Privacy Policy

1. Who is responsible

Miliastry is run by hxovc, an individual based in Colombia, who is responsible for your data and decides how it is used. Contact for anything about your data: [email protected].

2. What we collect

Using the editor without signing in stores nothing about you on our servers beyond the usage counts described below. Signing in and using the online features adds the following.

• Your osu! account. When you sign in with osu! we ask for the “identify” and “public” scopes and keep your osu! user id, username, avatar, country code, supporter status, global rank and pp. We never receive your password and do not read your messages or friends.
• What you save or publish. Cloud documents and projects with their titles and thumbnails, Workshop items, stars, comments and plugin reviews, and the settings that follow your account across devices.
• Collaboration. For rooms you host or join: the room, who hosts it, each member’s osu! id, username, avatar and role, an optional room password (stored only as a hash), the shared document and its snapshots, and the room chat: each message with its author’s osu! id, username and avatar and the time it was sent (the latest 500 messages per room).
• Reports you send. A bug report holds your message, steps, whether you want a reply, and technical context: app version, platform, theme, plugins, document size and browser user agent. The content of your documents is not included. For a profile report we also fetch the BBCode and HTML of your public osu! profile so the problem can be reproduced. Reports can be sent without signing in, and we do not store your IP address with them.
• Reports about profiles and Workshop items. When you report a profile or an item we store who reported, what was reported, the reason you chose, your optional details, the status, and which moderator closed it.
• Notifications. Messages we send you about your content or reports, and about comments, replies and stars other people leave on your items, with the data they need (an item’s name, the reason, or the name of who acted), not its content.
• Your public profile. Your Workshop profile page is visible to anyone, signed in or not: your osu! username, avatar and country, your creator and supporter badges, when you joined, your counts, the “about me” you write, what you published and the comments you left. Accounts also carry a role (such as moderator or administrator) that staff can see.
• Your acceptance of these texts. Which version of the Terms of Use and this policy you accepted and when, kept on your account, and a security-log entry with the IP address it came from.
• Usage counts. When you open a tool, a ping records the time, which tool, and a hash of your IP address made with a key that changes every day. That lets us count distinct visitors within a day without keeping the address, and the same person gets an unrelated hash the next day. If you are signed in it also records your account. Per account we keep how many times you launched Miliastry and which features you used. We use this only to understand what to improve.
• Security logs. For sign-ins, sign-outs, blocked requests, moderation actions and acceptances of these texts we record the event, the endpoint, your IP address and, when known, your osu! id and username. The server also uses your IP address in memory to limit abuse.
• Image hosts. If you connect GitHub, s-ul.eu, catbox.moe or pixeldrain to upload images, the keys or tokens for them stay in your browser and are never stored on our servers. Uploads to GitHub and pixeldrain go straight from your browser to them. Uploads to s-ul.eu and catbox.moe pass through our collaboration server, because those hosts do not accept uploads straight from a web page: it forwards the file and your key to the host you chose and keeps neither.

Our site also uses Vercel Web Analytics for aggregate page views, without cookies. If you pick a Google font for the menu, your browser loads it from Google Fonts, which then receives your IP address and browser details under Google’s privacy policy.

3. Cookies and what stays on your device

Miliastry sets only the cookies it needs for you to stay signed in (HTTP-only cookies holding your session; the sign-in token lasts as long as osu! says and the renewal cookie up to 30 days). It uses no advertising or cross-site tracking cookies.

Your browser’s local storage holds your settings, language, drafts and autosaves, open tabs and window layout, so your work is there when you come back, as well as the image-host keys you connect and which version of these texts you accepted. It stays on your device until you clear it, or syncs to your account only for the preferences described above.

When you open the support window, it loads Ko-fi inside the app. Ko-fi then handles whatever you do there under its own policy.

4. Why we use it

• To provide the features you ask for: sign-in, saving, publishing, collaborating, notifying you. (Performance of the service.)
• To keep Miliastry safe and usable: rate limiting, abuse prevention, moderation and bug fixing. (Our legitimate interest.)
• To understand usage in aggregate and improve the product. (Our legitimate interest, kept to the minimum above.)
• To meet legal duties, such as reporting child sexual abuse material and answering lawful requests. (Legal obligation.)

The labels in brackets are the legal bases under the GDPR. Under Colombian law (Ley 1581 de 2012) the basis is your authorization, except where that law allows processing without it.

