Privacy PolicyPrivacy Policy

1. Responsible party

The responsible party for personal information described in this Policy is:

2. Scope

This Policy applies to:

• the CursedForge website at cursed-forge.com
• the CursedForge game for Meta Quest
• the game servers and hosted worlds that Miniature Forge PTY LTD operates
• the account portal at auth.cursed-forge.com
• the official CursedForge community spaces where this Policy is linked.

It does not govern an independently operated third-party website, social network, platform, or service, for example Meta, Discord or Google. Those operators determine their own privacy practices.

If we add a feature that uses personal information in a materially different way, we will update this Policy before that feature starts.

3. Website, email and community information

Technical website information

When you request a page, hosting and network infrastructure may automatically process:

• Internet Protocol address;
• request date and time;
• requested page, response status, and data transferred;
• browser, device, and operating-system information;
• referring page, where supplied by your browser; and
• security and error information associated with the request.

Web fonts

The website uses fonts from Google Fonts. If your browser gets a font from Google Fonts, Google receives your IP address and the technical information of that request.

Cloudflare performance information

Cloudflare Web Analytics automatically adds a performance beacon to public HTML pages. It processes page-load and Core Web Vitals measurements, a generated page-load identifier, the requested page, referrer information, and limited browser, operating-system, device-type, and country-level information needed to produce aggregate performance reports.

Cloudflare states that Web Analytics does not collect or use visitors' personal data and does not track individuals across its customers' properties. The beacon sends performance data after page load and when a visitor leaves the page.

Optional Google Analytics information

Google Analytics does not load unless you choose Allow analytics. If allowed, it may process page views, session statistics, approximate geolocation, browser and device information, referring pages, and interaction events enabled for the CursedForge property. Google Analytics uses a first-party client identifier to distinguish visits and sessions.

We configure the Google tag with advertising storage, advertising user data, advertising personalisation, Google signals, and advertising personalisation signals disabled. CursedForge does not use Google Analytics for targeted advertising.

Information you provide directly

If you email us, we process your email address, display name, message, attachments, and related correspondence. Providing this information is voluntary, but we may be unable to respond without a usable return address and enough information to understand the request.

Official community information

If you participate in an official CursedForge community hosted on a third-party platform such as Discord, we may process information made available to community administrators, including your platform identifier, username, profile information, messages, reports, role assignments, and moderation history. We use this information only as reasonably necessary to operate, protect, and moderate the community.

4. Game and server information

This section tells you what the game, the game servers, the account service and our staff tools collect.

Your Meta account

The game uses your Meta Horizon account to identify you. When you sign in, the game gets these things from Meta on your headset: your Meta user id for this app, your Meta username (or your Meta display name if you have no username), and a proof that is good for one use. The game sends them to our account service. Our account service sends the proof to Meta, and Meta confirms that the proof is correct.

We keep your Meta user id and link it to your CursedForge account. We keep your Meta username as the display name of your game account, and we update it each time that you sign in. Meta confirms the proof and the user id, but not the name. So we use the name only as a label. It never decides what you can do. We do not keep the proof. We keep a record of each sign-in event (account created, account linked, sign-in, or refused) with its time. This record does not contain the proof or a token. The sign-in session that we give to the game lasts a maximum of one hour, and the game keeps it only in memory.

Your account and your characters

Your CursedForge account holds an account id, a display name, an account status, and the roles that you have in each world. If you link Discord, it also holds your Discord user id.

In each world, the game server keeps your characters and their progress, for example the name, the appearance, the inventory, the skills, the quests, the coins and the position in the world. Other players in the same world can see your display name, your character and what your character does. The server also keeps the times when you join and leave a world.

Your headset id

When you join a world, the game sends the identifier that the headset gives to the app. We keep this headset id with your player record. If a ban applies to your headset, we also keep the id with the ban. We use the headset id only to enforce bans and for moderation. It does not sign you in. The game keeps a copy of the id in a file on your headset.

Network information

The game servers and the account service receive the IP address of your device when you connect. The servers use it to send game data to you and to limit abuse. A world moderator can ban an IP address. Then we keep that address with the ban.

