~/privacy

Privacy Policy

Effective Date: October 2026 • Last updated: October 2026

#1. Overview & Scope

Project Irisyle ("we", "us", "our") provides open-source software, web applications, project management tools, community services, and game server integrations across our collective. This Privacy Policy explains what information we collect, how it is stored, how it is utilized, and what rights you have concerning your personal data.

This policy applies across all Project Irisyle properties, including irisyle.live, auth.irisyle.live, admin.irisyle.live, status.irisyle.live, cad.irisyle.live, our Discord integrations, and collaborator game servers such as The Oregon Project and Allegiance Roleplay.

#2. Account Information & Data Acquired Externally

Project Irisyle operates a centralized Single Sign-On (SSO) authentication service at auth.irisyle.live. When you choose to authenticate using Discord OAuth2, we request access under the identify and email scopes to retrieve and store the following account attributes:

Discord Snowflake ID: Your permanent, unique Discord account identifier. Used as the immutable key to link your account across all Project Irisyle sites and services.
Username & Avatar: Your current Discord username and avatar image URL. Used to display your profile on dashboards, rosters, and community boards.
Email Address: The verified email address linked to your Discord account. Used solely for essential account notices, security updates, and administrative communications. We do not sell, share, or send unsolicited marketing emails.
Community & Role Permissions: Platform role standings (such as staff or admin access) and community roster designations (department assignments or unit callsigns in The Oregon Project or Allegiance Roleplay) synchronized from our Discord servers or assigned by authorized staff.

You can inspect your current authenticated profile and connected services at any time by visiting the Account Dashboard.

#3. Session Cookies & Local Storage

We do not use invasive third-party tracking or advertising cookies. Our cookies fall into three clear categories:

Cookie Name	Domain & Scope	Lifespan	Description
irisyle_session	.irisyle.live (cross-subdomain)	30 Days	Strictly necessary HMAC-SHA256 signed JWT containing your user ID, Discord ID, username, avatar, and roles. Kept secure, HttpOnly, SameSite=Lax. Enables seamless Single Sign-On across all network services without re-authenticating.
oauth_state	auth.irisyle.live	10 Minutes (Ephemeral)	Cryptographically random token used during Discord OAuth authentication to protect your account against Cross-Site Request Forgery (CSRF). Immediately destroyed upon login.
oauth_next	auth.irisyle.live	10 Minutes (Ephemeral)	Preserves your intended destination URL during login so you are seamlessly redirected back after authenticating. Destroyed immediately upon login.
theme	Current domain (e.g. oregon.irisyle.live)	1 Year	Stores your client-side visual preference (dark or light mode). Non-identifying and set only when you interact with the theme toggle.

#4. Public Board & Community Feedback

When you interact with our public Feedback & Issue Board (/board):

Submitting Bugs & Suggestions: We store your submission title, markdown description, selected community (Irisyle, Oregon, or Allegiance), targeted service, and category along with your Discord Snowflake ID and username.
Comments: Staff and community discussion messages are stored with author identifiers and creation timestamps.
Upvotes: Upvoting records your Discord Snowflake ID against the card ID to prevent duplicate voting and measure community demand.

Card titles, descriptions, and comments you post on public boards are visible to other members. Please do not submit confidential, private, or sensitive personal information in public cards.

#5. In-Game Server Data & FiveM

When connecting to and playing on our FiveM game servers (such as The Oregon Project):

Platform Identifiers: FiveM and Cfx.re transmit standard connection identifiers (such as your FiveM license, Steam ID, and Discord ID) required for server access validation and player persistence.
In-Game Character Data: Fictional character names, inventories, vehicles, and gameplay progress are saved in our game databases to maintain persistent world state.

#6. Web Analytics & Cryptographic IP Hashing

We collect minimal, privacy-respecting aggregate traffic analytics to understand platform usage and server capacity needs:

Hashed IP Addresses: Raw, plain-text IP addresses are never stored in our analytics database. Instead, incoming IP addresses are immediately passed through a one-way cryptographic SHA-256 hash. This allows us to distinguish unique daily visits without maintaining identifiable IP logs.
Telemetry Collected: Requested URL pathname, referring domain, screen resolution category, and timestamp.

#7. E-Commerce & Tebex Billing

Payments for digital licenses, server supporter tiers, or premium assets are processed exclusively by Tebex Limited ("Tebex"), who acts as the official Merchant of Record. Project Irisyle does not receive, process, or store credit card numbers, debit card details, bank information, or complete billing addresses. Tebex notifies our systems of successful transactions via authenticated webhooks containing order numbers and purchased package identifiers to fulfill your delivery.

#8. Data Sharing & Third Parties

We do not sell, rent, monetize, or trade your personal data to advertisers, data brokers, or third parties. We only transmit or synchronize data with third parties strictly required for platform operations:

Discord Inc.: For OAuth2 user identity verification and guild role synchronization.
Cfx.re / Take-Two Interactive: For FiveM game client authentication and asset escrow delivery.
Tebex Limited: For payment checkout and digital store fulfillment.
Infrastructure Providers: Encrypted database and server hosting facilities located in secure data centers with restricted administrative access.

#9. Age Restriction (18+)

All Project Irisyle services, applications, software releases, Discord servers, and FiveM game servers are strictly restricted to individuals eighteen (18) years of age or older. We do not knowingly solicit, collect, or retain data from minors. If we discover that a user under 18 has registered an account, that account and its associated records will be promptly terminated and purged.

#10. Your Rights & Data Erasure

We believe in total transparency and user control over personal data:

Right of Access: You can view your current authenticated profile, email, creation date, and connected community services at any time by visiting the Account Dashboard.
Right to Rectification: Updating your Discord username or avatar and logging in again will immediately update your profile information in our database.
Right to Erasure (Account Deletion): You may request the permanent deletion of your account and personal database records by opening a support ticket in our official Discord server. Please note that security ban records and audit logs may be retained where legitimate interest or network defense requires it.

#11. Security Measures

We implement industry-standard protective measures, including TLS/HTTPS encryption across all domains, secure HMAC-signed JWT session cookies, parameterized database queries to prevent SQL injection, cryptographic IP hashing, and restricted administrative access limited to verified operational staff.

#12. Contact & Inquiries

If you have questions regarding this Privacy Policy or wish to exercise your data rights, please contact Project Irisyle administration via our official Discord server or review our Legal & Terms page.