Privacy
This page lists what Tevvez Cheats stores, why, and for how long. We keep as little as possible.
In short
- The forum stores no IP addresses, not in the database and not in its logs. A scrambled fingerprint of your network address (not the address itself) is kept for 14 days to detect shared accounts. It is different for every account and made with a key that is replaced every 14 days.
- You register with a username and an invitation code. We don't ask for an e-mail address or your real name.
- We don't track you, run analytics or show ads, and we never sell or share your data.
- Fonts and scripts come from this server, so your browser doesn't contact other sites. YouTube videos only load after you click.
- Private messages and tickets are stored encrypted (AES-256).
- You can download all your data at any time and ask for your account to be deleted.
Who runs this forum
This forum is run by the Tevvez Cheats team. You can reach the team with a support ticket or a private message after logging in.
What is stored and why
| Data | Why | How long |
|---|---|---|
| Account: username, password (stored only as a bcrypt hash, which cannot be read back), registration date, your roles | So you can log in and have the right permissions. | Until you delete your account |
| Who invited you | The forum is invitation-only. If a member is banned, the team can see who invited them. | Until you delete your account |
| Invitation codes you created and who used them | The forum is invitation-only. | Until the account is deleted; then the codes keep no link to it |
| Members you follow or block | Your following feed, and hiding the posts of members you blocked. | Until you remove them |
| Profile (voluntary): about me, profile picture, banner, custom status | Shown to logged-in members. | Until you change or remove it |
| Last seen (one timestamp, overwritten) | Online / idle / offline in the member list. Choose "Invisible" to appear offline. | Always only the latest time |
| Topics and posts | The forum content you write. | Until you or the team delete them |
| Private messages and support tickets (encrypted) | Only the two people in a conversation (tickets: you and the team) can read them. | Until the account is deleted |
| Coins, purchases: Coins history, product, plan, payment method name, date | Your balance and your access to purchased plans. No payment details, since paying happens outside the forum. | While your account exists. When it is deleted, the Coins history is removed and purchases stay only as an entry without your name. |
| Level and streak: XP, level roles you received, visit streak, streak freezes, weekly leaderboard prizes you won and question of the day bonuses | Your level next to your name, the daily bonus ladder, the leaderboard and the limit of one question of the day bonus per day. | Until the account is deleted; question of the day bonuses 365 days |
| Quests: finished quests (achievements) and proofs you sent (encrypted) | Rewards, and the team check of quests with a proof. The reason for a declined proof is shown on the Quests page and isn't copied into a message. | Achievements until the account is deleted, proofs and the team's reason 365 days after the decision |
| Cosmetics you bought or rented (item, end of a rental, what you wear) and giveaway entries (entry number, cost, result) | Showing what you wear next to your name and picture; the draw and its public check (entry numbers only, winners by name). | Until the account is deleted; entries in ended giveaways keep only the number |
| Coupon codes you used (code, time, order) and inviter rewards (amount and state, without names) | Limits like "once per member". Your inviter only sees totals, never who bought what. | Code uses 365 days (for a "once per member" code that can still be used: until the code ends), rewards 365 days after they were paid or cancelled |
| Notifications: who replied, quoted or mentioned you and where (only links, no text) | The bell in the header. You can switch each kind off under Account › Notifications. | 60 days |
| Feedback chips you gave (Thanks, Still works, Outdated) and bounties you set | Others only see the counts, never who gave them. Limits against farming Coins. | Until you remove them, the post or topic is deleted or your account is deleted |
| Votes in polls and on suggestion boards, and your "Did this help?" answers under help articles | So nobody votes twice. For polls only that you voted is stored, not your choice. Others only see the totals. | Until the topic, the article or your account is deleted |
| Status notifications: the programs you clicked "Notify me" for | You get a notification when such a program is back online or has a new version. | Until you switch it off or your account is deleted |
| Downloads: which loader you downloaded and the random file name you got | Protection against leaks of paid files. | 365 days |
| Moderation: mutes, bans, team action log, AutoMod log | Keeping the forum safe. AutoMod entries about you and your own log entries (registration, redeemed plans, ban appeals) are part of your data download. | Team log 365 days, AutoMod log 90 days (only the reason, never your text) |
