Last updated 9 August 2026. What we store, why we store it, and the one part of it that's public.
We store your Discord account details and the IP addresses of the servers you whitelist. We use them to work out what you've bought and to let your servers start. We don't sell anything to anyone, and there are no advertising or tracking cookies on this site.
The one part worth reading twice: whitelisted server IP addresses are published in a public file. That's how the mods read them.
When you sign in with Discord: your Discord user ID, your username, your avatar image, and which of our Discord roles you hold. We ask Discord for nothing else — not your email, not your other servers.
When you use the portal: the server IP addresses you add, the mod each one is for, and an activity log of what was added or removed, by whom, and when. Refused attempts are logged too.
When you buy something: whatever PayPal shows a seller about the payer. We never see or store card details.
When you visit any page: we record the page, the site you came from if any, your country, and whether you're on a phone or a desktop. We also record a short code so we can tell one visitor from another for the rest of the day.
We do not store your IP address. That code is a one-way hash of your address mixed with the date, so it can't be turned back into an address, and tomorrow the same person gets a different code. It's enough to count how many people visited; it isn't enough to identify anyone or to follow you from one day to the next. These records are deleted after 90 days.
Cloudflare Web Analytics also runs, which sets no cookies and doesn't follow you to other sites.
To run the thing you bought. The Discord ID identifies your licence, the roles say what you're entitled to, and the addresses are what the mods check at boot. Without them the portal can't tell you apart from anyone else.
The activity log exists so a dispute about who removed what can be settled, and so misuse of a shared account can be spotted.
The page-visit records exist so we can see which mods people actually look at and where they heard about us. Nothing in them names a person.
If you're in the EEA or UK, the lawful basis for the account and licence data is performance of a contract — it's what makes your purchase work. The visit records and the analytics rest on legitimate interest, and hold nothing that identifies you.
Whitelisted server IP addresses are written to a public file on GitHub, because the mods fetch it when a server boots and have no way to authenticate.
That file contains IP addresses and nothing else — no names, no Discord IDs, no usernames, no indication of who owns which address. A DayZ server's address is public by nature anyway: players need it to connect, and every server browser lists it.
Everything else — your Discord account, which mods you own, your activity log, who you've shared access with — is private, and visible only to you and to DDTB staff.
Nobody else. We don't sell, rent or trade personal information, and we don't use it for advertising.
One cookie: a session cookie set when you sign in, so the site knows it's still you on the
next page. It's HttpOnly, it's limited to this site, and it expires.
There are no advertising cookies, no analytics cookies and no third-party trackers. Cloudflare Web Analytics is cookieless. That's why you aren't being asked to accept anything — a cookie you can't switch off without breaking sign-in is a strictly necessary one, and consent isn't required for those.
Account details and licences are kept while you hold a licence, so your servers keep working.
Removed whitelist entries are marked deleted rather than erased, so the activity log still makes sense. The activity log itself is kept for about a year, and the page-visit records for 90 days.
Ask us to delete everything and we will — see below.
You can ask us to show you what we hold, correct it, delete it, or send you a copy. Open a ticket in our Discord and we'll do it by hand — there aren't enough customers for this to need a button.
Deleting your data removes your whitelist entries, which means your servers will stop loading whitelisted mods at their next restart. We'll say so before doing it.
If you're in the EEA or UK you also have the right to object to processing, to have it restricted, and to complain to your national data protection authority if you think we've got it wrong. We'd rather you told us first.
Discord's own rules require you to be at least 13, and older in some countries. We don't knowingly collect anything from children below that age. If you believe we have, tell us and it'll be deleted.
The site is HTTPS only. API tokens and bot credentials live server-side and are never sent to a browser. Staff-only pages re-check your Discord role on every request rather than trusting the page you're looking at.
No system is perfect and we're not going to pretend otherwise. If you find a hole, tell us in Discord before you tell anyone else and we'll fix it.
This policy can change; the date at the top says when it last did.
For anything on this page — a question, a correction, a deletion request — open a ticket in our Discord.