Product analytics

The game and the game servers send product analytics to our own Aptabase service at analytics.cursed-forge.com. We operate this service on our own servers. It does not use Google Analytics or Unity Analytics.

An analytics event tells us what occurred, for example that the app started, that a world join failed, that a tool broke, or the frame rate of the game. Each event from the game has a random session id and these device details: the headset model, the operating-system version, the language setting, and the app version.

Analytics events do not contain your name, your headset id, your Meta user id, your position in the world, or the text of log messages. If the game has an error, it sends the type of the error and not the error message. If a server counts events for one player, it uses a pseudonym. The pseudonym is a keyed hash that only that world can make. Aptabase does not keep your IP address.

The log file on your headset

The game writes a log file on your headset to help us find faults. The file has a size limit of approximately 1 MB, and the game keeps one older file. While you are connected to a game server, the game also sends the lines of this log to that server, and the server keeps them in a file for your player and your headset. The log can contain your headset id, your player name, what the game did, and the errors that it found. It does not contain voice chat. We use these files only to find and repair faults.

Server logs

The game servers write operation logs to help us find faults and abuse. These logs can contain your display name.

Moderation and sanctions

The owner of a world and the moderators that the owner chooses can kick, mute, jail and ban players in that world. We keep each sanction and an audit record of each moderation action. These records contain the account ids and display names of the people involved, the reason, and the times. When a ban ends, the ban record stays as moderation history.

Incident records

The game server keeps a short record of an incident in these conditions:

• a moderator kicks, mutes, jails or bans a connected player
• the server refuses many actions from one player in a short time.

An incident record covers the 20 seconds before the event. It holds the positions and movements of a maximum of 16 people within 30 m of the event. This can include people who only stood near the event. For each person, the record holds the display name, the account id and the headset id. An incident record does not contain voice or video. The game does not show a message when the server makes a record.

Behaviour signals

The game server counts some actions of each player in time windows. Examples are actions that the server refuses, and actions that take items from the pack or the grave of a different player. Each window record holds the display name, the account id (if there is one) and the headset id of the player. The record also names the other player of each counted action.

The owner, the administrators and the head moderators of that world, and CursedForge staff, can read incident records and behaviour signals. We record each read in an audit log. The Retention section tells you when we delete these records.

Hosted worlds and purchases (not available yet)

You will be able to buy a hosted world as a subscription through the Meta Horizon Store. Meta handles the payment. We do not receive your payment card details. We receive and keep your Meta user id, the subscription id, the product, and the times when Meta confirmed or cancelled the subscription. We also keep a record of a free trial, so that each account gets one trial.

Before you can buy, the game reads the age group of your Meta account on the headset. Only an adult account can buy. The age group does not leave your headset.

The account portal

The portal at auth.cursed-forge.com lets you manage your worlds and link your accounts. You can sign in to the portal with Discord. We ask Discord only for the identify permission. With it, we get your Discord user id and your Discord username.

Linked accounts

You can link one Discord account and one game (Meta) account. One side shows an 8-digit code. You type the code on the other side and confirm the link. The confirmation step shows the display name of the other account, so that you can check that it is your own account.

Only an adult Meta account can link accounts. Before the game shows a code or takes a code, it reads the age group of your Meta account on the headset. The age group does not leave your headset.

A link does not merge the two accounts. It shares these things between them:

• your roles and your owner rights in each world
• CursedForge staff status
• bans and sanctions: a ban or a sanction on one account also applies to the other account
• the free trial: the two accounts get one trial together.

We keep these records:

• The link: the two account ids, the time of the link, and how it was made (a code from the portal, a code from the game, or CursedForge staff). If staff made the link, we also keep the staff email.
• Link codes: only a hash of the code, never the code. A code works one time, for a maximum of 10 minutes.
• Wrong codes: for each wrong code, the account id, the IP address and the time. We use these records only to stop people who guess codes. After 5 wrong codes in 10 minutes, code entry stops for a short time for that account and that IP address.
• Unlink requests: you cannot remove a link yourself. You send a request to CursedForge staff with a reason of up to 280 characters. We keep the request, the staff decision, the staff email and the reason for the decision.
• Link history: a record of each link, unlink, request and decision, with the two account ids, the person who acted and the time.

