1. Scope and who we are
This policy applies to bedriox.com, marketplace.bedriox.com, and the related Bedriox account, publishing, download, review, discussion, and support experiences (together, the “Services”). Bedriox is an open-source community project. Questions or privacy requests can be sent to [email protected].
2. Information we collect
Information from OAuth providers
When you sign in with GitHub or Discord, we receive the provider account ID, display name or username, verified email address, and avatar made available through the permissions shown during sign-in. We use the immutable provider ID to recognize the account. OAuth access tokens are used to retrieve the sign-in profile and are not intentionally retained by Bedriox after that sign-in request completes.
Account and marketplace activity
We store information you provide or create, such as profile details, plugin listings, source and release submissions, gallery images, downloads, purchase entitlements, reviews, developer responses, comments, reactions, reports, moderation decisions, support correspondence, and seller-readiness state. If following features are available, follower and following relationships are also stored.
Connected GitHub repositories
If you install the Bedriox GitHub App for marketplace publishing, we process the selected repositories’ IDs, names, visibility, metadata, README, tags, release notes, release assets, and tagged source archives. The App has read-only access to repositories you explicitly grant. Short-lived installation tokens are not stored as account records, and private repository URLs or source are not made public merely because the App can read them.
Technical information
Our servers may record IP address, browser and device information, requested pages, referring pages, timestamps, errors, and security events. We use essential session and security cookies. A theme preference may be stored in your browser and in a non-sensitive cookie shared across Bedriox subdomains. After a successful sign-in, the marketplace stores only the name of the OAuth provider you used—GitHub or Discord—for up to 180 days so the sign-in page can mark it as your last-used method. This preference does not contain your username, email address, or provider account ID.
Website analytics
We use Google Analytics to understand visits across the main website, documentation, and marketplace. It may process page views, referring pages, approximate location, browser and device information, interaction events, and online identifiers, and may use cookies or similar browser storage. We use this information to understand aggregate usage and improve Bedriox, not for third-party targeted advertising.
Payments
Stripe processes marketplace checkout, seller onboarding, and optional Bedriox supporter contributions. Bedriox may receive transaction and customer identifiers, amounts, subscription status, billing dates, connected-account status, and limited billing details needed to operate those services. Bedriox does not intend to store full payment-card or bank-account numbers.
Supporter badges and Discord roles
If you support Bedriox, we store contribution and membership status, badges earned, and related delivery history. If you link Discord, we use your Discord account ID and an authorized bot to confirm membership in the official server and add or remove applicable community roles. We do not store a Discord password.
3. What is public
Your username, avatar, public profile, featured or earned badges, published plugins and releases, reviews, comments, reactions, developer responses, and follower or following relationships may be visible to anyone and may be indexed by search engines. Public GitHub repositories and publisher-provided support links are displayed with applicable plugin listings. After an eligible contribution, your username and chosen profile picture appear on the public supporter wall as a Backer or active Supporter by default; you can turn this off at any time from supporter settings. Contribution amounts, billing history, payment dates, and Discord account details are never shown there. Do not post secrets or personal information you do not want made public.
Pending submissions, private source-review archives, security reports, account email addresses, and staff-only moderation information are not intended to be public.
4. How we use information
- Authenticate accounts and maintain account security.
- Host, review, publish, deliver, and improve plugins and community content.
- Record downloads, enforce review eligibility, and provide purchase entitlements.
- Detect malware, fraud, abuse, policy violations, and service failures.
- Understand aggregate website and documentation usage.
- Moderate submissions, respond to reports, and keep an audit history.
- Provide support and send operational, security, moderation, and account messages.
- Comply with legal obligations and protect users, Bedriox, and the public.
Bedriox does not sell personal information or use it for third-party targeted advertising.
5. Email delivery
Bedriox may use an email-delivery provider. To deliver a message, that provider may process the recipient address, message content, sender information, delivery metadata, IP address, and delivery or bounce events. If optional email open or link-click tracking is enabled for a particular message, the provider may also process open events, clicked links, timestamps, and related technical data. We will use such tracking only for delivery reliability or understanding Bedriox communications, not third-party advertising.
You can opt out of non-essential messages using an unsubscribe option when one is provided. Account, transaction, moderation, legal, and security messages may still be sent when necessary to provide the Services.
6. When information is shared
We share information only as reasonably needed with service providers that help operate the Services, such as hosting, website analytics, email delivery, OAuth identity providers, security services, and—if enabled—payment processing. Those providers process information under their own terms and privacy commitments.
We may also disclose information when required by law, to respond to valid legal process, to investigate security or abuse, to protect rights and safety, or as part of a project reorganization where the recipient accepts appropriate privacy obligations. Public content is shared according to the choices you make when posting it.
7. Retention and deletion
Account data is generally kept while the account remains active. Public content and marketplace records are kept while needed to operate listings, releases, community history, and download entitlements. Security logs, moderation records, support messages, backups, and transaction records may be retained for a reasonable period after an account closes, or longer when required for fraud prevention, disputes, accounting, legal compliance, or protection of the Services.
To request account deletion or access to your information, email [email protected] from the account email and describe the request. We may need to verify ownership. Deletion may remove or anonymize public content instead of erasing it when retaining the surrounding discussion, moderation record, license record, or transaction history is reasonably necessary. Copies can remain temporarily in protected backups until they rotate.
8. Your choices and rights
You can choose what you publish, change supported profile details through the connected provider, control theme storage in your browser, use browser privacy controls or a supported analytics opt-out tool, and stop using the Services. Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information. Contact us to exercise an applicable right. You may also complain to your local data-protection authority.
9. Security, age, and international processing
We use reasonable technical and organizational safeguards, but no online service can promise absolute security. Report suspected account compromise or a private security issue to [email protected]; do not disclose exploitable details in public comments or Discord channels.
The Services are not directed to children who cannot legally consent to account processing in their location. If you believe a child provided information without required permission, contact us. Bedriox and its service providers may process information in countries other than yours, subject to applicable safeguards.
10. Changes and contact
We may update this policy as the Services change. Material changes will be identified by a new “Last updated” date and may also be announced through the website or an account message. Questions about this policy, privacy, legal matters, security, or licensing can be sent to [email protected].