velken

Velken / Privacy Policy

Privacy Policy

Last updated: [DATE — fill this in when you publish]

This reflects New York law as of when it was written, filled in for your situation as an individual (not a registered business) based in New York. It is still not legal advice, and laws — especially around minors' data — are actively being clarified through new regulations. Have a lawyer confirm this before you rely on it, particularly the sections on minors and arbitration below.

1. Who this covers

Velken is operated by an individual based in New York State — not a registered company. This policy applies to velken's website, the audit request form, the reviewer portal, and the Community Panel. It does not cover the Discord servers being audited, which have their own separate rules and privacy practices.

2. What we collect

When you submit an audit request, we collect what you enter into the form: your name or username, Discord tag, the server name and invite link, your selected focus area, and any additional details you provide.

If you use the Community Panel, you sign in with Discord instead of creating a password. Discord shares with us your Discord user ID, username, and avatar (nothing else — we only request the minimum "identify" permission, not access to your messages, servers, or friends list). We never see or store a Discord password; that's handled entirely by Discord itself.

Reviewers sign in the same way — through Discord, not a separate email/password account. An admin controls who has reviewer access, and separately holds a profile for each reviewer (name, role, and status) in addition to what Discord verifies.

If you rate a community, we collect the star rating and the time it was submitted. Ratings aren't linked to your name or account.

We do not knowingly collect payment information, government ID numbers, or sensitive categories of data (health, biometric, etc.) through this site.

3. How we use it

  • To review and respond to audit requests, including re-audit requests
  • To verify your identity through Discord sign-in and operate the Community Panel and the separate reviewer portal (role management for reviewers)
  • To publish organisation records you or a reviewer choose to make public (score, category, compliance status, rank, and any testimonial quote you've agreed to have shown)
  • To send the rank-announcement Discord embed when a record is published, if that's configured
  • To improve the service and fix problems

We do not use your information for advertising, behavioral profiling, or targeted marketing, and we do not sell it.

4. Who we share it with

We use third-party infrastructure to run this site, and your information passes through their systems as a normal part of that:

  • Discord — if you sign in to the Community Panel, Discord is who actually verifies your identity and shares your user ID, username, and avatar with us for that purpose. If a webhook is configured, a summary of a request or a published record is also posted to a Discord channel separately.
  • Google Firebase (Authentication and Firestore database) — stores account, audit-request, and rating data, and is where your signed-in session actually lives once Discord has verified you
  • Vercel — hosts the website itself and runs the one small server-side function that talks to Discord during sign-in (this function is the only part of our system that ever receives Discord's own sign-in secret, and it uses that solely to complete your sign-in)

We don't sell personal information to third parties, and we don't disclose a minor's personal data to third parties without a written agreement restricting its use.

5. Where data is processed

Because we rely on global infrastructure providers (Discord, Firebase, and Vercel), your information may be processed or stored in countries other than your own, or outside New York State. By using this site, you understand your information may cross borders as part of how these services operate.

6. How long we keep it

[State your actual retention period here — e.g. "Audit requests are kept for X months after resolution" or "until you ask us to delete them."] Published organisation records are kept until unpublished, deleted, or a takedown is requested. If we learn a user is under 18 and we don't have a valid basis to keep processing their data (see Section 9), we'll delete it rather than retain it.

7. Your rights

To access, correct, export, or delete your personal information — or to ask what we hold about you — contact me@xyzvu.online. New York does not currently have a general consumer privacy law giving automatic access/deletion rights the way some other states do, but we'll honor reasonable requests regardless. If you're a parent or guardian requesting deletion of a minor's data, say so in your message.

8. Data security (New York SHIELD Act)

We take reasonable administrative, technical, and physical steps to protect the security, confidentiality, and integrity of your information, consistent with New York's SHIELD Act (N.Y. Gen. Bus. Law § 899-aa/bb) — this applies to us regardless of being a small, individually-run project rather than a registered company. If a breach affecting New York residents' private information occurs, we will notify affected users within 30 days of discovering it, as the SHIELD Act requires.

9. Cookies and local storage

This site does not use advertising or tracking cookies. Signing in to the Community Panel or reviewer portal uses browser local storage to keep you signed in (via Firebase Authentication) and to remember that you've already rated a community — this is necessary for those features to function and isn't used for tracking across other sites. When you sign in to the Community Panel, you're briefly redirected to Discord's own website to approve the sign-in — anything Discord's site does with cookies during that moment is governed by Discord's own privacy policy, not this one.

10. Minors' privacy (13–17, and under 13)

Under 13: We don't knowingly collect personal information from anyone under 13, consistent with the federal Children's Online Privacy Protection Act (COPPA). If we learn someone under 13 has provided us information, we'll delete it.

13–17 (New York residents): Under the New York Child Data Protection Act (effective June 2025), we only process a minor's personal data with their informed consent, or where it's strictly necessary to provide the service they've asked for (for example, processing an audit request they submitted). Specifically:

  • We don't use a minor's data for targeted advertising, behavioral profiling, or to prompt an inactive minor user back to the service.
  • We don't sell a minor's personal data or disclose it to third parties except as described in Section 4, under a written agreement restricting its use.
  • Submitting the audit request form or signing in to the Community Panel with Discord as a 13–17 year old constitutes your informed consent to the processing described in this policy, for the purpose of providing that specific service.
  • If you're a minor (or a parent/guardian of one) and want data deleted, contact me@xyzvu.online — we'll delete it unless we have a valid basis under this policy to keep it (like an active, unresolved audit request).

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

12. Contact

Questions about this policy, or to make a privacy request: me@xyzvu.online.