Privacy Policy

This policy explains what information STALCRAFT Meta (stalcraftmeta.com) collects, why, where it goes and how long it is kept. It describes how the site works today.

1. What this policy covers

STALCRAFT Meta is an independent community project that provides tools, guides and reference pages for the game STALCRAFT. It is created and run by one person, milkdudofafrica, and is not affiliated with EXBO, the developer of STALCRAFT. In this policy, "we" and "the site" mean STALCRAFT Meta.

This policy covers stalcraftmeta.com. Services the site links to or works with, such as EXBO and donation platforms, have their own privacy policies.

2. Information collected when you browse

You can use the tools, guides, wiki and Tier Lists without an account. When your browser loads a page, it sends standard request information, such as your IP address, the address requested, and your browser's user agent and language. The server uses this to deliver the page, apply rate limits and block abuse. The site also keeps:

Rate-limit counters: short-lived counters keyed by IP address, kept for the length of each limit window.
Error records: if a request causes a server error, the error, the request's route and method and, if you are signed in, your account ID are stored for up to 30 days to find and fix the problem. Your IP address is not stored with them.
Tier List view records: when you open a Tier List (a published one, or an unpublished one through its share link), the site stores the list, the time and, if you are signed in, your account ID. If you are not signed in, it stores instead a keyed hash computed from your IP address, the list and the day, never the address itself. These records are used only so that repeat views within 15 minutes are not counted twice, and are deleted after 30 days. The view count shown on a list is a total and is kept.
Optimizer export links: when you create an export link in the Artifact Optimizer, the settings you export are stored on the server so that anyone with the link can import them. Only those settings are stored, not your IP address or account. Export links expire 30 days after they are created; links created before this policy update stay available for at least 30 days after it. To keep settings longer, save them as a preset or copy a share code.
Optimizer failure reports: when an optimizer search fails or finds no builds, your browser sends the optimizer settings you used, the error, how long the search ran, the optimizer and data versions, your browser's user agent, language and number of processor cores and, if you are signed in, your account ID. Your IP address is not stored with them. They are used only to find and fix optimizer problems; only the newest 500 are kept, each for up to 30 days.
Server logs: the web server keeps access logs that record the IP address and the address requested for each request. They are used to run the site and investigate abuse, and are deleted after about 14 days.

Analytics and telemetry depend on your analytics choice, described in section 6.

Signing in is optional and uses EXBO's OAuth login. You enter your EXBO credentials on EXBO's own site; STALCRAFT Meta never receives your password.

After you approve the sign-in, EXBO gives the site a temporary access token. The site uses it only during sign-in, to read your EXBO account ID and login name and the list of your STALCRAFT characters. The token is not saved in your session or in the database. The site then stores:

Account record: your EXBO account ID and login name; your character list (for each character: region, character ID, name, creation date and clan details, if any); and when the record was created, last updated and last signed in to. The character list is refreshed at sign-in when the stored copy is more than an hour old.
Sign-in history: the time and IP address of each successful sign-in, kept for 30 days for account security.
Login session: a session cookie keeps you signed in. The session is stored on the server, identifies only your account, and expires after 24 hours without activity. Signing out ends it.

4. Content you choose to save

When you are signed in, you can save content to your account. Each item is stored with your account ID:

Builds from the Build Calculator and the Artifact Optimizer: name, type and build settings.
Optimizer presets: name and optimizer settings.
Tier Lists: name, tiers and items, the author name you enter when publishing, and the share image generated for a shared list.
Likes you give to published Tier Lists.
Optimizer feedback you send, with the optimizer settings attached if you choose to include them. Feedback can also be sent without signing in; it is linked to your account only when you are signed in.

Saved builds and presets have a share link, and anyone who has the link can open them. A Tier List is not listed publicly until you publish it, but anyone who has its share link can open it. A published Tier List, with its author name, view count and like count, is visible to every visitor and can appear in the public catalogue until you unpublish or delete it.

You can delete saved builds, presets and Tier Lists in the tools. Other saved content is kept until you delete it or ask for your account to be removed (section 10).