| Team notes and the watch list: short remarks the team keeps about accounts (notes and watch reasons encrypted) | Moderation. You are not told about them. | Until the account is deleted |
| Reports and warnings: what you reported (reason, optional note, encrypted), warnings you received | The team checks reports; the member is never told who reported them. You see your active warnings under Account › Warnings. | Reports 365 days after the team decided, warnings 365 days after they expired |
| Ban appeals and posts waiting for review (encrypted) | The one appeal you can send per ban, and new posts of new accounts that the team checks before they go live. | Appeals 365 days after the decision, rejected posts 30 days (only the title and the reason) |
| Deletion requests: your optional reason (encrypted) and the team's answer | The team decides on account deletions. You see the answer on your Privacy & data page; it is not copied into a message. | Declined or withdrawn requests 365 days after the decision; an approved request keeps only "deleted-…" |
| Security feed: powerful role changes, possible shared accounts and similar events that name your account | Only the owner and the security team see it. | 180 days |
| Logged-in devices: a short name like "Firefox on Windows", when you logged in and when you were last active (the full browser string is not stored) | The list under Account › Security, where you can log out other devices. | Until you log out or the login ends (30 days) |
Known devices: a random device cookie (forum.dev); the server only keeps a scrambled form of it with the device name | You get a "New login" notification when your account is used from a browser it has not used before. | 180 days after the device was last used |
| Shared-account check: a scrambled fingerprint of your network address (not the address itself) and of your device | Accounts are for one person. The team sees only counts and times, for example "3 devices in 7 days", never an address. The network fingerprint is made from your account and your address, so it is different for every account and cannot be compared between accounts. Its key is kept outside the database and replaced every 14 days; the old key is deleted 7 days later, and from then on nobody can turn those fingerprints back into an address. | 14 days |
Login cookie (forum.sid), device cookie (forum.dev) and a 2-minute download cookie | Keeps you logged in / recognises your browser for login notices / shows that a download started. No tracking cookies. | Login 30 days or until logout, device cookie 1 year |
| Settings in your browser (local storage): collapsed categories, hidden member list, unread markers, YouTube consent, the keyboard shortcut setting, recently opened topics and read markers (per account, removed at logout) | Only on your device, never sent to the server. | Until you clear your browser |
What is NOT stored
- IP addresses. The login protection (too many wrong passwords) only works with a random, salted hash that stays in memory for 15 minutes and is never written to disk.
- E-mail addresses, real names, phone numbers, addresses.
- Payment data (card, PayPal or wallet details).
- Browser fingerprints, location, click tracking or statistics about you. The device cookie above is a random value, not a fingerprint of your device.
Third parties
- YouTube: tutorial videos in the Download tab are embedded from YouTube (privacy-enhanced mode, youtube-nocookie.com). The video, and with it a connection to Google that includes your IP address, is only loaded after you click "Load YouTube video".
- Discord: links to our Discord server take you to Discord; their privacy policy applies there.
- Hosting: the server is operated by a hosting provider. The forum itself writes no access logs; depending on the hosting, the provider may keep technical logs for operation and security.
Encryption
Private messages, ticket texts, report and warning notes, ban appeals, posts waiting for review, quest proofs, deletion request reasons, team notes and the team's payment notes are stored encrypted with AES-256-GCM. The key is stored separately, so they can't be read from a copied database or backup. This is not end-to-end encryption: the server has to decrypt the messages to show them to you, and the team needs to read tickets and messages sent to them. Passwords are never stored, only a bcrypt hash. All connections use HTTPS.
Deleted rows are overwritten with zeros in the database file, the database log is emptied after an account is deleted, and the file is cleaned up once a week.
Your rights
- See and download everything: Account › Privacy & data › Download my data (JSON file).
- Correct: change your profile, status, pictures and posts at any time.
- Delete: request the deletion of your account. The team reviews the request; when it is approved, profile, pictures, private messages, tickets, Coins and download history are removed. Your posts stay anonymous as "deleted-…" unless the deletion of your posts is approved too. Invitation codes lose the link to your account, and your old name is removed from quotes and @mentions in other posts (they then say "a deleted member") and from the team's notes and reasons. If a request is declined, you get a notification and see the reason on your Privacy & data page.
- Open a support ticket if anything is unclear.