Privacy Policy

The short version

The site holds what you gave it and what you did on it. There is no analytics, no advertising, and no third-party script on any page. Nothing here is sold or shared with anyone who is not needed to run it.

What osu! tells us when you sign in

Signing in asks osu! for the identify scope only. From that the site keeps your osu! user id, your username, the address of your avatar, and your country code.

It never receives your email address or your password.

What you give us

Depending on what you do here:

• A request: the beatmap link, your notes, and which modders you tagged.
• An application: your timezone, and whatever you write in the portfolio, experience, favourite mappers, favourite maps and motivation fields.
• A profile: your timezone, languages, how to reach you, the blocks of text and featured maps you add, and the banner, backdrop and artwork images you upload.
• Mentorship: tasks set for you, what you submit for them, and your mentor's feedback.
• As a modder: your queue status, your own rules, and the note you leave when you answer a request.

What the site records by itself

Every request carries the modders it went to and what each of them decided, with the time. Your profile carries the date you joined and the figures worked out from your answered requests.

Admin and member actions are written to an append-only log: who acted, what they did, what they did it to, and the IP address the request came from. Sign-in attempts are rate limited by IP address, which is held in memory only and never written to the database.

Cookies

Four, all set by this site, none for tracking:

• bb_osu_session — keeps you signed in for 30 days. It holds a signed reference to your account and nothing else.
• bb_admin_session — the same thing for an admin signed into the admin panel.
• bb_oauth_state and bb_oauth_next — set for ten minutes while you are being sent to osu! and back, so the round trip cannot be forged and you land back where you started.

Things kept in your browser

Your motion preference (bb_motion), which menu you last used (bb_view), and which sets of rules you have read (bb_rules_agreed, bb_rules_ack) are kept in your browser's own storage, along with whether you have seen the welcome (bb_welcome, cleared when you close the tab).

None of those are sent to the server. Clearing your browser data clears them.

Who else is involved

Running the site means these parties handle some of it:

• osu! (ppy Pty Ltd) — signs you in, and answers the site's questions about a beatmap. Avatars are loaded straight from osu!'s servers by your browser, so osu! sees your IP address when a page shows one.
• Vercel — hosts the site and keeps ordinary server logs, which include IP addresses.
• Neon — hosts the database, in the United States.
• Discord — only through the group's bot, which has its own policy.

How long it is kept

Requests are deleted 365 days after they were made, once nothing on them is still waiting for an answer. IP addresses in the action log are erased after 90 days, leaving the rest of the entry. A background image that has been retired from the pool is deleted 183 days later, and one that was refused is deleted after 30 days.

Database snapshots are taken nightly and the newest fourteen are kept. Your account, profile and mentorship history stay while you are part of the group.

What you can ask for

You can sign out, edit or empty your profile, and remove images you uploaded, at any time.

Ask an admin in Discord and your account will be erased: your osu! id, username and avatar are removed from it and from every request you made, which is left under a name that points at nobody. The mods themselves stay, because they are also somebody else's record of work they did.

Ask and you will be told what the site holds about you.

How it is kept

Session cookies are signed, marked http-only so no script can read them, and sent over HTTPS only. Admin passwords are stored as bcrypt hashes. The action log is hash-chained, so an entry cannot be changed or removed without it showing. Uploaded images are re-encoded on the way in rather than being stored as sent.

Age

The site is for osu! players and follows osu!'s own rule on this: it is not meant for anyone under 13, and no account is knowingly kept for one.

Changes

This page changes when what the site does changes, and the date at the top moves with it.

Getting in touch

Ask in the group's Discord. It is linked at the bottom of every page.

The other documents