5. Contact messages

When you send a message with the contact form, the site stores the email address, subject, request type and message you enter, your IP address, the time and, if you are signed in, your account ID. It also records a usage event that a message of that request type was sent, without its content.

This information is used to read and answer your message and to prevent spam and abuse: the form is rate-limited, and addresses that send abuse can be blocked. The IP address is removed from a message 30 days after it was sent; removal runs periodically, so it can happen a few hours later. The message itself is kept for support handling until an administrator deletes it; it is not deleted automatically. You can ask for a message to be deleted.

If "Attach my tool settings" is checked when you send a message, it also includes your current optimizer settings, the last optimizer problem in this browser (if any) and your browser's user agent, language and number of processor cores. The form shows exactly what will be attached, and you can uncheck it. The attached settings are kept with the message.

6. Analytics and telemetry

The site measures how it is used in two ways: its own first-party telemetry and Google Analytics. Your choice in the cookie banner, which you can change at any time with Cookie settings in the footer, controls both. Until you choose, the site treats the choice as not given.

STALCRAFT Meta telemetry. Only after you accept analytics does your browser send the site page views and tool-usage events. A page view contains the page route, the previous route, the referring site reduced to its origin (for example https://example.com), campaign (UTM) tags, your interface language and your game region. Tool events record actions such as an optimizer or TTK run starting or finishing, with coarse settings and outcomes, and can include diagnostic reports from optimizer test runs with timing and outcome categories only. The server then sets a first-party cookie, sm_vid, containing a random visitor ID, and groups activity into sessions with your country (from the Cloudflare country header), browser, operating system and device type. If you are signed in, these records are linked to your account ID. Your IP address is not stored in telemetry: a keyed hash of it is kept with the session for 7 days and then removed. This telemetry is pseudonymous, not anonymous.

If you reject analytics, or have not chosen, your browser sends no telemetry. If you reject after accepting, your browser asks the server to delete the sm_vid cookie.

Account actions. Some actions are recorded by the server whatever your analytics choice, because the server performs them: signing in, signing up and signing out; saving builds, presets and Tier Lists; publishing, unpublishing and liking Tier Lists; opening a shared build; preparing an optimizer run (only the outcome, the data region and the mode); and sending feedback or a contact message. These records contain the action, coarse details (such as whether an item was new) and your account ID when you are signed in. They never contain the content you entered.

Telemetry retention: raw page views, events and account-action records are deleted after 35 days, sessions after 90 days, and visitor records after 395 days without activity. Daily aggregate statistics are kept for 25 months; they are keyed by keyed hashes rather than by account or visitor IDs. For each account, an administrator-only activity summary (first and last active day, active days, sessions, page views and events over the last 30 and 90 days, most-used feature) is computed from these records and kept while the account exists.

Google Analytics. Every page loads Google's tag (gtag.js, measurement ID G-6ZEN624R7X) with Google Consent Mode. Before you choose, and after you reject, analytics storage is denied: Google Analytics sets no cookies, but your browser still sends Google cookieless measurement requests ("pings") for page views and some events, and these requests include standard information such as your IP address and browser details. After you accept, analytics storage is granted and Google Analytics sets its cookies (such as _ga) to measure visits. The page addresses sent to Google never include the query string. Google's advertising consent signals stay denied whatever you choose, because the site shows no ads. Google processes this data under its own privacy policy.

7. Cookies and browser storage

The site uses a few cookies and keeps other information in your browser's local storage, which stays on your device:

Login session cookie (connect.sid): set when you sign in. It keeps you signed in, cannot be read by page scripts, and expires after 24 hours without activity.
Telemetry cookie (sm_vid): set only after you accept analytics. It holds a random visitor ID, cannot be read by page scripts, lasts up to 395 days and is removed when you reject analytics.
Google Analytics cookies (such as _ga): set only after you accept analytics.
Language cookie (i18next): remembers the interface language you pick in the menu, for up to a year.
Your analytics choice: stored in local storage under the key cookieConsent as "accepted" or "rejected".
Preferences and drafts in local storage: interface language, game region, tool settings (such as optimizer inventory and requirements, Build Calculator, TTK, recoil and DPS table settings), Tier List drafts and custom tier presets, and which hints or notices you have dismissed. These are not sent to the site unless you save or share them. The tools also cache game data and recent optimizer results in your browser's IndexedDB storage so that pages load faster; this cache stays on your device.
Tool diagnostics in local storage (stalcraftmeta.toolDiagnostics.v1): your current optimizer settings and the last optimizer problem, kept for 24 hours so that they can be attached to a contact message. They are sent only with a failure report or a message you send.
Telemetry housekeeping in local storage: short-lived coordination and back-off records used by the telemetry client. They contain no visitor ID.

