Skip to content
Malnik Services Logo Malnik Services

Privacy policy

Last updated: November 2, 2026

1. Controller

Malnik Services — Malte Nowc, Hauptstraße 159, 26639 Wiesmoor, Germany. Contact: malnik.services@gmail.com, our contact form or our Discord server.

2. Discord login (OAuth2)

Sign-in is handled by Discord (scope identify). We receive your Discord ID, display name and avatar. No passwords are stored. Whether you may access dashboard areas is checked server-side against your roles on our Discord server; this lookup is cached in memory for up to 5 minutes (no persistent role profile). Provider: Discord Inc., San Francisco, USA — Discord's processing is governed by the Discord privacy policy; data may be transferred to the USA (third country, see section 9).

3. Cookies and local storage

We use no tracking, no analytics or advertising cookies and no third-party cookies. In the cookie notice you choose between "Only necessary" and "Remember my settings"; you can change your choice at any time via "Cookie settings" at the bottom of every page.

Always (necessary):

  • Session cookie (session): signed, needed for login and as a security token for forms (e.g. the contact form), valid for the browser session or up to 14 days.
  • Choice cookie (consent): stores your choice in the cookie notice for 1 year so the notice does not appear on every visit.
  • Without consent, your language choice (lang) and colour scheme (theme in sessionStorage) only last until you close the browser.

Only with your consent ("Remember my settings"): language cookie (lang) for 1 year and colour scheme (theme in localStorage, stays on your device).

Legal basis: § 25 (2) no. 2 TDDDG (strictly necessary storage) and § 25 (1) TDDDG (consent) for remembering language and colour scheme permanently; Art. 6 (1) lit. f GDPR.

4. Server logs

When you visit the site, the reverse proxy and application server process technically necessary connection data (IP address, timestamp, requested page, browser agent). This is done to secure operations (Art. 6 (1) lit. f GDPR — legitimate interest). Logs are not evaluated, not merged and not shared with third parties. They are retained only as long as required for secure operation and are deleted afterwards.

5. Protection logs (Fail2ban)

To protect against abuse, Fail2ban analyzes failed login attempts on the server and may temporarily block IP addresses. Legal basis: Art. 6 (1) lit. f GDPR (system security).

6. Bug reports, tickets and community data

When you submit a bug report via the website, we process your Discord ID, name and the report content (mod, version, description, optional screenshot URL) and create a thread in our Discord forum. Content you post on our Discord server (bug reports, tickets, suggestions, polls) is processed to provide community features and stored in a SQLite database. Legal basis: Art. 6 (1) lit. b and lit. f GDPR (use of platform features).

7. Download statistics

Clicks on download buttons are counted with mod, source, timestamp and — if logged in — your Discord ID (aggregate statistics). Legal basis: Art. 6 (1) lit. f GDPR.

8. External content and services

Mod images are served from our own server wherever possible. Discord avatars are fetched from Discord Inc. servers, which technically transmits your IP address to Discord. Download links lead to third-party platforms (Nexus Mods, Modrinth, CurseForge); their privacy policies apply from that point on. Our bot periodically fetches version and statistics data from the Nexus Mods and Modrinth APIs — no website visitor data is transmitted in that process. No tracking, analytics or marketing cookies, no ad networks.

9. Recipients and third-country transfers

Discord Inc. (USA): login, avatars, bot/forum (see sections 2, 6, 8). Discord Inc. is certified under the EU-US Data Privacy Framework; the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR).

Hosting provider: The server is operated by an external hosting company that provides the infrastructure (including VNC console).

10. Storage period and backups

Database backups are created daily and deleted after 14 days. Database content is retained while the account/entry is in use; deletion on request (see section 11). Section 4 applies to server logs.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Use the contact options in section 1.

12. Data minimization

We only collect data required for operating the platform and its community features. There is no real-name requirement; profiles are based solely on your Discord identity.

13. Contact form and e-mail

When you write to us through the contact form, we process your e-mail address, your message and optionally your name and subject to answer your request (Art. 6(1)(b) or (f) GDPR). The message is stored on our server and forwarded as a notice to a private staff channel on our Discord server (Discord Inc., USA, see section 9). We reply by e-mail via Gmail (Google Ireland Ltd. or Google LLC, USA). The same applies if you e-mail us directly. We delete contact requests once they are handled, at the latest after 180 days, unless statutory retention obligations apply. A hidden field in the form only serves to block spam bots.

14. Fonts

The "Space Grotesk" font is loaded from our own server. No data is sent to Google or other font providers.