps you signed in; Cloudflare may set its own security cookies. Your browser's localStorage holds some data on your device (generated lesson plans, progress caches, interface preferences) — it stays in your browser unless a feature you use expressly sends it (e.g. requesting a rendered video of your plan). We run no advertising cookies and no third-party analytics trackers, which is why there is no cookie-consent banner.

Server & security logs

Our infrastructure keeps short-lived technical logs (including IP addresses) for security, abuse-prevention, and debugging — separate from analytics, access-restricted, routinely rotated.

1.6 Embedded videos (YouTube)

Some pages — including our video-companion guides — embed a YouTube player so you can watch a creator's tutorial without leaving the page. Embedded videos stay on YouTube; we never host or re-upload them.

• We use YouTube's privacy-enhanced embed (youtube-nocookie.com), which is designed not to store advertising cookies before you press play.
• When a page shows an embed, your browser loads the player directly from YouTube's servers, which means YouTube (Google) receives standard technical data such as your IP address. When you press play, YouTube also processes your viewing of that video. All of this is governed by Google's privacy policy, not ours.
• We do not receive your viewing data. Playback happens between your browser and YouTube; we never see what you watched, paused, or skipped.

If you prefer YouTube not receive any data from your visit, you can read the written companion below each video without pressing play, or watch the video directly on YouTube.

1.7 Public information about video creators

Video-companion pages credit the creator of every featured video. To do that, we process and display information the creator has already made public on YouTube: the channel name, channel link, channel avatar, video title, and publication date. We use this information for exactly one purpose: attributing the work to its creator and sending viewers to the original video and channel.

To build the written companion, we also keep an internal, access-restricted archive copy of the featured video and the frames and transcript we analyzed. This archive is used only for verification and provenance (for example, confirming what the video actually showed) and is never published.

Where GDPR applies, our legal basis is legitimate interests — crediting original creators and directing traffic to them. If you are a creator and prefer not to be featured, you can opt out at any time: every companion page carries a creator opt-out link, or email [email protected]. We unpublish promptly, and we honor verified deletion requests for our archived analysis copy.

2. TikTok Data Handling

Verse Island offers an optional integration with the TikTok Content Posting API that can upload or publish short-form videos to a connected TikTok account. This section applies only when a TikTok account is connected — the integration is off and collects nothing otherwise.

Authorization. Connecting happens on TikTok's own consent screen via OAuth: you explicitly authorize each connection and TikTok shows you the exact permissions before you approve. We never see or store your TikTok password. We request the scopes video.upload (upload a video to the connected account's TikTok inbox/drafts, where the account holder reviews and publishes it inside TikTok) and video.publish (publish a video directly to the connected account's profile, and query the creator's posting settings).

TikTok data we access. Only: the connected account's basic creator information from TikTok's Creator Info endpoint (display name, username, avatar, available privacy-level options, duet/stitch/comment settings, maximum video duration) — which TikTok requires us to show you before every post; OAuth tokens (access + refresh) for the authorization you granted; and the identifiers and status of the posts this integration itself creates. We do not access your followers, messages, watch history, likes, analytics, or any other content on your TikTok account.

What we do with it. One purpose only: transmitting videos created or approved on Verse Island to the TikTok account that authorized us, with the caption, privacy level, and interaction settings chosen at posting time. Before any direct post we display the privacy selector and duet/stitch/comment options TikTok returns for your account, plus a branded-content disclosure where applicable. We do not use TikTok data for advertising, profiling, or AI/ML training, and we never sell or share TikTok user data. Our handling complies with TikTok's Developer Terms of Service, Developer Guidelines, and Data Sharing Agreement.

Storage & security. TikTok OAuth tokens are stored only on our internal, non-public backend server — never on the public-facing web server, never in client-side code, never in our source repositories.

Retention & revocation. Tokens are kept only while the connection is active; on disconnection we delete them promptly (within 30 days at most), and refresh tokens expire on TikTok's schedule (~365 days) if not renewed. Creator info is fetched fresh when needed and not retained beyond operational caching. You can revoke access at any time: disconnect on Verse Island, revoke inside TikTok (Settings and privacy → Security → Apps and websites), or email [email protected]. Revoking on TikTok's side immediately invalidates our tokens.