CursedForge staff can see both accounts of a link, with their ban and sanction history, to decide a request.

Messages from our Discord bot

Our Discord bot, Flames of Heaven, sends you direct messages about actions that change your account, your mods or your worlds. CursedForge staff, our systems, a world administrator or a payment provider can do these actions. Examples are a decision about your mod, a ban or a sanction, a canceled subscription and a change to your linked accounts.

The bot can send a message only when your account has a Discord account, directly or through an account link. Discord must also allow direct messages from the bot to you. We keep a record of each message for 90 days, then we delete it. The record holds your account id, the type of message and the facts that the message shows.

You cannot turn these messages off in CursedForge. To stop them, block the bot in Discord.

Modder tokens and the modder MCP server

An approved modder can make a token on the portal and give it to an AI agent. The agent uses the token to connect to the modder MCP server at mcp.cursed-forge.com. The server gives only the public text of the Modder Kit.

• The token: we keep only a hash of the token, never the token. The portal shows the token one time, when you make it. For each token, we also keep the name that you give it, the last characters of the token as a hint, the time when you made it, the time when it expires, the last time that it was used, and the time when you revoked it.
• Rate limits: the MCP server keeps the token id and the IP address of each request for a short time, to limit the number of requests for each token and for each address.
• Draft packs: the server checks the JSON files of a draft pack that the agent sends, and then deletes them. We do not keep a draft pack.

Meta friends, invites and presence (not available yet)

We are adding Meta social features to the game. This is how they will work:

• Friends: the game reads your Meta friends list on your headset only when you open the invite panel or the friends view of a leaderboard. We do not keep your friends list on our servers.
• Invites: you can invite Meta friends to your party or your world. Meta sends the invite. When a friend accepts, Meta opens the game in your world.
• Presence: the game tells Meta which world or dungeon you are in and whether friends can join you. Meta shows this to your Meta friends.
• Events: we list scheduled game events in Meta. An event link opens the game in the world of the event.

Achievements, leaderboards and challenges (not available yet)

The game will send your achievements and your scores, for example dungeon clear times, to Meta. Meta shows your achievements and your scores to you and to your Meta friends. A public leaderboard or a public challenge also shows your Meta name and your score to other players. A challenge shows the players who take part and their scores until the challenge ends.

Meta device ban (not available yet)

For serious or repeated breaks of our Terms of Service, only CursedForge staff can ask Meta to ban your headset from the game. Meta keeps this device ban. We keep the ban record, the reason and an audit record, as for our own bans. You can appeal a ban. When staff lift the ban, we also lift the Meta device ban.

Staff tools

CursedForge staff use a staff panel to operate worlds and to read moderation records. Only approved staff accounts can open the panel. Each staff read of an incident record or a behaviour signal is recorded in the audit log.

5. Voice chat and voice commands (not available yet)

We are adding voice chat and voice commands to the game. This section tells you how they will work.

The microphone permission

The game asks for the microphone permission the first time that you turn on voice chat. It does not ask when the game starts. If you do not give the permission, voice chat and voice commands do not work, and the rest of the game works normally. You can remove the permission at any time in the settings of your headset.

Voice chat

When voice chat is on, the game compresses your voice and sends it to the game server of your world. The server sends it only to players near you in the same area. If you use the Whisper Thread spell, the server sends your linked voice only to the one player that you linked with.

The server keeps your voice only in memory, for the time that it needs to send it on. We do not record, log or keep voice chat. The headsets of other players play your voice and do not keep it.

Other players identify your voice by a voice id. The server makes this id from your account with a secret key. The voice id does not show your account id to other players, and it is different on each server.

Your voice controls

Use the Players in this world page on the Social Tablet to control voice:

• Select open mic, push-to-talk, or off. Off stops voice chat.
• Select Mute myself to stop your voice.
• Select Mute next to a player to stop that player's voice for you.
• Select Turn off all voices to stop all voices for you.

