Privacy Policy

Monsterbrew is operated by an individual developer, registered in Belgium, who is the data controller within the meaning of Art. 4(7) GDPR and is referred to as "we" in this policy.

• Address: Gooik, Belgium
• Enterprise number: 0742.876.379
• VAT number: BE 0742.876.379

For all matters relating to this policy or to your personal data, contact [email protected].

Creatures, items, collections, and related content you create are stored locally in your browser using IndexedDB. Unless you sign in and sync it, this content is not transmitted to or stored on our servers. With Premium, every creature, item, and collection you save syncs automatically. Clearing your browser storage permanently deletes anything that was not synced.

The application additionally stores functional settings in your browser, such as your theme choice and whether CR suggestions are enabled. These remain on your device and are not used to identify or track you.

Cloudflare, the network that sits in front of our hosting provider, sets one cookie, called __cf_bm, to tell people apart from automated bots and protect the site against abuse. It holds encrypted information Cloudflare uses to estimate whether a visitor is a bot, and it can hold a session identifier. It expires after 30 minutes without activity. Signing in sets a session cookie that keeps you signed in, for as long as your session lasts (Section 3).

An account is optional. You must be at least 13 years old to create one, as set out in the Terms of Service. Authentication is performed by Discord. We receive and store from your Discord profile: your display name, your email address, and your avatar, together with the technical tokens Discord issues to verify your identity. We never receive or store a password, and we read nothing else from your Discord account. We also record which version of the Terms of Service you accepted, and when.

For each sign-in we create a session record containing your IP address and browser version. Session records exist to secure your account.

Legal bases: account data is processed for the performance of a contract (Art. 6(1)(b) GDPR); session records are processed on the basis of our legitimate interest in account security (Art. 6(1)(f) GDPR).

Creatures and items you sync, whether you choose them yourself or they sync automatically with Premium, are stored in our database to provide them back to you (Art. 6(1)(b) GDPR). They remain your data. We do not sell them, analyse them for our own purposes, or use them to train AI models.

With Premium, the artwork of a synced creature or item is stored with it, in your account. On a free account, artwork never leaves your device, even when the record syncs. We delete stored artwork once none of your synced creatures or items use it.

With Premium, your collections sync automatically. We store each collection's name, description, and the order of its creatures and items in your account, for the same purpose.

We do not look at your synced content, except where:

• You ask us to, for example when you contact us for support.
• We need to assess a report of illegal content or a breach of the Terms of Service.
• We need to investigate a security incident or a fault.
• The law requires it, for example a binding order from a court or authority.

We then access only what that purpose needs. Legal bases: our legitimate interest in running a safe and working Service (Art. 6(1)(f) GDPR) and, where the law requires it, compliance with a legal obligation (Art. 6(1)(c) GDPR).

Premium is sold through Stripe's Managed Payments service, with Sold through Link, LLC, a Stripe affiliate, acting as merchant of record. Stripe collects and processes your payment details, billing address, and tax information as merchant of record, under the Stripe Privacy Policy. We never receive or store your card or bank details.

We store what we need to provide Premium to your account: your Stripe customer ID, your plan and billing interval, the status of your subscription, and the dates of your billing periods. Stripe also makes your name, email address, billing address, and country available to us. We use them only to answer billing questions and handle refunds.

Legal basis: this data is processed for the performance of a contract (Art. 6(1)(b) GDPR).

We use Umami Cloud, an analytics service by Umami Software, Inc., to understand how the Service is used, on the basis of our legitimate interest in understanding and improving it (Art. 6(1)(f) GDPR). For each page you visit, Umami receives:

• The page address, and the address of the site that referred you.
• The page title.
• Your browser, operating system, device type, screen size, and language.
• Your approximate location (country, region, and city), derived from your IP address. Umami does not store the IP address itself.

To count visitors without cookies, Umami combines your IP address, your browser's user agent, our site ID, the current month, and a secret key held by Umami, and hashes them into an identifier. The identifier changes every month and is different on every other website. Umami keeps only this identifier, not your IP address. Umami sets no cookies and saves nothing in your browser's storage. We do not combine analytics data with your account data.

We also record when certain features are used, such as exporting a creature or starting checkout, with details like the export format. Those details never contain what you typed. Umami also measures how fast each page loads and responds, so that performance problems can be found and fixed.

Most tracker blockers, such as uBlock Origin and AdGuard, block Umami. The site works the same without it.

