Privacy Policy

ModParks ("we", "the site") sets out below how we handle personal information.

1. Operator and contact

Operator: ModParks operator (Pitan76)
Contact: admin@pitan76.net

Questions about personal data, requests for disclosure, and complaints are handled at the address above.

2. Information we collect

Account information: email address, username, display name, profile image, credentials (passwords are stored hashed), two-factor and passkey settings
Information from linked accounts: Google or GitHub account identifier, email address, display name, profile image URL
Content you submit: projects, versions, uploaded files, comments, ideas, collections, and reports
Usage information: IP address, user agent, access time, browsing and download history, and identifiers stored in cookies
Reward information: point ledger entries and payout destinations such as a PayPal email address (stored encrypted)
Notification information: push notification endpoints and keys, and your notification settings

3. How we use it

Providing the service, creating accounts, and authentication
Publishing and distributing submitted content
Sending notifications and responding to enquiries
Producing statistics such as download counts, and calculating and paying creator rewards based on them
Detecting and preventing abuse, malware distribution, rights infringement, and excessive load
Complying with law and handling breaches of the Terms of Service
Maintaining and improving the service

4. Cookies and transmission to external parties

We use cookies to keep you signed in and to remember display settings. Information is also sent from your device to third parties for analytics (Google Analytics) and advertising (Google AdSense). The information sent, its recipients, the purposes, and how to opt out are described in our External Transmission Policy at https://modparks.pitan76.net/external-transmission

5. Disclosure to third parties

We do not disclose personal data to third parties without your consent, except:

Where required by law
Where necessary to protect someone's life, body, or property and consent is difficult to obtain
Where disclosure of sender information is legally required in response to a rights infringement claim

6. Processors and their supervision

We entrust personal data to the following providers to the extent needed to run the service, and supervise them appropriately.

Cloudflare, Inc. (United States): hosting, database, and storage and delivery of uploaded files
Google LLC (United States): analytics, advertising, backup storage (Google Drive), and Google account linking
Resend, Inc. (United States): sending authentication and notification emails
PayPal (United States and local affiliates): paying out rewards
GitHub, Inc. (United States): GitHub account linking

7. Storage outside Japan

All of the providers above are located outside Japan, mainly in the United States, and data may be stored on servers there. We take account of the data protection regimes in those countries and rely on our agreements with those providers and on the safeguards they publish.

8. Security measures

Encryption in transit (HTTPS) and at rest (hashed passwords, encrypted payout details)
Restricted administrative access with an audit log of administrative actions
Rate limiting on authentication, submissions and downloads, and detection of unusual access
Scanning of uploaded files, with distribution blocked for files judged dangerous
Regular backups

9. Operator access to unlisted and private content

For projects set to unlisted or private (including drafts), archived files, and other non-public data, the operator is technically able to access the content. We state this plainly rather than claiming otherwise. In practice we operate as follows:

We do not look at this content in the course of normal operation.
We access it only in these cases: handling a report from a user or rights holder, investigating abuse or a security incident, complying with the law, and responding to an outage or performing maintenance where it is necessary.
When an administrator downloads a non-public file, the access is written to our audit log.
Viewing content out of curiosity, to monitor users, or for any purpose other than those above is prohibited.

Unlisted means "visible to anyone with the link"; it does not mean the content is kept secret. Please do not upload anything you cannot afford to have seen.

10. Retention and deletion

We keep personal data for as long as needed for the purposes above, or as required by law. When you close your account we delete your account information and data that identifies you, except:

Records we are legally required to keep, or that are needed to handle a dispute
Information already published and inseparable from other users' content, such as quoted comments
Statistics processed so that individuals cannot be identified
Copies held in backups, which are erased as those backups expire

You can export your data from the settings page before closing your account.

11. Your rights

You may request disclosure, correction, addition, deletion, suspension of use, suspension of disclosure to third parties, and notification of the purpose of use, for your own personal data. Contact us from your registered email address at the address in section 1. We will verify your identity and respond as required by law. There is no fee.

12. Data breaches

If personal data is leaked, lost, or damaged in a way that risks harming users, we will report it to the Personal Information Protection Commission as required by law and notify affected users promptly.

13. Minors

If you are a minor, please use the service with the consent of a parent or guardian. Consent is required for features involving money, such as reward payouts.

14. Changes

We may revise this policy to reflect changes in law or in the service. Significant changes will be announced on the site.

Effective: 15 August 2026