Back to the Mod LibraryYour account and privacy
You can browse and download mods without an account. Sign in with Discord when you want to rate a mod, leave comments, send a request or help moderate the library.
What we keep
| Information | Why it is needed | Who can see it |
|---|---|---|
| Your Discord account ID | Recognise the same account when you return. | The private account service. It is not shown on public reviews or profiles. |
| Your chosen display name | Credit your reviews and identify your requests. | Visitors alongside your public reviews; you and staff alongside requests. |
| Your website role and account status | Keep publishing and moderation tools restricted to assigned staff. | You and authorised staff. |
| Comments, reports and dates | Let players discuss mods and allow staff to assess reported content. | Visitors see visible comments and display names. Reports and moderation reasons are available to staff. |
| Download counters | Display tracked website download requests for each mod. | Visitors see aggregate totals. Temporary retry and rate-limit records stay in the private service. |
| Ratings, reviews and dates | Help players choose mods and keep one rating per account for each mod. | Visitors when the review is visible. Hidden reviews remain available to their author and staff. |
| Mod requests and replies | Check a suggested mod and tell you the outcome. | The requester and staff. Private staff notes are visible only to staff. |
| Temporary sign-in records, session hashes and optional remembered-device hashes | Complete sign-in and protect account actions. | The private account service. |
| Staff upload records, filenames, file sizes, transfer checksums and status | Resume interrupted transfers and connect completed files to the library. | The private library service and authorised staff. Completed mod packages and cover images are served publicly by the web host. |
Your initial display name comes from Discord. You can change it in account settings; your visible reviews then use the updated name. A mod's published creator credit is part of that mod's listing and is managed separately by staff.
Discord sign-in
The library requests Discord's basic identity permission. It does not request your email, messages, contacts or server list. It does not create a website password, store your Discord avatar, retain a Discord access or refresh token, or automatically join a Discord server on your behalf.
The Join Discord link is separate from sign-in. Discord handles that invitation under its own terms and privacy policy.
Where account information lives
The website's public files and approved downloads are served by the library's web host. Account records, private requests and staff notes are stored in a separate private Cloudflare database. The public website folder does not contain a user database or login secrets.
Discord, Cloudflare and the web host process information needed to deliver their services, including connection and operational metadata. Their own privacy policies apply to that processing. This website does not include advertising trackers or an analytics script.
Sessions and your browser
A secure browser cookie lets the library restore your sign-in when you refresh the page. Ordinary sessions expire after roughly 30 minutes without authenticated activity and have a maximum lifetime of eight hours. They use a browser-session cookie; a browser's session-restore settings can affect when that cookie is removed.
If you choose Stay signed in on this device, a separate secure cookie allows the library to create a new session for up to 30 days from that sign-in. The private database stores only a hash of the random remembered-device credential, its account link and expiry information. It does not store a device fingerprint or your Discord access token. Your account's current permissions are checked when a session is restored.
These sign-in cookies cannot be read by website JavaScript and are restricted to secure connections. Supported browsers partition the account-service cookies to this website. If browser privacy settings prevent cookies from working, the library keeps the current page signed in and explains that it could not retain sign-in for your return visit. Signing out removes this browser's remembered sign-in and revokes its linked sessions. Clearing cookies also removes the browser's ability to return automatically.
A temporary login proof may use first-party session storage so a sign-in in the same tab can finish. It is removed after the flow completes, is cancelled or expires and is next checked. A short-lived, secure sign-in cookie is used on the account service while Discord redirects back. The site does not save your session token in local storage or session storage. A non-identifying signed-out marker can use browser storage to prevent automatic restoration after you sign out and to retry a failed sign-out; it contains no account details or credentials.
Comments and download totals
Comments are public when visible. You can edit or delete your own comments; staff can hide or restore comments with a recorded reason. Reporting a comment does not hide it automatically. Deleted comments disappear from public discussion. Hidden comments and moderation records remain available to staff while needed to manage the library.
Download totals count tracked website requests across a mod's releases from the introduction of tracking. They do not identify unique players or confirm completed downloads or installations. Direct file links and launcher downloads are not counted unless they use the tracking route.
To limit inflated totals, the counter uses a daily changing hash of the connection address. The counter tables do not store raw IP addresses or set a visitor-tracking cookie. Rate-limit records expire after two hours and retry identifiers after 24 hours; scheduled and opportunistic cleanup remove expired records. Aggregate download totals remain.
Requests, retention and deletion
Staff uploads use the library's file service. The FTP credential stays in private service configuration. Upload records and checksums are kept in the private database; package and image bytes are transferred to the web host's public folders. These uploads are for mod assets intended for public download. An unfinished transfer expires after 72 hours. Scheduled cleanup attempts to remove its temporary file when the file service is available; the expiry is not a guarantee of immediate file deletion. Records of cancelled or expired uploads are removed after 30 days once cleanup has succeeded. Completed uploads and their file records remain available for releases and the file picker; uploading a file does not publish a catalogue entry automatically.
The browser uses a fingerprint of a selected file's size and sample bytes to help match it when resuming an upload. It also checks the previously accepted file chunks against their stored checksums before resuming. These checks identify file contents, not your device. The website does not save the selected file's bytes in browser storage. Deleting a staff account removes the account link from retained upload records; it does not remove files used by published mods.
Published and rejected requests, published draft history and staff activity logs are removed after 180 days by scheduled cleanup. Unfinished requests and unpublished drafts stay available while work is pending. Expired sign-in, session and remembered-device records are removed by scheduled cleanup; expired credentials stop working immediately even before that cleanup runs.
You can delete your website account from account settings. This removes its Discord identity mapping, sessions, remembered devices, ratings, reviews, comments, comment reports and review reports you submitted and your mod requests. In retained staff history, your account name is replaced with “Deleted account”. Published mods and their creator credits stay in the catalogue unless staff remove or update them separately. An administrator must leave another active administrator before deleting their own account.
Account deletion removes the live application records. Private provider backups and infrastructure records can have their own retention periods. If you sign in again after deletion, a new website account is created.
Questions or corrections
Contact the DKR-R Mod Library team through the community Discord for help with your account, a review or a request. Use account settings for deletion, and include the relevant mod or request title when asking about a correction.
Application behaviour described for release 1.0.0-rc.1, updated 29 October 2026 for comments and aggregate download counters. The site owner should keep this page aligned with the services and contact route used by the live library.