Privacy Policy

What We Collect

We collect the information needed to operate a public API and website, protect the service, support customers, and provide paid API access:

Information	Why we use it
Request details such as path, method, request time, status code, request ID, sanitized query parameters, sanitized headers used for client identification, user agent, client kind and version, country code, network provider details when available, derived network identifiers, and rate-limit state. Raw IP addresses are used transiently to route requests, apply limits, and derive privacy-safe operational fields, but are not intentionally stored in retained telemetry.	To run the service, troubleshoot errors, prevent abuse, enforce limits, and investigate incidents
API inputs such as mod IDs, server IDs, scenario IDs, page numbers, search text, tags, filters, history ranges, sort options, and refresh-job IDs	To return the API response you requested and diagnose API behavior
A launcher install identifier sent by the desktop launcher, as described under The Desktop Launcher, stored only as a keyed, irreversible digest	To count distinct launcher installs rather than only requests, and to understand version adoption and retention
API key records such as key prefix, hashed secret, owner/contact details, plan, status, creation and expiration dates, last-used time, and usage counters	To authenticate requests, meter usage, manage plans, rotate or revoke keys, and provide support
Billing and account information such as name, email address, organization, plan selection, invoice identifiers, payment status, tax-related metadata, and billing-provider customer IDs	To sell API access, process payments, issue invoices, comply with accounting obligations, and resolve billing questions
Donation records such as the amount, currency, payment status, and the payment-provider identifiers for the contribution	To accept voluntary contributions, reconcile them, handle refunds or disputes, and keep business records
Operational performance and usage metrics such as request counts, response times, cache status counts, cache freshness, approximate country-level request origin, coarse unique client-network estimates, distinct-install estimates, and upstream fetch results	To monitor reliability, cache performance, upstream health, capacity, and API usage patterns
Support messages, abuse reports, privacy requests, server-listing correction requests, and related attachments or diagnostics you choose to send	To respond to your request, investigate problems, and keep an operational record of the conversation

The website stores your light/dark theme choice and some tool/admin preferences in your browser's localStorage. Browser-based config tools may also store drafts locally on your device so you can continue editing, and the ping tool stores your chosen region and its most recent measurements there. Some API responses are cached in sessionStorage to make the tools faster. You can remove this data by clearing site data in your browser.

We do not run third-party advertising or cross-site tracking scripts, and the site has no third-party analytics tag. What we know about usage comes from our own request logs and the aggregate metrics described below.

Workshop And Server Data

The API provides Arma Reforger Workshop metadata, including fields such as mod names, authors, descriptions, images, tags, ratings, download counts, dependencies, scenarios, and update dates.

It also indexes the public Arma Reforger server list: server names, scenario names and imagery, game version, region and ping site, platform availability, BattlEye and password flags, current and historical player counts, queue figures and queue wait estimates, server simulation FPS, published host address, port and lobby session identifier where the lobby exposes them, and the mods a server requires.

Both datasets describe games and servers, not players. The index holds no player names, Steam or console accounts, in-game identities, chat, or per-player session records, and the API exposes none.

Workshop and lobby data is controlled by Bohemia Interactive. reforgermods.net caches and formats it for the website, tools, embeds, launcher, and API use, but does not verify ownership, identity, moderation status, entitlement, or legal rights in that content. Server operators who want a listing corrected or removed should contact support; we cannot change what the official lobby publishes.

Website Tools

Some browser tools do work on your device that is worth naming:

The region ping tool measures latency by having your browser make timed requests directly to Arma Reforger ping-site hosts. Those requests go to third-party infrastructure, not to us, so those hosts see your IP address and request metadata under their own terms. To choose a starting region, the tool may call our /v2/network/location endpoint, which reads the coarse geolocation Cloudflare attaches to your request, rounds coordinates to roughly 11 km, and returns only a country, region, city, and those rounded coordinates. It never returns your IP address, the response is marked private, no-store, and the result is not retained. Measurements and your region choice are kept in your browser, not on our servers.

