Privacy Policy

What We Collect

We collect the information needed to operate a public API, protect the service, support customers, and provide paid API access:

Information	Why we use it
Request details such as path, method, request time, status code, request ID, sanitized query parameters, sanitized headers used for client identification, user agent, country code, network provider details when available, derived network identifiers, and rate-limit state. Raw IP addresses are used transiently to route requests, apply limits, and derive privacy-safe operational fields, but are not intentionally stored in retained telemetry.	To run the service, troubleshoot errors, prevent abuse, enforce limits, and investigate incidents
API inputs such as mod IDs, page numbers, search text, tags, sort options, and refresh-job IDs	To return the API response you requested and diagnose API behavior
API key records such as key prefix, hashed secret, owner/contact details, plan, status, creation and expiration dates, last-used time, and usage counters	To authenticate requests, meter usage, manage plans, rotate or revoke keys, and provide support
Billing and account information such as name, email address, organization, plan selection, invoice identifiers, payment status, tax-related metadata, and billing-provider customer IDs	To sell API access, process payments, issue invoices, comply with accounting obligations, and resolve billing questions
Operational performance and usage metrics such as request counts, response times, cache status counts, cache freshness, approximate country-level request origin, coarse unique client-network estimates, and upstream fetch results	To monitor reliability, cache performance, upstream health, capacity, and API usage patterns
Support messages, abuse reports, privacy requests, and related attachments or diagnostics you choose to send	To respond to your request, investigate problems, and keep an operational record of the conversation

The website stores your light/dark theme choice and some tool/admin preferences in your browser's localStorage. Browser-based config tools may also store drafts locally on your device so you can continue editing. Some API responses are cached in sessionStorage to make the tools faster. You can remove this data by clearing site data in your browser.

Workshop Data

The API provides Arma Reforger Workshop metadata, including fields such as mod names, authors, descriptions, images, tags, ratings, download counts, dependencies, scenarios, and update dates.

Workshop data is controlled by Bohemia Interactive. reforgermods.net caches and formats it for website tools and API use, but does not verify ownership, identity, moderation status, entitlement, or legal rights in Workshop content.

How We Use Information

We use collected information to provide the API, issue and manage API keys, process paid plans, maintain reliability, apply rate limits, measure operational performance, investigate errors, respond to support requests, prevent misuse, and meet legal or accounting obligations.

We do not sell personal information. We may share information with service providers that help operate hosting, DNS, security, email, logging, payment processing, tax calculation, invoicing, customer support, or abuse prevention.

Where privacy laws require a legal basis, we process information to provide the requested service or paid subscription, comply with legal obligations, protect the service and users, pursue legitimate operational and security interests, and, where applicable, based on consent.

API Keys

API keys are credentials. We store key secrets as hashes where practical and may store non-secret key prefixes so users and support staff can identify a key without exposing the full secret.

Requests made with an API key may be linked to the key's account, plan, usage counters, and support history. Keep keys private, rotate exposed keys, and do not place secret keys in public client-side code.

Payments And Billing

Paid API plans may be processed through third-party payment, tax, and invoicing providers, including Stripe. Those providers may collect and process payment details, fraud-prevention signals, and related transaction information under their own terms and privacy policies. reforgermods.net does not need to store full card numbers to operate paid plans.

We may keep billing records, invoice metadata, account email addresses, plan history, and payment status for business records, fraud prevention, dispute handling, tax, and compliance purposes.

Cookies And Storage

The current site does not use third-party advertising cookies and does not sell or share personal information for cross-context behavioral advertising. Authentication, checkout, billing portal, abuse prevention, and support features may use cookies or similar storage from the service or from payment/support vendors.

Account management uses an HTTP-only signed session cookie after passwordless email sign-in. Checkout and billing portal flows may redirect you to payment-provider pages that use their own cookies or similar technologies.

Local browser storage is used for site preferences and browser-only tool drafts. API requests should not include secrets, payment details, or sensitive personal information in query strings.

Logs And Retention

Operational logs may include request details needed for debugging, security, billing enforcement, and reliability. These logs are kept only as long as needed for operational, legal, accounting, or security purposes. Default telemetry settings retain raw request events for 90 days, hourly aggregates for 400 days, telemetry log entries for 30 days, error records for 365 days, and quota usage records for 7 days, but deployment settings or legal/business needs may change those periods.

Operational metrics may include aggregate request counts, response-time summaries, cache hit/miss/stale counts, cache keys, cache freshness timestamps, upstream fetch status, approximate country-level request counts, coarse unique client-network estimates, API-key usage counters, and retained aggregate day/week/month/year buckets.

Approximate country and unique client-network metrics are generated from request metadata for aggregate operational visibility. Raw IP addresses are not stored in the retained metrics snapshot. Unique client-network estimates use coarse IP network prefixes and rotating in-memory hashes, so they are approximate and are not intended to identify individual people.

Cached API responses may be kept temporarily to improve performance and reduce repeated requests to Workshop services. Cached responses may be stale and may be cleared or refreshed at any time.

Security

We use reasonable safeguards for a public API, including rate limiting, request limits, security headers, restricted CORS configuration, access controls, and key rotation/revocation tools where applicable.

No internet service is perfectly secure. You are responsible for protecting your API keys, account email, billing portal access, and any systems that call the API.

Your Requests

You may contact us to ask about privacy, billing records, API key records, support history, or account deletion. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a copy of certain personal information, and to complain to a privacy regulator. Some records may need to be retained for security, abuse prevention, legal, tax, accounting, or dispute-resolution reasons.

Because the service is operated from Canada and uses external providers, information may be processed in countries other than where you live. Service providers are expected to process information only for the services they provide to us and under their own applicable legal obligations.

Contact

For privacy questions, support requests, billing questions, contact requests, or abuse reports, join the ReforgerMods Discord support server or contact cedarline.digital at [email protected].

Changes

This policy may be updated as the service changes. The date at the top of the page will show when it was last revised.