Kraken Alliance is a community of Star Citizen corporations. This policy explains what personal data this website collects, why, who receives it and what rights you have. It applies to krakenalliance.sc and any domain the alliance uses for it.
1. Who is responsible
The website is run by the Kraken Alliance leadership. For anything about your data, message an officer on our Discord server (discord.gg/krakenalliance) and we will reply within 30 days.
2. What we collect
- Visitors: no account, analytics, advertising or tracking. We set only the cookies needed to run the site, listed on our Cookies page.
- Applicants: your name, Discord username, the corporation you represent, its type (hardcore or casual), your time zone and the site language you used. We never store your IP address. To stop spam, it is held briefly in memory to limit how many applications one connection can send, and forgotten within an hour.
- Admins: when alliance staff sign in with Discord we receive their Discord ID, username, display name, avatar and their roles in our server. Admin sign-ins and edits are recorded in an internal audit log with the admin's Discord handle, the time and their IP address.
3. Why we use it
- To review applications and contact applicants on Discord, which you ask us to do by applying.
- To keep the site secure, prevent spam and keep a record of who changed what, which is our legitimate interest in running the site safely.
- To decide who may edit the site, based on Discord server roles.
4. Who receives it
- Fly.io hosts the website and database in Frankfurt, Germany.
- Upstash provides the cache and sessions, also in Frankfurt.
- Cloudflare delivers the website and shields it from attacks. Every visit passes through its network, which sees your IP address and browser details in order to block malicious traffic.
- Discord handles admin sign-in. New applications and officers' decisions are also posted to a private Discord channel that only alliance officers can read.
- The admin panel (not the public site) loads fonts from Google Fonts.
We never sell your data or share it with anyone else.
5. How long we keep it
- Applications are deleted automatically 12 months after a decision, or 12 months after they arrive if no decision is made.
- Audit log entries, including admins' IP addresses, are deleted after 24 months.
- Sessions end after 2 hours of inactivity.
You can ask us to delete your application sooner at any time.
6. Your rights
Under the GDPR you can ask to see, correct or delete your data, object to how we use it, or ask us to restrict its use. Contact us as described in section 1. You also have the right to complain to your local data protection authority.
7. Changes
If we change this policy we will update this page.