The config generator and validator run in your browser. Config contents you paste or build are processed locally and kept as local drafts; do not paste server passwords, admin credentials, or tokens into them.

The server status embed at /embed/server/{id} is plain HTML with an inline stylesheet. It sets no cookies, loads no scripts, and makes no third-party requests, so placing it on your site does not add tracking to your visitors. Your visitors' requests for the widget reach our servers and appear in our request logs like any other request.

The Desktop Launcher

The desktop launcher is an anonymous client. It has no accounts and no sign-in, sends no API key, and does not ask for personal information.

Each request to our API carries the launcher's version in its User-Agent and an install identifier in the X-Launcher-Install-Id header. That identifier is derived on your device as a salted SHA-256 digest of a per-operating-system installation value — MachineGuid on Windows, /etc/machine-id on Linux — or a locally generated random value where neither is readable. The underlying machine value never leaves the process; only the digest is sent, and it cannot be reversed into a machine identifier. It is not a device serial, MAC address, or user account, and it changes when the operating system is reinstalled. Because it is derived rather than stored, it currently persists across launcher reinstalls and there is no in-app reset. Our servers store it only as a further keyed, truncated digest, keyed with a secret we can rotate, and the raw header is redacted before request headers are recorded.

The identifier is an analytics hint. It is spoofable by design, it is never used for authentication, entitlement, quotas, or moderation, and rate limiting continues to be enforced on IP address.

What the launcher keeps on your device only, in launcher-state.json in its own configuration folder: your settings, favorites, recent servers, and launch history. None of that is uploaded.

The launcher inspects your local Arma Reforger addon folder to report how many required mods are installed, outdated, or missing. That scan happens entirely on your machine and the results are never sent to us. It reports readiness and never installs, modifies, or deletes game content.

Other outbound connections the launcher makes:

Connection	What it involves
Latency measurement	ICMP echo requests from your machine directly to the selected server and to region ping sites. Those hosts see your IP address.
Scenario imagery	Images loaded from the Bohemia Interactive CDN, restricted to an allowlist of hosts and enforced by a content security policy.
Joining a server	A steam:// handoff to your local Steam client. Steam and the game server handle the session under their own terms; we are not part of it and receive nothing back.
Discord Rich Presence	On by default and switchable off in settings. While enabled, it publishes to your local Discord client what the launcher is doing — the name of the server you are viewing or joining and its player count — which your Discord friends can see. It goes to Discord, not to us.
Updates	On Windows, the launcher checks a signed update manifest on dl.reforgermods.net and verifies a signature before applying anything. Linux installs update through your package manager instead.

The launcher contains no crash reporter, no third-party analytics or telemetry SDK, and no advertising code.

How We Use Information

We use collected information to provide the API and website, issue and manage API keys, process paid plans and donations, maintain reliability, apply rate limits, measure operational performance, investigate errors, respond to support requests, prevent misuse, and meet legal or accounting obligations.

We do not sell personal information, and we do not sell or license community usage data. We may share information with service providers that help operate hosting, DNS, CDN and edge delivery, security, email, logging, payment processing, tax calculation, invoicing, customer support, or abuse prevention. Current providers include Cloudflare, which fronts the website and API and serves the site's rendering and caching layer, and Stripe, which processes payments.

Where privacy laws require a legal basis, we process information to provide the requested service or paid subscription, comply with legal obligations, protect the service and users, pursue legitimate operational and security interests, and, where applicable, based on consent.

API Keys

API keys are credentials. We store key secrets as hashes where practical and may store non-secret key prefixes so users and support staff can identify a key without exposing the full secret.

Requests made with an API key may be linked to the key's account, plan, usage counters, and support history. Keep keys private, rotate exposed keys, and do not place secret keys in public client-side code.

