What we collect
When you sign in, we read your Discord username, ID and avatar — nothing else, and never your messages. When you apply, we store what you submit in the application. When you buy from the store, Tebex (our payment processor) handles your payment details directly; we never see or store your card information. We receive your Discord account and a record of what you purchased and when.
How we use it
To run City Hall (applications, tickets, transcripts), deliver the digital items you purchased, respond to support and refund requests, and prevent fraud and abuse.
Who we share it with
We share purchase information with Tebex only as needed to process your order, and use Supabase to store account and application data. We do not sell or rent your information to anyone.
How long we keep it
For as long as reasonably necessary for support, fraud prevention and basic bookkeeping.
Cookies and browser storage
We don't use advertising or cross-site tracking cookies. We do store a few things in your browser (its local storage), and you choose which groups to allow in the notice that appears on your first visit. You can change your mind any time with Cookie settings in the footer.
Essential — always on. These make the site work and can't be switched off:
- Your login session — keeps you signed in after you use Discord or Steam to sign in (stored by our backend provider, Supabase).
- Music volume and mute — remembers the choice you made on the homepage.
- Invite code — if you arrive through a referral link, the code is kept so it can be credited when you apply.
- Staff maintenance bypass — a flag that lets signed-in staff view the site during maintenance.
- Your cookie choice — so we don't ask you every visit.
Analytics — only if you allow it. A random anonymous ID kept in your browser, used to count page views and show the number of people on the site right now. It isn't linked to your name, and turning it off deletes the ID.
Other services involved
- Discord and Steam — when you sign in or link an account, you're sent to their sites and they tell us your public username, ID and avatar. We never see your passwords.
- Supabase — stores accounts, applications, tickets and your linked accounts on our behalf.
- Google Fonts and jsDelivr — the site loads its fonts and a code library from these services, so your browser contacts them (and they see your IP address) when a page loads.
- Tebex — handles store payments.
Your options
Open a ticket in Discord to ask what we hold about you, or to ask us to delete records we aren't otherwise required to keep.