Privacy Policy

Effective date: October 19, 2026

This Privacy Policy explains how Crossid ("we", "us") collects, uses, stores, and protects information when you use the Crossid service, including the Crossid website, REST API, Discord bot, and Minecraft plugin (together, the "Service").

1. Information we collect

Crossid exists to link accounts across platforms. We collect only the information needed to provide that function.

• Discord information: your Discord user ID and username, and the Discord server (guild) ID where you use Crossid commands.
• Minecraft information: your Minecraft Java Edition UUID and username, as reported by the Minecraft server on which you link.
• Roblox information: your Roblox user ID, username, and display name, obtained through Roblox's official OAuth flow if you choose to connect Roblox.
• Server operator information: Minecraft server installation names, identifiers, hashed API credentials, and Discord guild associations.
• Technical and security data: authentication and session records, audit events, IP addresses used for rate limiting and abuse prevention, and basic request diagnostics.

We do not collect your Discord or Roblox password. We do not receive payment card data.

2. How we use information

• To create, verify, and store server-scoped account links.
• To resolve linked identities for authorized server operators and integrations.
• To authenticate servers and dashboard users and to prevent fraud and abuse.
• To maintain security, audit trails, and service reliability.
• To respond to support and privacy requests.

3. Legal bases

Where required, we rely on performance of a contract (providing the Service), our legitimate interests (security, abuse prevention, and service improvement), and your consent (for optional connections such as Roblox OAuth). You may withdraw consent by unlinking the relevant account.

4. Sharing and disclosure

We do not sell personal information. We share information only:

• With the Minecraft server installation you link on, which can retrieve the mappings for that server through the API.
• With service providers that host or operate the Service (our hosting and infrastructure providers), only as needed to run it.
• With platform providers as necessary to perform OAuth and identity verification (Discord and Roblox).
• When required by law, or to protect rights, safety, and the integrity of the Service.

Links are scoped to a single Minecraft server installation. We do not transfer mappings between server installations.

5. Cookies and sessions

The dashboard uses a single first-party session cookie that is HttpOnly, SameSite=Lax, and marked Secure over HTTPS. It is used only to keep you signed in. We do not use advertising or cross-site tracking cookies.

6. Data retention

We retain account links until they are unlinked, server installations until they are revoked, and security/audit records for a limited period consistent with security and legal needs. Short-lived linking codes, OAuth states, and expired sessions are deleted automatically.

7. Security

API keys and linking codes are stored only as salted hashes. Discord interactions are signature-verified, Roblox uses the OAuth authorization-code flow with PKCE, and all production traffic uses HTTPS. No system is perfectly secure; please protect your API keys and account credentials.

8. Your choices and rights

• You can unlink an account at any time with the bot, plugin, or dashboard.
• Server operators can rotate or revoke credentials and remove links through the dashboard.
• Depending on your jurisdiction, you may have rights to access, correct, or delete personal information, or to object to processing.

To make a privacy request, contact us at contact@sh0.si.

9. Children

The Service is not directed to children under 13 (or the minimum age required by your country or the relevant platform). Do not use the Service if you do not meet the applicable age requirement.

10. International transfers

The Service runs on a global hosting network, and information may be processed in countries other than your own. We take steps intended to protect information in accordance with this Policy.

11. Changes

We may update this Policy from time to time. Material changes will be reflected by a new effective date on this page. Continued use after an update means you accept the revised Policy.

12. Contact

Questions about this Policy: contact@sh0.si