Payments, Billing And Donations

Paid API plans may be processed through third-party payment, tax, and invoicing providers, including Stripe. Those providers may collect and process payment details, fraud-prevention signals, and related transaction information under their own terms and privacy policies. reforgermods.net does not need to store full card numbers to operate paid plans.

Voluntary donations are also processed by Stripe Checkout. Choosing an amount sends you to a Stripe-hosted page; card details are entered there and not on our site. We receive the amount, the payment status, and the provider's transaction identifiers, and an email address when Stripe passes one on with the receipt. Donations unlock no features and do not influence listings or rankings.

We may keep billing records, invoice metadata, account email addresses, plan history, donation records, and payment status for business records, fraud prevention, dispute handling, tax, and compliance purposes.

Cookies And Storage

The current site does not use third-party advertising cookies and does not sell or share personal information for cross-context behavioral advertising. Authentication, checkout, billing portal, abuse prevention, and support features may use cookies or similar storage from the service or from payment/support vendors.

Account management uses an HTTP-only signed session cookie after passwordless email sign-in. Checkout, donation, and billing portal flows may redirect you to payment-provider pages that use their own cookies or similar technologies. Cloudflare may set cookies or similar identifiers for security and abuse prevention at the edge.

Local browser storage is used for site preferences, browser-only tool drafts, and ping measurements. API requests should not include secrets, payment details, or sensitive personal information in query strings.

Logs And Retention

Operational logs may include request details needed for debugging, security, billing enforcement, and reliability. These logs are kept only as long as needed for operational, legal, accounting, or security purposes. Default telemetry settings retain raw request events for 90 days, hourly aggregates for 400 days, telemetry log entries for 30 days, error records for 365 days, and quota usage records for 7 days, but deployment settings or legal/business needs may change those periods.

Operational metrics may include aggregate request counts, response-time summaries, cache hit/miss/stale counts, cache keys, cache freshness timestamps, upstream fetch status, approximate country-level request counts, coarse unique client-network estimates, distinct launcher-install counts and version split, API-key usage counters, and retained aggregate day/week/month/year buckets.

Approximate country and unique client-network metrics are generated from request metadata for aggregate operational visibility. Raw IP addresses are not stored in the retained metrics snapshot. Unique client-network estimates use coarse IP network prefixes and rotating in-memory hashes, so they are approximate and are not intended to identify individual people.

Cached API responses and rendered pages may be kept temporarily to improve performance and reduce repeated requests to Workshop and lobby services. Cached responses may be stale and may be cleared or refreshed at any time. Historical server population figures are retained as aggregate time buckets so the site and launcher can show population trends.

Security

We use reasonable safeguards for a public API, including rate limiting, request limits, security headers, restricted CORS configuration, access controls, signed release artifacts for launcher updates, and key rotation/revocation tools where applicable.

No internet service is perfectly secure. You are responsible for protecting your API keys, account email, billing portal access, and any systems that call the API.

Your Requests

You may contact us to ask about privacy, billing records, donation records, API key records, support history, or account deletion. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a copy of certain personal information, and to complain to a privacy regulator. Some records may need to be retained for security, abuse prevention, legal, tax, accounting, or dispute-resolution reasons.

Launcher data is harder for us to act on than it looks: with no accounts, the install identifier is the only thing tying requests together, and we hold it only as an irreversible digest. We cannot look up your install or single out its records from a request you make by email. You can stop the launcher sending it by uninstalling the launcher, and you can clear what is stored locally by deleting its configuration folder.

Because the service is operated from Canada and uses external providers, information may be processed in countries other than where you live. Service providers are expected to process information only for the services they provide to us and under their own applicable legal obligations.

Contact

For privacy questions, support requests, billing questions, contact requests, or abuse reports, join the ReforgerMods Discord support server or email support@reforgermods.net.

Changes

This policy may be updated as the service changes. The date at the top of the page will show when it was last revised.