Privacy Policy

Last Updated: October 2, 2026

1. Information We Collect

DupeDB is operated by Vibe Archives LLC, the data controller responsible for the personal information described in this policy.

1.1 Account & Sign-in Information

You can sign in with Discord, Google, GitHub, or an email address and password, and link more than one of these to the same account. Every account has:

Username — a handle you choose (publicly visible). You can change it once every 30 days.
Display name and avatar — optional, publicly visible. When you sign up with Discord, Google or GitHub, we copy that account's profile picture once as your starting avatar; it does not update from the provider afterwards, and you can change or remove it any time. If you later hide your Discord profile, an avatar copied from Discord is removed.

Depending on how you sign in, we also store:

Discord — your Discord user ID, username and avatar. If you choose to join our community Discord server at login, we also store your Discord OAuth tokens (access + refresh) in encrypted form. We never receive your Discord email, password, messages, or DMs. See Section 2.
Google or GitHub — that account's ID, its name (Google) or username (GitHub), its email address and whether the provider has verified it. We do not store Google or GitHub access tokens and never see your password there.
Email and password — your email address and your password, stored only as a salted one-way hash (we never store or see the password itself).

Email addresses are never shown publicly. We use them to sign you in, to recognize that two sign-in methods belong to the same person, and to send account emails (see Section 3).

1.2 Automatically Collected Information

IP Address — we record the IP address you sign in from, and the address behind certain logged actions, and use it to detect VPNs and proxies, handle abuse reports, and enforce bans (including IP bans). Kept for up to 18 months from your last activity, or as long as an active IP ban references it. Our usage analytics, error logs and server logs store only a one-way hash of your IP address, not the address itself.
Session Data — temporary login tokens (expire after 7 days).
Ban Records — if an account is banned, we keep the Discord, Google and GitHub account IDs and the verified email addresses linked to it, so the same person can't sign up again another way. Staff can also block a sign-in account or email address before it is ever used. See Section 9.
Page Views — when you open an exploit while logged in, we record one view per exploit tied to your account so each viewer is counted once. See Section 9 for retention and what happens on account deletion.

1.3 User-Generated Content

What you submit — exploits (name, description, media, versions), comments, votes, and bounties (a public request for an exploit on a plugin or server, plus an optional message) — is publicly visible and shown alongside your DupeDB username and display name. If you enable "Hide Discord Profile" in settings, nothing public links your DupeDB account to your Discord account.

Bounty subscriptions. Subscribing to a bounty records which bounty you follow so we can notify you when it is filled. A bounty's public "waiting" count is aggregate only. However, when a bounty you subscribe to is filled and you are a member of our community Discord server, our Discord bot may @mention you in that bounty's public Discord thread — disclosing your interest in that bounty to others in the thread. Unsubscribe at any time to stop these notifications.

Discord. When you sign in with Discord, we ask whether you want to join our community Discord server — your choice determines what we request from Discord:

If you join: we request identify and guilds.join, add you to the server, and store your encrypted OAuth tokens so we can re-add you to a successor server if we ever migrate. You can leave the server any time.
If you opt out: we request only identify. No server-add, no OAuth tokens stored.

In both cases identify shares only your Discord user ID, username, and avatar. We never see your password, messages, DMs, friends, or other servers. Revoke access any time via Discord → Authorized Apps.

Google. We request openid, email and profile: your Google account ID, name, email address (and whether Google verified it) and profile picture. Revoke access any time in your Google Account → Security → Third-party connections.

GitHub. We request read:user and user:email: your GitHub user ID, username, profile picture and your verified primary email address. Revoke access any time in GitHub → Settings → Applications → Authorized OAuth Apps.

Email and password. We send a confirmation link before the account can be used, and links to reset a password or confirm a new address when you ask for them. These links are stored only in hashed form and expire within 1 to 24 hours.

An email address that a provider has verified is used to join that sign-in to an existing DupeDB account with the same verified address, so you don't end up with two accounts. You can see and remove linked sign-in methods under Account → Security → Sign-in Methods (you must keep at least one).

3. How We Use Your Information & Legal Basis

For users in the EEA, UK, or Switzerland, the GDPR Article 6 legal basis is noted per purpose:

Provide the Service — display exploits, process submissions, show comments. (Art. 6(1)(b) — contract.)
Identify You — show your username, display name and avatar on your contributions. (Art. 6(1)(b) — contract.)
Sign-in & Account Emails — sign you in with the methods you linked, and send confirmation, password-reset and security notices (for example when your password or email changes). We send no marketing email. (Art. 6(1)(b) — contract.)
Prevent Abuse — detect and block malicious users, record IP addresses to detect VPNs and proxies and investigate abuse reports, enforce bans and IP bans, and block banned sign-in accounts and email addresses from signing up again. (Art. 6(1)(f) — legitimate interests.)
Moderation — review and manage user content. (Art. 6(1)(f) — legitimate interests; Art. 6(1)(b) for the submitter.)
Community Discord Server (optional) — add you to our server if you grant guilds.join. (Art. 6(1)(a) — consent; withdraw any time by leaving the server or revoking DupeDB in Authorized Apps.)
Legal Compliance — respond to lawful requests and protect our rights. (Art. 6(1)(c) — legal obligation; Art. 6(1)(f) — legitimate interests.)

