Privacy Policy

Short version

We collect the minimum identity, entitlement, and moderation data the Service needs to function: your Discord ID (so we know who you are), your RedM / Cfx.re identifiers and in-game progress (so the game remembers you), and records of your Tebex purchases (so your supporter perks actually land). We also run privacy-respecting product analytics (PostHog) so we can see which features people actually use and where the store journey breaks. We don't sell anyone's data, we don't run ad tracking, and we never see your payment card. Tebex handles that end-to-end.

Who this applies to

This policy covers playcaladria.com, the Caladria store, the game servers, and the Caladria Discord. "We", "us", and "Caladria" refer to the Caladria community operators.

What we collect, and why

• From Discord (sign-in): your Discord user ID, username, and avatar hash. Used to identify you on the store, link your in-game progress to a stable account, and render your name + avatar in the header. Stored in a signed session cookie on your device and in our players table. We don't store your Discord email, friends list, guilds beyond Caladria, or message history.
• From RedM (when you join a shard): your Cfx.re license / Steam / Rockstar identifiers, display name, and the IP address you connected from. Identifiers tie your session to your account across restarts; the IP is kept for ban-evasion checks and moderation, scoped to the accounts table. None of this leaves the server box.
• Gameplay state: gold balance, characters, class, experience, honor, timers, and related progression data. Required for the game to do its job.
• From Tebex (purchases): we receive a transaction ID, the package you bought, the amount, and the email Tebex already knows about you. We link the transaction to your Discord ID so fulfilment can run. We never see your card or bank details. Those live entirely inside Tebex and their payment processors.
• Moderation log: when staff take actions (kicks, bans, gold adjustments) we record the actor, target, timestamp, and reason. Required for accountability.
• Cloudflare infrastructure: the Service sits behind Cloudflare, so Cloudflare sees request metadata (IP, user-agent, URL) the way any CDN does.
• Product analytics (PostHog): we use PostHog (US region) to understand how the site is used: pages viewed, buttons clicked, store funnel progression, approximate device / browser, and a coarse location derived from IP. Anonymous visitors are kept as a random device ID only. Once you sign in with Discord or complete a Tebex purchase, that device ID gets linked to your Discord ID so we can see, for example, whether a supporter completed a specific in-store flow. We don't use PostHog for advertising, we don't enable session replay, and we don't sell the data to anyone.

Cookies

• caladria_session: signed session cookie with your Discord ID, username, avatar, and an admin flag. Set after Discord sign-in, cleared on sign-out.
• caladria_oauth: short-lived CSRF / state cookie during Discord sign-in. Discarded the moment the handshake completes.
• Cloudflare may set its own cookies (e.g. __cf_bm) for bot management.
• ph_<project>_posthog: PostHog's first-party cookie holding an anonymous device ID so repeat visits register as the same browser. Paired with a matching localStorage entry.

We don't use cookies for advertising. See the Cookie Policy for the full list.

Who we share data with

Only the providers the Service runs on:

• Discord: identity provider (OAuth sign-in).
• Tebex: payment processing and subscription billing.
• Cloudflare: DNS, CDN, and Workers hosting.
• Cfx.re: RedM platform authentication (happens directly between your game client and Cfx.re, not via us).
• PostHog: product analytics (US region). Receives pageview / event data and, after sign-in, your Discord ID as a stable user identifier.

We don't sell personal data. We don't share data with marketers or data brokers. If law enforcement produces a valid legal request we'll respond as legally required.

Retention

Gameplay data, purchase records, and moderation entries are kept as long as your account exists, so we can restore your progress and honour existing supporter perks. Transient cookies (session, OAuth CSRF) follow their own lifetimes shown above.

Your rights

You can ask us to show you the data we hold on your account, correct anything wrong, or delete your account and its data. Deletion removes gameplay progress, supporter entitlements, and the Discord link; moderation records tied to a ban may be kept in redacted form so staff can enforce the ban. Requests go through the Caladria Discord . Open a ticket or DM a staff member.

Children

The Service isn't directed at children under 13 (or the higher floor in your region). If you believe a child has registered, contact us and we'll remove the account.

Changes

We'll update this page if the way we handle data changes. Material updates get announced in the Caladria Discord and the date above gets bumped.

Contact

Anything privacy-related, reach us via our Discord. DM a staff member for private account matters, or open a ticket for formal requests.