Your headset keeps your voice settings and your mutes in files on the headset. The game also tells the server which voice ids you muted, so that the server does not send those voices to you. A mute also ends a Whisper Thread link with that player. The operator of a world can mute a player or turn off voice for the whole world.

Voice commands

You can say the name of a spell to choose it. Voice commands use Wit.ai, a speech service of Meta. The game sends audio to Meta only while you hold the listen button. When you release the button, the audio stops.

Meta changes the audio into text and sends the result back to the game. The game uses the result on your headset to choose the spell. We do not receive or keep the audio. Meta processes the audio under its own terms and privacy policy.

If you do not want Meta to receive this audio, do not hold the listen button. Voice chat works without voice commands. If you turn on the private incantation setting, the game does not send your voice to other players while you hold the listen button.

6. What we do not collect

As of the effective date, we do not:

• sell or rent personal information
• show advertising, serve targeted advertising, or use advertising pixels
• record, log or keep voice chat
• receive payment card details
• use Unity Analytics, Unity crash reporting or Unity Ads
• use personal information for automated decisions that produce legal or similarly significant effects.

The website itself does not provide accounts, a login, a contact form or a newsletter. Account functions are in the game and on the account portal.

7. Purposes and legal grounds

We process personal information only for specific purposes supported by applicable law:

• Providing the game: to sign you in, keep your account, worlds and characters, and send game data and voice chat between players. This is necessary to provide the service that you ask for under the Terms of Service.
• Safety and moderation: to enforce world rules and bans, and to keep incident records, behaviour signals and audit records. This supports our legitimate interest, and the interest of other players, in a safe game and in service integrity.
• Product analytics: to measure how the game and the servers perform, with events that do not contain your name or your ids. This supports our legitimate interest in a reliable game.
• Linked accounts: to link your Discord account and your game account when you ask for it, to share your rights and your restrictions between them, and to stop people who guess link codes. This is necessary to provide the link that you ask for, and it supports our legitimate interest in a safe game.
• Meta social features (not available yet): to show friends whom you can invite, to send invites, to show your presence to your friends, and to show achievements, leaderboards and challenges. These features start only when you use them.
• Purchases: to give you the hosted world that you bought and to keep the records that the law requires. This is necessary to perform the contract with you and to meet legal obligations.
• Voice commands: to choose a spell from your speech. You start each use when you hold the listen button.
• Delivering and securing the website: to serve requested pages, diagnose faults, prevent abuse, and protect systems. This supports our legitimate interest in providing a safe and reliable website.
• Measuring website performance: to understand aggregate page usage and loading performance through Cloudflare Web Analytics. This supports our legitimate interest in maintaining a reliable and usable website.
• Optional visit measurement: to understand visits and sessions through Google Analytics only after an affirmative choice. This processing relies on consent where consent is the applicable legal ground.
• Responding to you: to answer questions, privacy requests, reports, or other correspondence. This supports our legitimate interest in communicating with visitors and may be necessary to take steps you request before entering a contract.
• Operating official communities: to manage roles, enforce community rules, investigate abuse, and protect members. This supports our legitimate interests in community safety and service integrity.
• Meeting legal obligations: to comply with applicable law, lawful requests, recordkeeping obligations, or the establishment, exercise, or defence of legal claims.
• Consent: where we specifically ask for consent for an optional purpose, for example the microphone permission. You may withdraw that consent at any time, without affecting processing that was lawful before withdrawal.

8. Cookies and similar storage

The website stores your analytics choice in your browser's local storage under the key cf_analytics_consent. This prevents the site from repeatedly asking the same question. It is not used to identify you across websites and can be changed through any Privacy choices link on this site.

Cloudflare automatically injects two scripts into public HTML responses:

• Email Address Obfuscation hides published email addresses from automated harvesting and decodes them for human visitors.
• Cloudflare Web Analytics measures page views and loading performance without tracking individuals across websites.

