Privacy Policy
Last updated 18 October 2026
This policy explains what personal data Celestia collects, why, and what you can do about it. Aegis Networks is responsible for your data (the “controller”). For privacy questions, email no-reply@celestiamods.com.
In short: we collect only what’s needed to run the site. No ads, no analytics or tracking, no data sold or shared for marketing, and no third-party scripts, fonts or embeds on our pages.
What we collect and why
| Data | What it’s for | Legal basis |
|---|---|---|
| Username, email address, password | Your account. The password is stored only as an Argon2 hash; we can’t read it. | Providing the service you signed up for |
| Avatar and bio | Your public profile | Providing the service |
| Mods, files, images, descriptions, comments, ratings | Publishing and showing what you share | Providing the service |
| Follows and notification settings | Telling you about updates you asked for | Providing the service |
| The date you accepted these terms, and which version | Showing what you agreed to | Legal obligation and our legitimate interest |
| Reports, legal notices, moderation decisions and their reasons | Keeping the site safe and handling complaints | Legal obligation and our legitimate interest |
| Sign-in sessions and API tokens | Keeping you signed in and letting your tools publish. We store only a hash of each token. | Providing the service |
| Your IP address | Limiting repeated sign-in attempts and abuse, and counting each download once. We store only a keyed hash of your IP address, never the address itself, and delete it after an hour. We don’t keep access logs of visits. | Our legitimate interest in security |
| Download counts | Statistics per mod and day, not linked to you | Our legitimate interest |
| Technical error details | When something breaks, we record the page address, the error and where in our code it happened, never passwords, cookies or what you typed. | Our legitimate interest in a working site |
If you connect a public source repository to your mod, we download that repository to rebuild and compare your mod, and publish the comparison report and build log on the site.
Emails
We email you to confirm your address, reset your password, and, if you leave it switched on in Settings, about approvals, comments, team invitations and new versions of mods you follow. You can switch notifications off at any time; account and security emails can’t be switched off.
What’s public
Your username, avatar, bio, mods, comments, ratings and the mods you help maintain are public, and can also be read through our API. Your email address, follows, reports and settings are never public.
How long we keep data
- Your account and content: until you delete them.
- When you delete your account: your email, password, avatar, bio, sessions, API tokens, follows and notifications are erased right away, and mods you own are deleted. Comments stay visible as “Deleted user”, without anything that identifies you.
- Reports, legal notices and moderation records: as long as needed to handle disputes and meet legal obligations, normally up to 12 months after they’re closed.
- Backups: up to 30 days, after which deleted data is gone from them too.
- Server logs: we don’t log visits. Error and warning logs are rotated automatically and overwritten within days; connection errors there can include an IP address.
Your rights
You can:
- get a copy of your data: Settings, then “Download my data” (a JSON file)
- correct it: edit your profile and email in Settings
- delete it: Settings, then “Delete my account”
- object to or restrict some uses, and withdraw consent for optional emails
- complain to a data protection authority, for example the one where you live
For anything else, email no-reply@celestiamods.com. We answer within one month.
Children
You must be at least 13 to create an account. If you think a younger child has an account, tell us at no-reply@celestiamods.com and we’ll delete it.
Security
Passwords are hashed with Argon2, connections use HTTPS, sessions and tokens are stored as hashes, and every uploaded file is checked before it’s published. No system is perfectly secure; if a breach affects your data, we’ll tell you and the authorities as the law requires.
Changes
If we change this policy in a way that matters, we’ll tell you on the site and by email before it applies. The date at the top shows the current version.