Privacy policy
Last updated: 2026-10-29
This is the operator's policy on processing personal data on glitchmug.com ("glitchmug", "we") under Russian Federal Law No. 152-FZ "On Personal Data". For users in the EU it also describes processing under the GDPR.
Operator
Sole proprietor Maksim Dmitrievich Koltsov (Russia; INN 502752681000, OGRNIP 325508100641534). Questions and requests about your data: abuse@glitchmug.com. The operator alone decides the purposes of processing, what data is processed and how.
What we collect
- Account. When you sign in with HubCore ID we receive your account id, username, display name, avatar and, if you share it, your email.
- What you add. Profile (bio, links, banner, accent, badges you show), mods, files, images, comments, reviews, wall posts, collections, likes, follows and reports.
- Technical data. A keyed hash of your IP address (the key changes every 30 days), used for rate limits and to count a download once. The web server keeps raw IP addresses in its logs for 14 days for security. A session cookie keeps you signed in (see the cookie policy).
The data is of the general category; we do not process special or biometric data. We do not use analytics, advertising or tracking scripts, and we do not sell data.
Why, and on what legal basis
| Purpose | Basis |
|---|---|
| Registration, sign-in and identification | Your consent (152-FZ art. 6(1)(1)); performing the terms of use (art. 6(1)(5); GDPR art. 6(1)(b)) |
| Running the catalog: publishing and showing content and profiles | Same |
| Security, spam and abuse prevention, moderation, download counts | Consent; legitimate interest (art. 6(1)(7); GDPR art. 6(1)(f)) |
| Email notifications | Consent: turn them off in Settings or with the link in any email |
| Showing 18+ content | Consent: you confirm your age in Settings and can withdraw it |
You give consent to processing with a separate tick when signing in. Its text: Consent to the processing of personal data.
How we process it
Collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (provision, access), depersonalization, blocking, deletion, destruction. Processing is automated and mixed, with transfer over the Internet, and only for the purposes and to the extent listed above.
Where the data lives
Our databases are in Russia; this meets the data localization rule of 152-FZ. Sign-in (HubCore ID) and image storage (nigur) are run by the same operator on the same infrastructure. If you live outside Russia, your data is transferred there to provide the service.
Who receives it
- Cloudflare, Inc. (USA): the human check at sign-in (Turnstile) and protection of the site against attacks. It receives your IP address and technical browser data. This is a cross-border transfer of personal data.
- Google LLC (USA): a hint for moderators (Gemini) gets the content of a published mod: title, description, tags, images, file list. The author's account data (name, email, IP) is not sent. This is a cross-border transfer.
- Sign-in providers you choose (Discord, Google, GitHub) get your sign-in request directly from you. If your avatar comes from such a provider, your browser loads it from their server.
- Yandex LLC (Russia): Yandex Metrika, only if you pressed "Accept" in the cookie banner: page address, referrer, browser and device data, IP address, a cookie identifier.
- Google LLC (USA): Google Analytics 4, only after "Accept": the same data, with the IP address truncated. This is a cross-border transfer.
- Plausible runs on our own server: anonymous visit statistics without cookies or stored IPs, not shared with anyone.
- Public authorities, only when the law requires it.
What you publish (profile, mods, comments, reviews, wall posts, public collections) is public. Moderators see reports and moderation history.
How long we keep it
- Account and content: until you delete them or withdraw consent.
- Notifications: 90 days. Download records: 90 days. Webhook delivery logs: 14 days. Server logs: 14 days.
- Moderation records: as long as needed to handle appeals and legal claims.
Processing stops when you withdraw consent, delete the account, or the operator ceases its activity.
Deleting your account and withdrawing consent
Settings → Delete account. Your profile becomes "Deleted user"; email, links, bio and banner are erased, every session ends and your webhooks are switched off. Mods you published stay under their license unless you ask us to remove them; you can delete your comments and reviews yourself. You can also withdraw consent by writing to abuse@glitchmug.com: we stop processing and destroy the data within 30 days, except where the law lets us keep it.
Your rights
You can get information about your data and its processing, ask us to correct, block or destroy it, export it, object to processing and withdraw consent at any time. Write to abuse@glitchmug.com. We answer within 10 working days; we may extend this by 5 working days and will tell you if we do. You can also complain to Roskomnadzor, a court, or your country's data protection authority.
How we protect it
- A person responsible for personal data processing is appointed; this policy and internal rules are in place; compliance is checked internally.
- Connections to the site are encrypted (TLS). We do not store passwords: sign-in is handled by HubCore ID.
- The database holds a keyed hash instead of IP addresses; access is limited by roles; uploaded files are scanned for malware.
- The protection level of the information system is set under Russian Government Decree No. 1119.
- We report a data breach to Roskomnadzor within the time the law sets, and to affected users.
Children
glitchmug is not for children under 14, or under the age of digital consent in your country if it is higher.
Changes
We date every change at the top of this page and announce important ones on the site. The current version is always at this address.