Privacy Policy

1. Responsible party

The responsible party for personal information described in this Policy is:

2. Scope

This Policy applies to the CursedForge website at cursed-forge.com and to official CursedForge community spaces operated by Miniature Forge PTY LTD where this Policy is linked.

It does not govern an independently operated third-party website, social network, platform, or service. Those operators determine their own privacy practices.

A future game build, account system, purchase flow, playtest, or hosted world service may require additional privacy information. We will update this Policy or provide a specific notice before introducing materially different processing.

3. Information we process

Technical website information

When you request a page, hosting and network infrastructure may automatically process:

• Internet Protocol address;
• request date and time;
• requested page, response status, and data transferred;
• browser, device, and operating-system information;
• referring page, where supplied by your browser; and
• security and error information associated with the request.

Cloudflare performance information

Cloudflare Web Analytics automatically adds a performance beacon to public HTML pages. It processes page-load and Core Web Vitals measurements, a generated page-load identifier, the requested page, referrer information, and limited browser, operating-system, device-type, and country-level information needed to produce aggregate performance reports.

Cloudflare states that Web Analytics does not collect or use visitors' personal data and does not track individuals across its customers' properties. The beacon sends performance data after page load and when a visitor leaves the page.

Optional Google Analytics information

Google Analytics does not load unless you choose Allow analytics. If allowed, it may process page views, session statistics, approximate geolocation, browser and device information, referring pages, and interaction events enabled for the CursedForge property. Google Analytics uses a first-party client identifier to distinguish visits and sessions.

We configure the Google tag with advertising storage, advertising user data, advertising personalisation, Google signals, and advertising personalisation signals disabled. CursedForge does not use Google Analytics for targeted advertising.

Information you provide directly

If you email us, we process your email address, display name, message, attachments, and related correspondence. Providing this information is voluntary, but we may be unable to respond without a usable return address and enough information to understand the request.

Official community information

If you participate in an official CursedForge community hosted on a third-party platform such as Discord, we may process information made available to community administrators, including your platform identifier, username, profile information, messages, reports, role assignments, and moderation history. We use this information only as reasonably necessary to operate, protect, and moderate the community.

4. What the website does not currently collect

As of the effective date, the website does not:

• provide website user accounts or login;
• process purchases, payment-card details, or billing information;
• provide a contact form or newsletter subscription;
• use advertising pixels or cross-site behavioural advertising;
• serve targeted advertising;
• sell or rent personal information; or
• use personal information for automated decisions that produce legal or similarly significant effects.

5. Purposes and legal grounds

We process personal information only for specific purposes supported by applicable law:

• Delivering and securing the website: to serve requested pages, diagnose faults, prevent abuse, and protect systems. This supports our legitimate interest in providing a safe and reliable website.
• Measuring website performance: to understand aggregate page usage and loading performance through Cloudflare Web Analytics. This supports our legitimate interest in maintaining a reliable and usable website.
• Optional visit measurement: to understand visits and sessions through Google Analytics only after an affirmative choice. This processing relies on consent where consent is the applicable legal ground.
• Responding to you: to answer questions, privacy requests, reports, or other correspondence. This supports our legitimate interest in communicating with visitors and may be necessary to take steps you request before entering a contract.
• Operating official communities: to manage roles, enforce community rules, investigate abuse, and protect members. This supports our legitimate interests in community safety and service integrity.
• Meeting legal obligations: to comply with applicable law, lawful requests, recordkeeping obligations, or the establishment, exercise, or defence of legal claims.
• Consent: where we specifically ask for consent for an optional purpose. You may withdraw that consent at any time, without affecting processing that was lawful before withdrawal.

6. Cookies and similar storage

The website stores your analytics choice in your browser's local storage under the key cf_analytics_consent. This prevents the site from repeatedly asking the same question. It is not used to identify you across websites and can be changed through any Privacy choices link on this site.

Cloudflare automatically injects two scripts into public HTML responses:

• Email Address Obfuscation hides published email addresses from automated harvesting and decodes them for human visitors.
• Cloudflare Web Analytics measures page views and loading performance without tracking individuals across websites.

Cloudflare's security systems may set strictly necessary cookies when needed to deliver or protect the website, including during bot or security challenges.

If you choose Allow analytics, Google Analytics loads and may set first-party cookies such as _ga and a property-specific _ga_* cookie to distinguish visits and sessions. If you choose No thanks, the Google tag is not loaded and no data is sent to Google Analytics by this website. You may withdraw permission by reopening Privacy choices and choosing No thanks. You may also delete existing analytics cookies through your browser.