Cloudflare's security systems may set strictly necessary cookies when needed to deliver or protect the website, including during bot or security challenges.

If you choose Allow analytics, Google Analytics loads and may set first-party cookies such as _ga and a property-specific _ga_* cookie to distinguish visits and sessions. If you choose No thanks, the Google tag is not loaded and no data is sent to Google Analytics by this website. You may withdraw permission by reopening Privacy choices and choosing No thanks. You may also delete existing analytics cookies through your browser.

The account portal sets two strictly necessary cookies: a sign-in check cookie that lasts 10 minutes, and a session cookie that lasts 30 days.

The game keeps these files on your headset: the headset id, the log file, your settings, and (when voice starts) your voice settings and your mutes. If you delete the app data or remove the game, these files are deleted.

If we introduce advertising, personalisation, or another nonessential use, we will update this Policy and obtain consent where required before that use begins.

Open privacy choices

9. How information is shared

We do not sell or rent personal information. We may disclose limited information to:

• Meta, which confirms your sign-in proof, handles Meta Horizon Store purchases, and (when voice commands start) changes the audio of a voice command into text. When the Meta social features start, Meta also receives your presence, your invites, your achievements and your scores, and the device bans that our staff issue;
• the other account of a link, which sees the display name of your account in the link confirmation step;
• other players, who see your display name and your character, and hear your voice when voice chat is on;
• world owners and their moderators, who see the moderation records of their world, and the owner, administrators and head moderators of a world, who can read the incident records and behaviour signals of that world;
• CursedForge staff, who operate the service and can read moderation records;
• Discord, when you choose to sign in to the account portal with Discord, and when our bot sends you a direct message;
• Cloudflare, which provides content delivery, network security, email-address obfuscation, request analytics, and privacy-first web-performance analytics;
• Google, for web fonts, and for Google Analytics only after you allow analytics;
• other hosting, email, security, and information-technology providers that process information to provide services to us;
• third-party community platforms when you choose to use those platforms;
• professional advisers such as legal, accounting, or security advisers where reasonably necessary and subject to appropriate duties;
• law-enforcement, regulators, courts, or other parties where required by law or reasonably necessary to protect rights, safety, or service integrity; and
• a successor or prospective successor in a merger, restructuring, financing, or sale of all or part of the business, subject to appropriate confidentiality and legal safeguards.

Service providers may process information only for the service they provide to us and under their applicable contractual and legal duties.

10. International processing

Some service providers or community platforms may process information outside South Africa or outside the country where you live. Meta, Discord, Cloudflare and Google can process information in other countries. Where applicable law requires it, we use a lawful transfer mechanism or another appropriate safeguard and consider whether the recipient provides an adequate level of protection.

You may contact us for more information about safeguards relevant to your information.

11. Security

We use reasonable technical and organisational measures appropriate to the nature and risk of the information processed. These measures may include access controls, transport encryption, credential protection, software maintenance, limited access, and provider security controls.

Headset ids, incident records and behaviour signals are not available to other players. Only the people named in the sharing section can read them, through access checks, and we record each read.

No internet transmission or storage method is completely secure. If we identify a personal-information breach, we will investigate and provide legally required notices to affected people and regulators.

12. Retention

We retain personal information only for as long as reasonably necessary for the purpose described in this Policy, unless a longer period is required or allowed by law.