4. Data Storage & Security

Passwords — only for email sign-in, and only as a salted scrypt hash; plain passwords are never stored. Discord, Google and GitHub handle their own authentication.
Session tokens — cryptographically random, and stored only as a one-way hash, so our database never holds a usable sign-in.
IP addresses — kept only in our moderation records, where the server uses them to enforce IP bans and spot linked accounts. They are never shown on the site, including to staff. Analytics, error logs and server logs store an HMAC-SHA256 hash instead.
OAuth token encryption — Discord tokens are encrypted at rest with AES-256-GCM.
Security headers + CSRF protection — standard web hardening; OAuth state tokens prevent CSRF.

No method of internet transmission is 100% secure. We take reasonable precautions but cannot guarantee absolute security.

5. Cookies & Local Storage

DupeDB uses minimal client-side storage:

Session cookie — keeps you signed in (expires after 7 days)
Security cookies — a short-lived cookie that ties a Discord, Google or GitHub sign-in to the browser that started it, and a cookie that protects against cross-site request forgery
User Preferences — May store filter/sort preferences locally

We do not use third-party tracking cookies or advertising cookies.

6. Third-Party Services

We rely on the following third-party services. Each may receive your IP address when your browser connects to them. Apart from what is described for each below, we do not share other personal information with these providers:

Cloudflare — Our network and security provider: every request to DupeDB passes through Cloudflare, which sees your IP address and the request. Its Turnstile check runs on the email sign-in, sign-up, resend and password-reset forms to tell people from bots (sign-in only requires it after failed attempts); Cloudflare uses that data to run the check, not for advertising. Subject to Cloudflare's Privacy Policy.
proxycheck.io — When a sign-in uses an account or email address that is banned from DupeDB, our server sends that sign-in's IP address (and nothing else about you) to proxycheck.io to check whether it belongs to a VPN, proxy, datacenter or mobile network. If it doesn't, the address is IP-banned for 90 days. Subject to proxycheck.io's Privacy Policy.
Discord — For signing in with Discord and the optional community server (subject to Discord's Privacy Policy).
Google — For signing in with Google if you use it, and Google Workspace delivers our account emails (so it receives your email address and the message). Subject to Google's Privacy Policy.
GitHub — For signing in with GitHub if you use it (subject to GitHub's Privacy Statement).
YouTube — When users embed YouTube videos in submissions, we use the privacy-enhanced youtube-nocookie.com domain for video playback. Video thumbnails load from img.youtube.com, which may receive your IP address. Subject to Google's Privacy Policy.
Modrinth — Plugin and mod icons load from cdn.modrinth.com, which may receive your IP address. Download counts and other metadata are fetched by our servers, not your browser. Subject to Modrinth's Privacy Policy.
jsDelivr (cdn.jsdelivr.net) — Public CDN used to load the optional Discord widget on our contact page (only after you choose to load it).
WidgetBot — Renders the embedded Discord widget on our contact page (only if you click to load it). Subject to WidgetBot's Privacy Policy.

For server plugins, we also retrieve public plugin metadata (icon and download count) from SpigotMC via the Spiget API.

We do not sell, trade, or share your personal information with third parties for marketing or advertising purposes. We do not use third-party analytics or advertising trackers.

We do collect first-party, privacy-respecting usage analytics to understand how the site is used (e.g. which pages are visited, searches, and key actions).

7. Data Sharing

We share information only in these cases:

Public content — your submissions, comments, bounties, username, display name and avatar are publicly visible, as is your Discord profile unless you hide it.
Bounty notifications — when a bounty you subscribe to is filled, the Discord user IDs of its subscribers are shared with our Discord bot so it can notify them, which may include @mentioning you in that bounty's public thread in our community Discord server. This applies only if you are a member of that server. See Section 1.3.
Abuse reports — when we report abuse to, or answer an abuse report from, a network or hosting provider, we may include the IP addresses and account details involved.
Legal requirements — when required by law or valid legal process.
Protection — to protect our rights, safety, or property.

8. Your Rights

All users have the right to:

Revoke Access — Remove a sign-in method under Account → Security → Sign-in Methods, or disconnect DupeDB at the provider (Discord Authorized Apps, Google third-party connections, GitHub Authorized OAuth Apps).
Account Deletion — Delete your account under Account → Settings → Danger Zone (banned or timed-out accounts: contact us). See Section 12 for how account deletion interacts with verified content.

If you are in the EEA, UK, or Switzerland, you also have these rights under GDPR / UK GDPR:

Right to rectification (Art. 16) — Correct inaccurate or incomplete personal data. Change your username, display name, avatar and sign-in email in the account menu.
Right to erasure (Art. 17) — Request deletion of your data. You can delete individual comments from "My Comments"; account-level deletion is described in Section 12. Exception: verified sightings can't be self-deleted (they're public affected-server records) — contact us to request removal.
Right to restriction (Art. 18) — Request that we limit processing of your personal data in specific circumstances.
Right to object (Art. 21) — Object to processing based on legitimate interests, including our abuse-prevention processing of IP addresses.
Right to withdraw consent (Art. 7) — Withdraw consent for any consent-based processing at any time. Withdrawal does not affect the lawfulness of prior processing.
Right to lodge a complaint — File a complaint with your local data protection supervisory authority. A list is available at edpb.europa.eu/about-edpb/about-edpb/members_en.