3. How we use data

Only to: run your account (sign-in, sessions, access tier from Discord roles); provide features (progress, saved plans, credits, attributed contributions); publish content you direct us to publish (Section 2); keep the service working and safe (aggregate traffic measurement, abuse prevention, security); and respond to you. Where GDPR applies, our legal bases are performance of a contract, legitimate interests (security, abuse prevention, cookieless analytics), and consent (the TikTok connection, optional email sharing) — withdrawable at any time. We do not use your personal data for advertising, do not sell it, and do not use members' personal data to train AI/ML models. (Community content you choose to publish is licensed under the contribution licence shown at submission and on Sources & Licensing.)

4. How we share data

Only with the services needed to operate Verse Island: Discord (our authentication provider — the OAuth sign-in exchange); TikTok (videos, captions, and post settings you direct us to post — only when connected, Section 2); Cloudflare (CDN, TLS, and security proxy our traffic passes through); our own hosting infrastructure (we self-host on servers we control); and YouTube (Google) — your browser talks directly to YouTube when a page embeds a creator's video (see §1.6), so embedded playback of creators' videos is governed by Google's privacy policy. No data brokers, no ad networks, no third-party analytics companies. We may disclose data if legally compelled, and would tell you unless legally barred.

5. Security

All traffic is encrypted in transit (TLS). Sensitive credentials — including TikTok and other social tokens — live only on internal servers not exposed to the public internet; the public web server holds no social-platform tokens at all. Analytics hashes are salted with a key destroyed daily. Production access is limited to Biloxi Studios operators. No internet service can promise perfect security; if we discover a breach affecting your personal data, we will notify affected users and any required regulators without undue delay.

6. Data retention

• Account, profile, progress, plans, credits: until you delete your account.
• Published contributions: retained under the contribution licence; anonymised on account deletion (or attributed, at your request).
• Cookieless analytics: ~35 days, rolling.
• Server/security logs: short-lived, routinely rotated.
• TikTok OAuth tokens: until disconnection/revocation (deleted within 30 days) or token expiry.
• Creator attribution info on companion pages (public channel data): while the companion page is published; removed on creator opt-out.
• Internal video-analysis archive (featured videos, frames, transcripts): while the companion page is published; deletion honored on verified creator request.
• Erasure audit record: retained — it records only that an erasure happened, with no profile data.

7. Your rights & controls

Self-service (fastest): signed-in members can export a complete portable copy of everything we hold about them and permanently delete their account and personal data from the Privacy & Data controls on your account page. By email: [email protected]. Creators featured on video-companion pages do not need a Verse Island account to exercise these rights — the opt-out link on the page or an email to [email protected] is enough.

Depending on where you live, you may: access/know, correct, delete, and export your data (GDPR Arts. 15–17, 20; CCPA rights to know, correct, delete); restrict or object to legitimate-interest processing (GDPR Arts. 18, 21); withdraw consent at any time (e.g. the TikTok connection); opt out of sale or sharing (CCPA/CPRA — we do not sell or share personal data as those laws define, so there is nothing to opt out of); exercise rights without discrimination; and complain to your supervisory authority (GDPR). We answer verified requests within 30 days (GDPR) / 45 days (CCPA), verifying through the account itself or the contact channel on record.

8. Children

Verse Island is not directed to children under 13 and we do not knowingly collect personal data from them. Signing in requires a Discord account (Discord requires users to be at least 13, older in some countries); connecting TikTok additionally requires meeting TikTok's own minimum-age requirements. If you believe a child under 13 has provided us personal data, email [email protected] and we will delete it.

9. International transfers · 10. Changes

Our servers are in the United States; if you use Verse Island from elsewhere (including the EU/EEA and UK), your data is transferred to and processed in the U.S. Where GDPR applies we rely on appropriate safeguards, including standard contractual clauses with our providers where applicable. Changes to this policy are posted here with an updated date; material changes get advance notice on the site (or by email where we have one). Earlier versions are available on request.