If we introduce advertising, personalisation, or another nonessential use, we will update this Policy and obtain consent where required before that use begins.

Open privacy choices

7. How information is shared

We do not sell or rent personal information. We may disclose limited information to:

• Cloudflare, which provides content delivery, network security, email-address obfuscation, request analytics, and privacy-first web-performance analytics;
• Google Analytics, only after you allow analytics, to provide visit and session measurement;
• other hosting, email, security, and information-technology providers that process information to provide services to us;
• third-party community platforms when you choose to use those platforms;
• professional advisers such as legal, accounting, or security advisers where reasonably necessary and subject to appropriate duties;
• law-enforcement, regulators, courts, or other parties where required by law or reasonably necessary to protect rights, safety, or service integrity; and
• a successor or prospective successor in a merger, restructuring, financing, or sale of all or part of the business, subject to appropriate confidentiality and legal safeguards.

Service providers may process information only for the service they provide to us and under their applicable contractual and legal duties.

8. International processing

Some service providers or community platforms may process information outside South Africa or outside the country where you live. Where applicable law requires it, we use a lawful transfer mechanism or another appropriate safeguard and consider whether the recipient provides an adequate level of protection.

You may contact us for more information about safeguards relevant to your information.

9. Security

We use reasonable technical and organisational measures appropriate to the nature and risk of the information processed. These measures may include access controls, transport encryption, credential protection, software maintenance, limited access, and provider security controls.

No internet transmission or storage method is completely secure. If we identify a personal-information breach, we will investigate and provide legally required notices to affected people and regulators.

10. Retention

We retain personal information only for as long as reasonably necessary for the purpose described in this Policy, unless a longer period is required or allowed by law.

• Technical logs: retained according to the shortest operational period reasonably needed for hosting, security, abuse prevention, and troubleshooting, then deleted or de-identified, subject to the hosting provider's controlled backup cycle.
• Cloudflare Web Analytics: Cloudflare states that unsampled beacon data is retained for seven days and then aggregated to a smaller dataset. Performance reports are available to us for the period Cloudflare makes them available in its dashboard.
• Google Analytics: retained according to the data-retention settings applied to the CursedForge Analytics property and Google's applicable provider obligations. You may ask us for the current setting.
• Analytics preference: retained in your browser until you change it, clear site storage, or the browser removes it.
• Correspondence: retained until the matter is resolved and for any further period reasonably needed for continuity, legal compliance, or dispute records.
• Community moderation records: retained while relevant to community safety, repeat-abuse prevention, appeals, or enforcement, and reviewed when no longer needed.

Information may remain in protected backups until those backups are overwritten through the normal backup cycle.

11. Your privacy rights

Depending on the law that applies to you, you may have rights to:

• ask whether we process your personal information and request access to it;
• request correction of inaccurate or incomplete information;
• request deletion or restriction where the legal requirements are met;
• object to particular processing, including direct marketing;
• withdraw consent where processing relies on consent;
• request portability of information you provided where applicable; and
• complain to an applicable privacy regulator.

Send requests to legal@cursed-forge.com. We may ask for information reasonably necessary to confirm your identity and locate the relevant records. We will respond within the period required by applicable law.

These rights can be limited where an exemption applies or where fulfilling a request would adversely affect another person's rights. If we cannot fulfil a request, we will explain the reason where the law allows.

12. Children

The website is not directed to children under 13 and does not knowingly collect personal information from them. Official interactive community spaces require users to meet the applicable platform age requirement and any higher minimum required by local law.

If you believe a child has provided personal information to us contrary to these requirements, contact us so that we can investigate and take appropriate action.

13. Third-party services

Links to Discord, Meta, social networks, or other third-party services take you to independently operated services. Their privacy policies govern their processing. Review those policies before providing personal information.

We are not responsible for an independent third party's privacy practices. This does not reduce any responsibility we have for information that we ourselves receive or control.

14. Changes to this Policy

We may update this Policy when the website, project, community features, providers, or law changes. The effective date at the top identifies the current version. If a change materially affects how we process personal information, we will provide reasonable notice and obtain consent where required.

15. Contact and complaints

For privacy questions or requests, contact:

If you are in South Africa and believe your personal information has been processed in breach of the Protection of Personal Information Act, you may also complain to the Information Regulator of South Africa. If another privacy law applies to you, you may complain to the competent authority in your jurisdiction.