To exercise any right, open a ticket in our Discord #create-ticket channel (fastest) or email contact@dupedb.net. We respond within 30 days and may verify your identity through a sign-in method linked to your account before acting.

9. Data Retention

Account Data — Retained while your account is active. Deleted (or pseudonymized — see Section 12) when you delete your account.
Session Data — Expires after 7 days. Changing or resetting your password signs out your other sessions.
Sign-in Methods & Email Addresses — Kept while linked to your account; removed when you unlink them or delete your account. A sign-up that is never confirmed is deleted after 7 days.
Email Links — Confirmation and reset links are stored only as hashes, expire within 1 to 24 hours, and are purged within a day of being used or expiring.
Discord OAuth Tokens — Only stored if you joined the community Discord server at login. When stored: encrypted at rest, cleared if Discord invalidates them (e.g., you revoked DupeDB in Authorized Apps), deleted with your account.
Ban Records — Account IDs and email addresses blocked because of a ban are kept until the ban is lifted, including after the banned account is deleted.
IP Addresses — Retained for up to 18 months from your last activity, or as long as an active IP ban references the address, whichever is longer. IP hashes in analytics, error logs and server logs follow the retention of those records.
Public Content (verified) — Retained indefinitely as part of the public archive. Authorship may be pseudonymized after account deletion — see Section 12.
Bounties & Subscriptions — Bounties are retained while open; your bounty subscriptions are kept until you unsubscribe or delete your account. On account deletion, bounties you created are pseudonymized (see Section 12) and your subscriptions are removed.
View Records — For logged-in viewers, we keep one (account, exploit, timestamp) row per exploit you've opened so the counter is deduplicated. When you delete your account, the account reference on these rows is anonymized (the user link is removed) but the (exploit, timestamp) entries are retained as part of the aggregate per-exploit totals.

10. Children's Privacy

DupeDB is not intended for children. We do not knowingly collect personal information from anyone below the minimum age in their jurisdiction (13 in the US and UK; 13–16 in EEA member states under GDPR Article 8). If you believe a child has provided personal information to us, contact us as described in Section 8 and we will delete the account.

11. International Data Transfers

DupeDB is operated from the United States and hosted on servers in the Netherlands (European Union). For EEA / UK users, your data stays within the EU when stored and processed. For users outside the EU, your data is transferred to and processed in the Netherlands under EU data-protection law.

Where required by GDPR / UK GDPR, we rely on appropriate safeguards for transfers between the EU and US (e.g., Standard Contractual Clauses, the UK IDTA). For details, contact us as described in Section 8.

12. Account Deletion & the Public Archive

You can delete your DupeDB account at any time under Account → Settings → Danger Zone, or by contacting us as described in Section 8. A banned or timed-out account can't be deleted from the account menu; ask us through support and we will delete it, keeping the ban records described below. When your account is deleted:

Hard-deleted: your comments, replies, unverified sightings, votes, bounty subscriptions, session data, linked sign-in methods and email addresses, password hash, stored OAuth tokens (if any), notifications you triggered for others, and every exploit submission that was not verified (drafts, pending and rejected).
Pseudonymized: your verified exploits, verified sightings, and bounties stay in the public archive. The displayed author is replaced with "[deleted]" and the user-ID link is removed. Credits naming you on other people's exploits become "[deleted]" too, with the link to your account and Discord profile removed. Verified exploit and sighting content remains under the CC BY 4.0 license you granted at submission.
Unlinked: moderation (audit) records stay, with your name and the text of your comments removed; usage analytics, error and failed sign-in records stay only until their normal expiry, with the link to your account removed.
Retained: if you had an active ban, the IP address, sign-in account IDs and email addresses linked to it are kept per Section 9 to prevent evasion.

You can also delete individual comments any time from "My Comments" (verified sightings are the exception — see Section 8). If a specific verified submission or sighting warrants full removal rather than pseudonymization (e.g., it contains personal information), contact us.

13. California Privacy Notice

For California residents: DupeDB is a non-commercial, free service and does not meet the CCPA / CPRA revenue or volume thresholds. We voluntarily commit to:

No sale or sharing of personal information (as defined under California law). No cross-context behavioral advertising.
Categories collected: identifiers (username, avatar, email address, and Discord, Google or GitHub account IDs and usernames for the sign-in methods you link), internet activity (IP address, per-account exploit view records), and user-generated content (submissions, comments, votes, bounties). Sources, purposes, and retention are in Sections 1, 3, and 9.
Deletion and correction requests — contact us as described in Section 8.
No discrimination for exercising these rights.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date.

We encourage you to review this Privacy Policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.