When you sign in, Miliastry asks you to accept this policy and the Terms of Use. That is your prior, express and informed authorization to process your data as described here. We keep a record of it on your account (which version and when) and on your device. When either text changes in substance, we ask again.

5. Who sees it

• Other people. What you publish to the Workshop is public together with your osu! username and avatar, and so is your Workshop profile page. Members of a room you join see your name and avatar and what you write in its chat.
• Running and moderating Miliastry. The person who runs it can open any stored file, private ones included, and moderators see reports and the items and profiles reported. This is only to moderate, investigate abuse or a report, fix a fault, or meet a legal duty.
• Our providers. Vercel hosts the site, Railway hosts the database and the collaboration server, and osu! provides sign-in. Each processes data on our behalf and only to provide that service.
• Services you choose. The image host you upload to (GitHub, s-ul.eu, catbox.moe or pixeldrain) receives the file and your key for it, and Google Fonts receives your IP address if you pick one of its fonts. They act under their own policies.
• Authorities. If the law requires it, to protect people, or to report child sexual abuse material to the NCMEC CyberTipline and preserve it as the law requires.

We do not sell your data and do not share it for advertising.

6. Where it is stored

Our servers are in the United States. If you are elsewhere, using Miliastry means your data is transferred there. By signing in and using Miliastry you expressly authorize that transfer and the processing described in this policy. You can withdraw that authorization at any time by deleting your account.

7. How long we keep it

• Account, cloud files, comments, stars, preferences, collaboration data, notifications and the record of your acceptance: while your account exists, and deleted 14 days after you ask to delete it. Copies in our database provider’s backups disappear as those backups rotate, and are used only to recover from a fault.
• Bug reports: kept after a fix as a record of the problem. If you delete your account the link to you is removed.
• Room chat: the latest 500 messages per room, kept with the room and deleted with it. A profile in quarantine is kept, hidden, until the quarantine is lifted.
• Security and moderation logs: 12 months, then deleted.
• Usage pings: 12 months, then deleted. The per-account counts are kept while your account exists.
• A banned account that is deleted: only the record of the ban (osu! id, when, why and by whom), for as long as the ban stands.
• Content we are legally required to preserve: for the period the law sets.

8. Your choices and rights

You can access, correct or delete your data, get a copy of it, object to some uses, and withdraw your authorization. Some you can do yourself: manage and delete your cloud files from your profile, delete your own comments and reviews, take down your own Workshop items, and clear local data in your browser. A copy of your data is sent on request, in a common machine-readable format (JSON).

You can delete your whole account from your profile (“Delete my account”). The deletion is scheduled for 14 days later and you can cancel it until then. Afterwards your cloud files, Workshop items, comments, reviews, stars, preferences, notifications, the rooms you host and your messages in other rooms’ chats are permanently deleted, your name, osu! id and IP address are removed from our security logs, and usage pings lose their link to your account. If the account is banned, the same data is deleted and only the record of the ban is kept, so a ban cannot be erased by deleting the account; a banned account can ask for this through [email protected].

For anything else, write to [email protected]. That is also where to send a query (to see what data we hold about you) or a claim (to correct, update or delete data, or to withdraw your authorization). We answer a query within 10 business days and a claim within 15 business days. If we need more time we tell you why before that deadline and answer within 5 more business days for a query or 8 for a claim. Include your osu! username or id so we can find your account.

These are your rights under Ley 1581 de 2012 if you are in Colombia, and under the GDPR if you are in the EU or UK. If we do not resolve your request, you can complain to the Superintendencia de Industria y Comercio (SIC) in Colombia, after first making your query or claim to us, or to your local data protection authority.

9. Children

Miliastry is not meant for children under 13. If you are between 13 and 17, a parent or guardian has to authorize the processing of your data before you sign in: under Colombian law that authorization is given by a minor’s legal representative, and we process a minor’s data only in a way that respects their best interests and rights. We collect nothing more from minors than from anyone else. If you think a child under 13 has an account, or a minor signed in without that authorization, tell us and we will remove it.

10. Security

Sessions use HTTP-only cookies, room passwords are stored as salted hashes, requests are rate limited and sensitive actions are logged. No system is perfectly secure; if a breach puts your data at risk we will tell you and, in Colombia, the Superintendencia de Industria y Comercio, as the law requires.

11. Changes

We will update this policy when Miliastry changes what it collects. The date at the top shows the latest version, and substantial changes are announced in the changelog and in the app.