1. Scope And Operator
This policy covers the World War Z community website, Discord bot, dashboard and connected administration features. The public website is hosted through GitHub Pages, while authenticated operations and persistent bot records are handled by Railway and connected services.
This policy is intended to provide clear information broadly consistent with Australian privacy expectations. Whether a particular statutory privacy requirement applies depends on the circumstances; the community aims to handle information responsibly regardless.
2. Information Handled
Public And Technical Information
- Public DayZ server state, player totals, capacity, map, platform and update time.
- Basic request, error, security and operational information generated by the hosting services.
- Current-tab preferences such as dashboard session state and map view.
Account And Community Information
- Discord user identifier, username, display name, avatar, server membership and roles.
- Linked PlayStation ID and bot-maintained survivor, session, activity, PvP, faction, event and economy records.
- Survivor-shop catalogue limits, event-delivery profiles, order contents, prices, status, optional buyer delivery notes, saved delivery-location names and coordinates, next-restart deployment state, automatic delivery updates, manual trader-ticket fulfilment updates, refunds and order audit history.
- Support, moderation, warning, note, ban, case, appeal statement, appeal evidence reference, linked ticket, assignment, deadline, decision, action and audit information.
- Owner-configured notification destination labels, Discord channel names, event routes, test outcomes, delivery status and retry history.
- Evidence or context voluntarily submitted through official community channels.
3. Sources
Information may come from Discord OAuth, Discord guild membership and moderation APIs, user-submitted bot commands, account linking, DayZ or ADM logs, Nitrado server data, dashboard actions, member appeal submissions, saved delivery locations, shop event orders, Owner appeal, notification and mission-file configuration, community reports and support tickets.
4. Why Information Is Used
- Authenticate users and assign visitor, member, Admin or Owner access.
- Link Discord and PlayStation identities and provide personal bot features.
- Operate the virtual economy, survivor-shop purchases, saved delivery locations, next-restart Item delivery, restart-bound Event Item rentals, stock limits, manual fulfilment, refunds, events, tickets, statistics and server controls.
- Investigate reports, create moderation cases, process member appeals, operate linked support tickets, enforce bans and detect evasion or abuse.
- Protect the bot, API, website, database, community and connected accounts.
- Route authorised moderation and operational notifications to selected Discord channels.
- Diagnose failures, maintain audit integrity and improve reliability.
- Meet platform, security or legal obligations where applicable.
5. Browser Storage And Cookies
The website does not currently use advertising cookies, analytics cookies or behavioural tracking. It uses essential sessionStorage in the current browser tab for the opaque dashboard session and limited interface preferences. Personal Chernarus map pins are stored separately in browser localStorage so they can persist on that browser; they are not uploaded to Railway unless an authorised Admin deliberately creates a separate public marker. The Shop also caches non-personal DayZ Wiki preview-resolution results in localStorage for up to approximately 30 days to avoid repeatedly requesting the same item artwork. Session storage is normally removed when the tab closes and is also subject to Railway-side expiry.
Discord, GitHub, Railway, Nitrado, Fandom/DayZ Wiki or other external services may use their own cookies, logs or storage when you visit, authenticate with them, or load third-party Shop preview artwork. Their policies apply to that activity.
6. Service Providers And Disclosure
Information is disclosed only as reasonably necessary to operate or protect the services, including through Discord, Railway, Nitrado, GitHub Pages, Fandom/DayZ Wiki for optional catalogue preview artwork, and authorised community administrators. These providers may process information in countries outside Australia under their own terms and privacy practices.
Information may also be disclosed where required by law, to protect a person from serious harm, to investigate security abuse, or to report conduct to a relevant platform or authority. Personal information is not sold or rented.
7. Security Boundaries
- Discord bot tokens, OAuth secrets and Nitrado credentials remain on Railway and are not included in the public website.
- The browser receives an opaque session rather than Discord or Nitrado credentials.
- Railway rechecks current membership and roles before protected requests and actions.
- Personal endpoints derive identity from the session and cannot select another user's Discord ID.
- Protected player responses are allowlisted and exclude raw database IDs, Discord IDs, DayZ UIDs, live ADM positions, credentials and unrelated records. A linked member can access only their own saved shop-delivery coordinates, while authorised staff can access coordinates attached to orders they must fulfil.
- Write actions require authorisation, target validation, a reason, confirmation, operation-specific safeguards and audit logging.
- Temporary-ban expiry failures are retried rather than falsely marked successful.
- Webhook URLs and tokens are never submitted to the public website or stored in SQLite; the bot resolves an existing Discord webhook only while delivering a notification.
- Outgoing moderation notifications disable Discord mention parsing so user-supplied reasons cannot ping members or roles.
8. Retention
OAuth state expires after approximately 10 minutes, one-time login tickets after approximately 2 minutes, and the dashboard session after approximately 12 hours or when the current tab storage is cleared. Railway stores hashes of temporary login values rather than their usable originals.
Persistent player, economy, shop catalogue, shop order, saved delivery-location, event-profile, deployment, fulfilment, refund, moderation, ban, case, appeal, appeal evidence, linked support-ticket, assignment, shared public map-marker, webhook-configuration, notification-delivery and audit information is retained for as long as reasonably needed to operate the community, enforce restrictions, investigate abuse, resolve disputes, maintain audit integrity, recover accidental unlinking, meet platform requirements or comply with law. No fixed automatic deletion period is currently promised for these operational records.
9. Access, Correction And Deletion Requests
You may request access to, correction of, or deletion of information associated with you through the established Discord support-ticket process. Identity may need to be verified before a request is actioned.
Some information may be retained or withheld where reasonably necessary for security, moderation, ban enforcement, dispute resolution, the rights of others, technical integrity, platform requirements or legal obligations. Requests cannot require the community to alter accurate historical audit records, although a correction or review outcome may be appended.
10. Younger Users
Users must meet the age and consent requirements of Discord, PlayStation, DayZ and applicable law. Parents or guardians should supervise accounts where required. Do not submit unnecessary sensitive information about a child through public channels.
11. Questions And Complaints
Use the established World War Z Discord support-ticket process for privacy questions or requests. If you believe an Australian privacy law applies and a concern is not resolved, information about privacy rights and complaints is available from the Office of the Australian Information Commissioner.