Privacy Policy

This page describes how the Apophis website handles data. It is a technical draft and does not replace a reviewed privacy policy.

Without an account

• No tracking and no analytics tools.
• Fonts and images are served from our own server – your browser loads no content from third parties.
• The “Reduce motion” setting is stored only locally in your browser (localStorage).

Sign in with Discord

Signing in is optional. If you choose “Sign in with Discord”, Discord asks you to allow access to your basic profile (scope identify). We then store:

• your Discord user ID, username, display name and avatar ID,
• whether you registered interest in beta builds,
• the downloads you start while signed in (file, version, platform, time).

We do not receive your email address or password, and we do not store Discord access tokens. Your avatar is fetched by our server from Discord and passed on to you, so your browser does not contact Discord for it.

Cookies

• apophis_session – keeps you signed in for up to 30 days. Only a hash of it is stored on our server. Set only after you sign in.
• apophis_oauth_state – protects the sign-in against forgery, valid for 10 minutes during sign-in.

Both are strictly necessary for the sign-in you requested; there are no advertising or analytics cookies.

Deleting your data

Signing out ends your session. On the account page under Settings, “Delete account” removes your account, download history and beta flag from our server immediately.

Server logs

Like any web server, ours may technically log requests (e.g. IP address, time, requested page). Retention depends on the server configuration and will be specified here.

The launcher

The Apophis launcher signs in through Microsoft and stores accounts in the system keyring. Discord Rich Presence runs locally over IPC and can be switched off in the settings. Updates are only installed if they are signed.

Controller

Details of the responsible party will follow (see Imprint).