Privacy Policy

1. Introduction

This Privacy Policy explains what data the staff portal at staff.itsmias.com ("the Portal") and its Discord bot, Watchful Eye ("the Bot"), collect, why it is collected, how it is stored, and your rights regarding that data.

The Portal is operated by ItsMias for the staff of the HorizonMines and Beyond The Horizon Discord servers. If you are on a staff team in one of these servers, your data is processed as described below.

2. Data We Collect

For everyone on a staff team, the Bot records the following, even before you log in:

• Discord User ID
• Username and display name
• Avatar
• Server nickname
• Staff teams you are on in each server

If you have linked a Minecraft account through the Sentinel bot in the Beyond The Horizon Discord server, the Portal also shows that account's Minecraft username and UUID. This is read from Sentinel's own database each time a page loads; the Portal does not store a copy.

You log in through login.itsmias.com, which is also run by ItsMias. Discord only shares your user ID, username, display name and avatar, and the login service passes those to us. We also record when you last logged in.

If you choose to fill them in, we store:

• Email address
• YouTube channel link (Beyond The Horizon only)
• Twitch channel link (Beyond The Horizon only)
• GitHub profile link (Development Team only)
• Timezone
• Leave of absence: whether you are on leave and, if you give one, when you expect to be back

When you enter an email address, we check that its domain exists and can receive mail by looking up the domain's DNS records. Your email address itself is not sent anywhere.

When you enter a GitHub profile, we look up the username on GitHub to check the account exists.

Our web server keeps standard access logs (IP address, page visited, time and browser) for 14 days.

3. What We Do Not Collect

• Message content
• Presence or activity
• Data about members who aren't staff. The Bot reads the member list to find staff, but everyone else is discarded straight away and never stored.

4. Why We Collect This Data

• Discord account and team data, to show the staff directory and decide who can log in.
• Email address, to share Google Drive documents with you.
• YouTube and Twitch links, to make you a moderator in chat.
• GitHub profile link, to give you access to our GitHub repositories.
• Timezone, to plan around when staff are available.
• Leave of absence, to give you the role on Discord and show admins who is away.
• Linked Minecraft account, to know who you are in-game, for example for whitelists, events and moderation.
• Access logs, to keep the Portal secure and fix problems.

5. How Long We Keep Your Data

Your data is kept while you are on a staff team. When you are no longer on any staff team, or you leave the servers, you are removed from the staff directory straight away and your data is permanently deleted after 30 days. If you are added back to a team within that time, your details are kept.

Login cookies expire after 7 days. Logging out on any of our sites logs you out of all of them. A second cookie, horizon_sso, is shared across itsmias.com so the sites can tell you are still logged in. It holds a random value and nothing about you. Access logs are deleted after 14 days.

6. Who Has Access to Your Data

• ItsMias and Portal admins can see the staff directory, including the details listed in section 2. They see it on admin.itsmias.com, which reads it from the Portal when a page loads and does not keep a copy.
• Other staff can only see their own details, not yours.
• Third parties: your data is never sold or shared with any third party.

7. Third-Party Services

The Portal uses the following external services:

• Discord, for logging in, checking staff teams and giving the leave of absence role. Discord's own Privacy Policy applies to your use of Discord. Avatars and server icons are loaded from Discord's servers.
• GitHub, to check that a GitHub username you enter exists. Only the username is sent. See GitHub's Privacy Statement.
• mc-heads.net (with Crafatar as a backup), for pictures of linked Minecraft accounts' heads. Our server requests them using the account's Minecraft UUID and keeps a copy for a day; your browser never contacts these services, and no Discord data is sent to them.
• Google Fonts, which serves the fonts used on the Portal. Your browser downloads it from Google, which receives your IP address. See Google's Privacy Policy.

8. Your Rights (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, you have rights under the General Data Protection Regulation (GDPR), including the right to see, correct and delete your data. You can change or clear your email, links, timezone and leave of absence on the Portal at any time. To exercise any other right, contact us using the details in section 11.

9. Data Security

Your data is stored in a SQLite database on our own server, and the Portal is only served over HTTPS. Only the people in section 6 can view it, after logging in with Discord.

10. Limitation of Liability

While we take reasonable steps to protect your data, we cannot guarantee absolute security. In the event of a data breach or unauthorised access, we accept no liability for any resulting damages, losses, or harm. By using the Portal, you acknowledge and accept this risk.

11. Contact

If you have questions about this policy, wish to exercise your data rights, or want your data deleted, please contact us:

• Discord: open a ticket in the support channel, or message @itsmias.
• Email: me@itsmias.com

12. Changes to This Policy

We may update this policy at any time. The date below shows when it last changed. Continued use of the Portal after changes are made means you accept the updated policy.

Last updated 6 November 2026