The short version
You can read this whole site without an account and without accepting anything. If you do that, we store nothing about you and no third party is contacted on your behalf.
Everything below is about what changes when you accept cookies, create an account, list a server or buy something.
Who is responsible
JoinGG operates www.joingg.co and is the controller of the data described here.
The site owner needs to insert the legal name and postal address of the operating person or company here before this page is relied on. A policy without a named, contactable controller is not complete, and this is the one detail the site itself cannot supply.
For anything about your data, write in through the contact page.
If you only read the site
No account, no cookie consent given: nothing is stored about you by us.
Our web server keeps ordinary request logs — the requested address, the time, the response code and the user agent — for a short period, to keep the site running and to see when something breaks. That is a standard technical record and is not used to build a profile of anybody.
Cookies and the two third parties
JoinGG sets one cookie of its own: a session cookie, created when you sign in, which is what keeps you signed in. It cannot be switched off, because signing in is what it does. The row we store contains a SHA-256 hash of the cookie's value — the value itself is never written to our database, so a copy of the database does not let anyone impersonate you.
Beyond that, two Google services, and neither of them loads until you accept:
- Google Analytics 4 — page views, roughly where visitors came from and which pages get read. We use it to decide what to write next.
- Google AdSense — the adverts, which is what pays for the server. AdSense may set its own cookies to measure and personalise them.
Both are blocked outright until consent is stored. Not loaded with tracking disabled — not requested at all. You can confirm that yourself: open your browser's network tab, decline, and neither Google domain is contacted.
Your choice is kept in your browser's local storage, not in a cookie, and it never reaches us.
If you create an account
We store what the account needs and nothing beyond it:
- Your email address and display name.
- A hash of your password, if you set one. We never store the password and cannot recover it.
- If you signed in with Discord, Steam or Google, that service's account identifier and, where the service provides one, your avatar image URL. We do not receive your password for those services.
- An optional short biography and avatar colour, if you fill them in.
- Sign-in sessions: the hash described above, the expiry, and the browser user agent, so you can see where your account is signed in.
- When the account was created and when it last signed in.
If you vote for a server
Voting does not require an account, and it is the place where this site is deliberately careful.
To stop one person voting a hundred times, we have to recognise a repeat vote. We do that by storing a SHA-256 hash of your IP address combined with a secret value, plus the date. We never store the address itself. The hash cannot be turned back into an address without the secret, it is useless to anyone who obtains the database, and it lets us enforce one vote per server per day without knowing who you are.
If you list a server
A listing is public by design. The address, name, description and any Discord invite you supply are shown on the site, and our poller connects to the address you gave every fifteen minutes to read its public status — the same information any player's game client would ask for.
We do not receive anything about the people playing on your server. The query returns counts and map names, not identities.
If you buy something
Payments are handled entirely by PayPal. Your card details never reach this site and we never see them.
We store the PayPal order and capture identifiers, the amount, the currency, the status, and the email address PayPal reports for the buyer — enough to know what was bought, to support it, and to keep the accounting records the law requires.
Discord communities
Member counts on community listings come from Discord's own public widget, which a server has to switch on itself. We read what it publishes. Nothing about individual members is fetched or stored.
Where the data is
The site and its database run on a single server rented from a German hosting provider. Google and PayPal operate their own infrastructure internationally under their own terms, which is the reason the Google services are behind a consent gate.
The site owner should confirm the country the server is physically located in and state it here.
How long things are kept
- Account data — until you ask us to delete the account.
- Sessions — until they expire or you sign out.
- Votes — the hashed records are pruned on a schedule; they exist to score listings, not as a history of anybody.
- Orders — kept as long as tax and accounting rules require.
- Listings — until the owner or a moderator removes them. A server that stops answering is marked offline rather than deleted, so its uptime history stays honest.
Why we are allowed to hold it
For readers in the UK and the EU, the lawful bases are: consent for analytics and advertising cookies, which you give and can withdraw here; contract for accounts, listings and anything you have paid for; and legitimate interests for keeping the site up, preventing vote manipulation and keeping ordinary server logs.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to a use of it. Write in through the contact page and a person will deal with it.
If you are in the UK or the EU and you think we have got something wrong, you can also complain to your national data protection authority.
One honest limitation: a vote is stored as an unreversible hash, so if you ask us to find and delete "your" votes, we cannot identify which ones are yours. That is a consequence of not storing your address, and we think it is the right trade.
Children
This site is not aimed at children and accounts are not intended for under-16s. We do not knowingly collect data from them. If you believe a child has created an account, tell us and we will remove it.
Changes
If this policy changes in a way that affects what we do with your data, the date at the top changes and the cookie banner is shown again so the choice is made afresh rather than inherited.