Privacy Policy

Information we process

Routine website and security data. Cloudflare and our systems may process an IP address, browser and device information, requested URL, referral information, request time, response status, and security events. We use this information to deliver the site, prevent abuse, troubleshoot failures, and protect the service.

Admin data. Authorized administrators provide a username and password and use an authenticator. We store password hashes and salts, encrypted authenticator seeds, permissions, security counters, session and trusted-device token hashes, IP addresses, user agents, and encrypted administrative audit records. We do not store plaintext passwords.

Webhook Builder data. Draft message content and named drafts are stored locally in your browser. Webhook URLs and uploaded files are kept in the current tab and are not included in saved drafts, exports, or share links. When you ask the tool to read, send, edit, or delete a Discord webhook message, the Cloudflare Worker temporarily processes the webhook credential, message content, identifiers, and any files and relays them to Discord. The Worker does not save that request content or credential in its application database. Discord will retain content according to its own practices.

Webhook Proxy data. When a server script uses webhook.southlandlabs.dev, our backend temporarily processes the webhook ID and Discord token contained in the request URL path, the message request and any attached files, the source IP address, and routine request metadata. The application forwards the request to Discord and does not intentionally store or log webhook tokens or message payloads. It uses IP-based rate-limit counters held in memory to enforce the configured rate-limit window. Generated proxy URLs contain webhook credentials; keep them in server-only configuration and do not expose them in client scripts, public repositories, browser history, or logs.

Status data. Our Worker retrieves service-health data from our Uptime Kuma instance. If you open the Minecraft status dialog, your browser contacts api.mcstatus.io and that provider receives routine connection data such as your IP address.

Cookies and local browser storage

We do not use advertising or behavioral-analytics cookies. Authorized admin pages use strictly necessary, Secure, HttpOnly cookies for a 15-minute idle session, a five-minute authenticator challenge, and—only if the administrator selects it—a trusted-device record lasting up to 14 days. Cloudflare Turnstile may use strictly necessary security storage on the admin login page.

The public site uses local storage to remember that this notice was dismissed for about six months. The Webhook Builder uses local storage for autosave and named drafts until you clear them in the builder or through browser controls. Share links put message content in the URL fragment; anyone who receives such a link can read that content.

Why we use information

We process information to provide requested features, authenticate administrators, maintain an audit trail, secure and rate-limit the service, diagnose problems, and comply with valid legal obligations. Where a law requires a legal basis, we rely on providing a feature you requested, our legitimate interests in operating and securing the service, compliance with legal obligations, or consent when we specifically ask for it. We do not sell personal information, use it for targeted advertising, or create marketing profiles.

Service providers and disclosures

We use Cloudflare for hosting, D1 database storage, network security, Turnstile, and operational logs; a self-managed backend server for the webhook relay; Discord for community links and webhook delivery; cdnjs for Font Awesome site assets; api.mcstatus.io for on-demand Minecraft status; and our Uptime Kuma installation for service status. These providers process data under their own terms and privacy notices. We may also disclose information when reasonably necessary to protect users or the service, investigate abuse, or respond to a valid legal demand.

Retention and security

Expired admin sessions and authenticator challenges are purged on a scheduled basis; trusted-device records expire after 14 days; login-rate records are short-lived; and encrypted admin audit entries are scheduled for deletion after 90 days. Cloudflare Workers Logs may be retained for up to seven days, depending on the account plan. The webhook-proxy application does not create request-access logs, and its in-memory rate-limit entries expire after the configured window; infrastructure providers may keep routine network and security logs under their own retention settings. Site configuration and admin account records remain until changed or deleted. Browser drafts remain on your device until you clear them.

We use access controls, encryption for authenticator seeds and audit payloads, hashed session tokens, rate limits, and transport security. No internet service can promise absolute security. Do not put secrets or sensitive personal information in message drafts, exports, share links, or public Discord channels.

Your choices and privacy requests

You can clear public-site local storage through the Webhook Builder or your browser. Administrators can sign out to revoke the current session and trusted-device record. Depending on where you live, you may have rights to request access, correction, deletion, or a copy of personal information, or to appeal a denied request. Contact us through the official Southland Labs Discord; do not post account secrets or sensitive information in a public channel. We may need to verify a request before acting.

Because the public site does not perform cross-site behavioral tracking, it does not respond differently to browser “Do Not Track” signals. We honor legally required opt-out mechanisms if our practices change in a way that makes them applicable.

Information is primarily processed in the United States and may be processed where our service providers operate. If local law applies, you may also withdraw consent where consent is the basis for processing and complain to your local data-protection authority.

Children

The site is not directed to children under 13, and we do not knowingly collect their personal information. The Discord and webhook features are only for people old enough to use Discord in their country. If you believe a child supplied personal information to us, contact us so we can investigate and delete it where appropriate.

Changes and contact

We may update this policy as the site or legal requirements change. The date above identifies the current version. Questions, privacy requests, and abuse reports can be sent through the official Southland Labs Discord.