• Voice chat: not kept. The server keeps voice only in memory, for the time that it needs to send it on.
• Voice command audio: not kept by us. Meta processes it under its own policy.
• Sign-in session: a maximum of one hour, in the memory of the game only.
• Incident records and behaviour signals: deleted after 90 days. After we delete an incident record, a short record stays. It holds the account id and the display name of the subject and of the reporter. It holds no headset id.
• Bans and sanctions: kept as moderation history after they end.
• Account links: kept while the link exists. The link history and the unlink requests stay as moderation history after an unlink, and also after an account is deleted.
• Link codes: deleted when used, and valid for a maximum of 10 minutes.
• Wrong link codes: deleted after 30 days.
• Modder tokens: a token expires 180 days after you make it. We keep the token record, with the hash and never the token, as a record of access.
• Discord messages: the record of each direct message from our bot is deleted 90 days after we make it.
• MCP rate-limit records: the token id and the IP address, kept only in the memory of the MCP server for a short time.
• Meta friends list: not kept by us.
• Server backups: we make a backup each night. We delete backups that are older than 30 days, but we always keep the 7 newest backups.
• Hosted worlds: if a subscription ends, the world stops and we keep it for 7 days. After 7 days, we delete the world and all its backups permanently.
• Account portal cookies: 10 minutes for the sign-in check cookie and 30 days for the session cookie.
• Files on your headset: kept until you delete the app data or remove the game. The log file has a size limit of approximately 1 MB and one older file.
• Device logs on the game servers: kept for 30 days, then deleted.
• Technical logs: retained according to the shortest operational period reasonably needed for hosting, security, abuse prevention, and troubleshooting, then deleted or de-identified, subject to the hosting provider's controlled backup cycle.
• Cloudflare Web Analytics: Cloudflare states that unsampled beacon data is retained for seven days and then aggregated to a smaller dataset. Performance reports are available to us for the period Cloudflare makes them available in its dashboard.
• Google Analytics: retained according to the data-retention settings applied to the CursedForge Analytics property and Google's applicable provider obligations. You may ask us for the current setting.
• Analytics preference: retained in your browser until you change it, clear site storage, or the browser removes it.
• Correspondence: retained until the matter is resolved and for any further period reasonably needed for continuity, legal compliance, or dispute records.
• Community moderation records: retained while relevant to community safety, repeat-abuse prevention, appeals, or enforcement, and reviewed when no longer needed.

Information may remain in protected backups until those backups are overwritten through the normal backup cycle.

13. Your privacy rights

Depending on the law that applies to you, you may have rights to:

• ask whether we process your personal information and request access to it;
• request correction of inaccurate or incomplete information;
• request deletion or restriction where the legal requirements are met;
• object to particular processing, including direct marketing;
• withdraw consent where processing relies on consent;
• request portability of information you provided where applicable; and
• complain to an applicable privacy regulator.

Send requests to legal@cursed-forge.com. We may ask for information reasonably necessary to confirm your identity and locate the relevant records. We will respond within the period required by applicable law.

In the game, you can also control some processing yourself. You can remove the microphone permission in the settings of your headset. You can turn voice chat off, mute players, and choose not to use voice commands.

These rights can be limited where an exemption applies or where fulfilling a request would adversely affect another person's rights. If we cannot fulfil a request, we will explain the reason where the law allows.

14. Children

The website is not directed to children under 13 and does not knowingly collect personal information from them. Official interactive community spaces require users to meet the applicable platform age requirement and any higher minimum required by local law.

In the game, only an adult Meta account can link accounts or buy a hosted world. The game reads the age group of the Meta account on the headset for this check.

If you believe a child has provided personal information to us contrary to these requirements, contact us so that we can investigate and take appropriate action.

15. Third-party services

Links to Discord, Meta, social networks, or other third-party services take you to independently operated services. Their privacy policies govern their processing. Review those policies before providing personal information.

The game uses Meta Horizon for sign-in, your Meta username and purchases. When these features start, it also uses Meta Horizon for friends, invites, presence, events, achievements, leaderboards, challenges and device bans, and Wit.ai from Meta for speech. The account portal uses Discord for sign-in. The privacy policies of Meta and Discord apply to the information that they process.

We are not responsible for an independent third party's privacy practices. This does not reduce any responsibility we have for information that we ourselves receive or control.

16. Changes to this Policy

We may update this Policy when the website, the game, community features, providers, or law changes. The effective date at the top identifies the current version. If a change materially affects how we process personal information, we will provide reasonable notice and obtain consent where required.

17. Contact and complaints

For privacy questions or requests, contact:

If you are in South Africa and believe your personal information has been processed in breach of the Protection of Personal Information Act, you may also complain to the Information Regulator of South Africa. If another privacy law applies to you, you may complain to the competent authority in your jurisdiction.