You can delete cookies and local storage in your browser settings. Doing so signs you out and resets your preferences and your analytics choice.

8. Third-party services

In normal operation the site works with these services:

EXBO: provides the sign-in (OAuth) and the STALCRAFT API, which the site uses to read your characters at sign-in and auction price history for the wiki. When you sign in, you use EXBO's site under EXBO's terms and privacy policy. Game item data comes from snapshots of EXBO's public game-data repository and involves no personal data.
Google: Google Analytics, as described in section 6.
Cloudflare: the site is served through Cloudflare, which carries and protects requests to the site, including your IP address, and supplies the country header used in telemetry. Cloudflare processes this data under its own terms.
Donation platforms (Ko-fi, Boosty and NOWPayments): only if you follow a link on the Support page. Donations take place entirely on those sites. STALCRAFT Meta does not receive your card, bank or wallet details and does not keep a list of donors.

Information may also be disclosed if the law requires it, or to protect the site and its users against abuse.

9. How long information is kept

Different information is kept for different periods:

Telemetry: raw records 35 days, sessions 90 days, the IP hash 7 days, visitor records 395 days without activity, daily aggregates 25 months (section 6).
Sign-in history and server error records: 30 days.
Optimizer failure reports: up to 30 days, and only the newest 500.
Login session: until you sign out or after 24 hours without activity.
Account record and saved content: until you delete the content or the account is removed.
Contact messages: the IP address 30 days after sending; the message until an administrator deletes it (there is no automatic period). Optimizer feedback: until it is deleted; there is no automatic period.
Tier List view records: 30 days. The view count of a list is a total and is kept while the list exists.
Optimizer export links: 30 days after they are created.
Web server access logs: about 14 days.
Cookies and local storage: as described in section 7, or until you delete them.

When an account is removed, its account record, saved builds, presets, Tier Lists (with their likes, view records and share images), the likes it gave, its sign-in history and its login sessions are deleted. The account ID is removed from contact messages, feedback, optimizer failure reports, telemetry and error records, which are otherwise kept until their normal deletion. Aggregate statistics keyed by hashes do not change.

Automatic deletion runs every few hours, so information is removed within a few hours after its period ends, not at the exact moment. These periods apply to the site's own server and database. Cloudflare and the hosting provider (Vultr) process request information under their own terms and retention periods, which the site does not control.

10. Your choices

Accept or reject analytics in the cookie banner, and change your choice at any time with Cookie settings in the footer or the button below. The change takes effect immediately, without reloading the page.
Use the site without signing in. The tools work without an account; saving to an account, publishing Tier Lists and liking them need one.
Delete saved builds, presets and Tier Lists, and unpublish Tier Lists, in the tools.
Ask, through the contact form or by email, what account or contact information is stored about you, or ask for it to be corrected, or for your account or a message to be deleted. There is no self-service account deletion; requests are handled by hand, and we may need to confirm that a request comes from the account holder.
Block or delete cookies and local storage in your browser.

The site does not respond to browser "Do Not Track" signals; the analytics choice above is the control it offers.

11. Security

The site uses reasonable technical measures to protect the information it stores, including HTTPS, login session cookies that page scripts cannot read, rate limits and restricted access to administrative functions. No method of transmitting or storing information is completely secure, so absolute security cannot be guaranteed.

12. Changes to this policy

This policy is updated when the site's data practices change. The "Last updated" date at the top shows when it last changed.

13. Contact

For privacy questions or requests about your information, use the contact form or email the site: