Privacy Policy

This policy explains what personal data the Small Hustlers Crew portal collects, why we hold it, and what you can ask us to do with it.

Who we are

The controller of your data is Small Hustlers Crew (www.shc-clan.com), a non-commercial gaming community. For anything in this policy — including any of the rights listed below — write to [email protected].

What we collect

Your account

When you register we store your username, email address and a password hash. We never store your password itself and cannot read it. We also record the country your IP address resolves to at the moment you register.

If you add them, we store your avatar and your newsletter preference.

Security and activity

While you are signed in we keep a session record containing your IP address, browser user agent and the time you were last active. We store the time you were last seen on your account, and the IP address you last registered or signed in from. If your account is moderated we store the ban reason, the period, and which staff member applied it.

Maps you upload

For each submission we keep the original filename, the resource name and tag, the file size, a SHA-256 checksum, and a link to your account. Rejected uploads keep the reason for the rejection.

Donations

If you donate, PayPal reports the payment to us and we store the display name you chose, the amount, the PayPal transaction id, the email address on the PayPal account that paid, and the full payment notification exactly as PayPal sent it. That last record can contain further details supplied by PayPal that we did not ask for and do not use. We keep it so a disputed or missing donation can be traced.

Why we use it, and on what basis

To run your account and the services you ask for — signing in, verifying your email, resetting your password, accepting your map uploads, and granting premium after a donation. This is necessary to provide what you signed up for.
To keep the site secure and usable — blocking bots, rate-limiting abuse, checking what gets uploaded, and enforcing bans. We rely on our legitimate interest in running a community that is not overrun by spam, abuse or ban evasion.
To send you news, if you asked for it — the newsletter preference is off unless you switch it on, and you can switch it off again at any time in your account settings. This is based on your consent.
To keep records of money received — donation records are kept because we are required to be able to account for payments.

Cookies

We do not show a cookie banner, because we do not set any cookie that would need your consent. There is no advertising, no analytics and no tracking on this site — no Google Analytics, no Tag Manager, no advertising or social media pixels of any kind. Nothing here builds a profile of you or follows you to other websites.

The only cookies set are the ones the site cannot work without:

A session cookie and a CSRF token cookie, which keep you signed in as you move between pages and protect forms from being submitted by other sites. These expire when you close your browser or after a period of inactivity.
A "remember me" cookie, set only if you tick that box when signing in, so you do not have to sign in again on your next visit.
A security cookie set by Cloudflare Turnstile, the anti-bot check on our sign-up and sign-in forms. It records that a browser has passed the check. Cloudflare designed Turnstile specifically not to track people across sites.

Cookies that are strictly necessary to deliver a service you asked for do not require consent, which is why you are not asked for any. If you block them, signing in will not work.

One thing worth being clear about: our video player is embedded from YouTube, and embedded players do normally set third-party cookies. Ours is loaded only when you click play, and in YouTube's no-cookie mode — so nothing is set, and nothing is requested from Google, unless you choose to watch a video. See who we share it with for what happens when you do.

We do not sell your data, and we do not share it for advertising. A small number of services process data on our behalf:

Cloudflare — the Turnstile anti-bot check on our forms. Your IP address and browser signals reach Cloudflare when the check runs.
Bunny.net — serves the site's fonts from EU servers. Loading a page requests a font file, which means your IP address reaches Bunny. We use them rather than Google Fonts for this reason.
Resend — sends our email. Your email address is processed so the message can reach you.
PayPal — processes donations. You are handed over to PayPal to pay; we never see your card or bank details, only what PayPal reports back to us.
YouTube (Google) — community videos are played in a window on the site. Nothing is requested from YouTube until you actually click play, and the player runs in YouTube's no-cookie mode, so simply browsing a page that lists videos sends Google nothing. Once you start a video, your IP address and what you are watching reach Google under their privacy policy.

For completeness: the country shown on your profile is worked out from a database stored on our own server. Your IP address is not sent to any geolocation service.

We may also disclose information where we are legally required to, or where it is necessary to investigate abuse of the site or our game servers.

How long we keep it

Your account data is kept for as long as your account exists. Session records expire automatically. You can delete your account yourself at any time from your account settings, which removes your profile, email address and avatar.

Two things deliberately survive that deletion, with the link to your account removed so they no longer identify you: donation records, which we must be able to account for, and maps you uploaded that are already part of the public map library. Where a record is no longer needed for either reason, it is deleted; records kept for accounting purposes are held for up to five years.

Your rights

If you are in the EU or UK, the GDPR gives you the following rights over your data. You can exercise any of them by writing to [email protected].

Confirmation and access — to be told whether we hold data about you, and to receive a copy of it.
Rectification — to have inaccurate data corrected. Most of it you can edit yourself in your account settings.
Erasure — to have your data deleted, subject to the retention above.
Restriction — to have us stop processing your data while a dispute about it is resolved.
Portability — to receive your data in a machine-readable form.
Objection — to object to processing we carry out under our legitimate interests.
Withdrawal of consent — to withdraw consent at any time, without affecting anything done before you withdrew it.

You also have the right to complain to the data protection authority in the EU member state where you live if you believe we have handled your data improperly.

Children

This site is not intended for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has registered, contact us and we will remove the account.

Changes to this policy

We may update this policy as the site changes. The date at the top shows when it was last revised, and material changes will be announced on the site.