We use Sentry, by Functional Software, Inc., to log errors on the live site and on our server, on the basis of our legitimate interest in maintaining a working Service (Art. 6(1)(f) GDPR). When an error occurs, Sentry receives a technical report containing:

• The error itself: what went wrong and where in the code it happened.
• The page you were on when it happened.
• A short trail of what happened just before: the pages you visited and the buttons you clicked.
• Your browser and operating system version.

We configure Sentry not to store IP addresses or console output. Reports are not designed to contain your creatures or other saved content, but an error message can occasionally include a short fragment of the data that caused it. We use reports only to find and fix faults. Our server also logs each request it handles, with only the route, method, status code, and duration. Error logging runs only on the live site, never in development or preview builds.

We share personal data only with the processors needed to operate the Service. Each processes data only to the extent needed for its function, under a data processing agreement:

• DigitalOcean, LLC hosts the Service and its database. Cloudflare, Inc. sits in front of it as DigitalOcean's content delivery network and handles each request at the data centre nearest to you. Like any web host, both process your IP address to deliver pages and to protect the site against attacks.
• Umami Software, Inc. provides analytics (Section 6).
• Functional Software, Inc. provides Sentry (Section 7).

Discord provides sign-in as an independent service under its own privacy policy. We receive the profile data described in Section 3 from Discord, and Discord learns that you signed in to Monsterbrew.

Stripe handles payments for Premium as merchant of record, as described in Section 5, under its own privacy policy.

We do not sell or rent your data. We disclose it to others only as described in this policy, or where the law requires it.

Some of our providers process personal data outside the European Economic Area. Each transfer is covered by a safeguard under Chapter V GDPR:

• DigitalOcean hosts the Service and its database on servers in the United States. Transfers rely on DigitalOcean's certification under the EU-U.S. Data Privacy Framework, with the European Commission's Standard Contractual Clauses in its data processing agreement as a fallback.
• Cloudflare can handle requests in data centres worldwide, under DigitalOcean's agreement with it and Cloudflare's own certification under the EU-U.S. Data Privacy Framework.
• Sentry stores our error reports in its EU region, in Germany. Functional Software, Inc. is a US company and may access them from the United States, on the basis of its certification under the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses in its data processing agreement.
• Umami Software, Inc. is a US company. It stores our analytics data in its EU region, in Germany, and uses US subprocessors. Umami is not certified under the EU-U.S. Data Privacy Framework, so transfers rely on the Standard Contractual Clauses in its data processing agreement.
• Stripe processes payment data, including in the United States, under its own certification under the EU-U.S. Data Privacy Framework.

You can ask us for a copy of these safeguards at the address in Section 1.

We keep personal data only as long as we need it:

• Account data, synced creatures and items and their artwork, synced collections, and subscription records: until you delete them or your account.
• Session records: they stop working seven days after you last used them, and are removed when you sign out or delete your account.
• Error reports and server request logs: up to 90 days.
• Analytics records: six months, the retention period of our Umami plan.
• Emails you send us, such as support requests, reports, and appeals: as long as needed to handle the matter, and at most two years after it is closed, unless we need them for a legal claim.
• Database backups: deleted data may remain in the hosting provider's automatic backups for up to seven days before it is removed entirely.

Stripe keeps its own payment records for as long as its privacy policy and tax law require.

Most of your data is stored in your own browser, where you control it directly. For the personal data we hold on our servers, your account data, subscription records, synced creatures and items with their artwork, and synced collections, you have the rights set out in Arts. 15 to 21 GDPR:

• Access and portability: you can export your creatures and items from the application at any time, in portable formats. For a copy of all the personal data we hold about you, including your account, subscription, and session records, email us at the address in Section 1.
• Rectification: you can edit your creatures and items in the application. To correct your account data, email us.
• Erasure: you can delete your account from the account settings. Deletion first cancels any active Premium subscription, so you are not charged again. It then takes effect immediately and removes your account, sessions, Discord link, subscription records, all synced creatures and items and their artwork, and all synced collections. Your local library remains in your browser.
• Restriction and objection: contact us at the address in Section 1.

We answer requests within one month. If a request is complex, or we receive many, we may extend this by up to two further months; we will tell you so, and why, within the first month. We may ask you to confirm your identity, for example by writing from the email address on your account.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in your EU member state of residence. The authority responsible for us is the Belgian Data Protection Authority.

We do not process personal data beyond what is described in this policy. We do not use your data for advertising or marketing, do not sell or rent it, do not build profiles, and do not subject you to automated decision-making within the meaning of Art. 22 GDPR. We do not use your creatures or other content to train AI models.

We may update this policy from time to time, for instance when the Service changes. If a change materially affects how we process your data, we tell account holders by email before it takes effect. The current version is always available on this page, together with its effective date.