This page explains privacy implications of visiting and using LBP Union’s websites, applications, and services. As with every privacy policy, it’s wise to scrutinize it and decide what’s best for you based on your unique needs and threat model. Therefore, this page will also offer advice on how to protect your privacy from LBP Union.
Our Domain
The only domain operated by LBP Union is lbpunion.com. Every time you visit a subdomain, like
- www.lbpunion.com
- beacon.lbpunion.com
- wiki.lbpunion.com
Items of this privacy policy may apply to you. Beware of phishing and deception attempts by attackers. For example, an attacker might utilize a domain named ‘ibpunion.com’ with a capital i, presenting the appearance of our domain. This may put you at risk of accidentally exposing your credentials to the attacker.
DNS
Our Dynamic name service (DNS) provider is Cloudflare.
Our Discord Server
Our Discord server is an external service which we moderate and administrate, but which is hosted by Discord. Consequently, this comes with a separate set of privacy implications beyond LBP Union. For example, depending on your jurisdiction, Discord may require you to provide photo ID or upload a photo or recording of your face.
Data Collection Policy
LBP Union aims to collect as little data as needed to operate our applications and services.
- Username: to identify your account
- A password: to secure your account, which is salted and hashed across all services to protect it from abuse
- Email address: for external verification of your account and to send transactional messages (like password resets, verification emails)
- IP address: we need this to serve web applications to you from our web server (see below)
What’s a Web Server?
A web server is software that makes it possible to provide you with online applications and websites, including the page you’re reading right now. The web server has to be able to see your IP address, all the text on this page, and everything that you share with us (like filling out a form).
The web server produces a log of this information, where each request is associated with an IP address. Determined analysis could figure out what you were up to, like what pages you visited, if one could figure out what IP address is associated with each user.
Web servers are fundamental to how services on the Internet are provided everywhere. We primarily only look at our web server log when needed to examine security related issues, like a malicious user abusing our services. Only certain administrators have access to this log.
Discord and Passport Integration
If you choose to use the Discord sign-in option with Passport, you must grant our application the following permissions, called ‘scopes‘:
- identify: see your Discord username
- guilds.members.read: allows the application to see what Discord servers you are a member of. This is explicitly to determine if you are a member of LBP Union’s Discord, which enables Passport to sync your roles to other applications.
The most potentially concerning permission on this list is guilds.members.read. We do not make a record of the servers you are a part of. Please check the OAuth authorization requirements shown by Discord before adding the application to your account. Learn more about Discord OAuth scopes.
Discontinued Data Collection
At one point, we used Google Analytics to track user behavior across our services. This tracking anonymized data regarding how users interacted with our applications and displayed the aggregate data in a dashboard. For example, it showed us the number of unique viewers on a given page. However, we are moving away from Google Analytics out of concern for the privacy of our users.
Data Collection Considerations
Consider these tips to better protect your privacy before using our services:
- Avoid choosing a username with identifiable information. Example: your real name
- Choose a unique, strong password that you don’t use on other websites.
- Consider using an email address with no identifiable information in its name. Even if the applications you use may not expose your email address to the public, LBP Union can still see it.
- If you have special operational security needs (wanted by the government, in a jurisdiction that may block our service, or otherwise really, really don’t want us to know your IP address), consider using a VPN or proxy to access our service. We cannot guarantee the quality of our service over a VPN or proxy connection.
Data Retention Policy
We have no defined data retention policy.
Deleting Your Data
You may delete or request data be deleted that we may hold. Most user generated content can be removed by you. However, some data, like your actual accounts, will require our intervention. We’re happy to assist you as best we can with these requests.
Deleting Beacon Data
On Beacon, you may delete content that you’ve uploaded, such as photos, levels, comments, and reviews. The following data is fully deleted from the server after you press delete:
- Levels
- Photos
- Your avatar
When comments and reviews are deleted, they are hidden from the public but preserved in Beacon’s MySQL database. This is a limitation in the Project Lighthouse software. If you have a special concern and need us to fully delete all your comments and reviews, please contact us using the Deleting an Account instructions below.
Note that some changes, like changing your profile description, may be preserved in the web server logs. This information isn’t stored in a very nice and tidy format, but it theoretically could be recovered by determined analysis.
Deleting Other Data
There are other kinds of data you can delete from our services. Here is a summary of those options:
LBPUnion.com
If you’ve posted a comment on our site, you can navigate to that comment while logged in and click a button to delete it. You can also remove certain details from your profile while logged into the WordPress dashboard.
Forum
You may delete any forum posts you’ve posted at your discretion, as well as remove certain details from your profile.
Wiki
Your profile and talk page can be freely edited by you to remove information. If your account is to be deleted, we will need to determine how to handle edits and contributions your account has made to the site.
Support
Please see the ‘Deleting your LBP Union Passport and Other Accounts’ section below.
Passport
You can remove connected authentication services, like Discord, from your account at any time from your Passport settings.
Deleting an Account
To request that your account be deleted, follow these steps:
- Contact us. Options:
- Use our contact form.
- Open a ticket in our Discord server.
- Email us at support@lbpunion.com (currently experimental!)
- Tell us which accounts you want deleted (Passport or Beacon).
- You may be asked to verify that you own the account. If contacting us via email, please use the email address attached to the account you want deleted.
- If significant data is on the account, we will place a hold on the request for seven days to allow you an opportunity to download data, such as published levels.
There are two types of deletion requests:
- Beacon: only deletes your Beacon account.
- Passport: removes your account from LBP Union Passport and all applications you used to sign in with Passport.
We will do our best to assist you in deleting as much data as possible from each platform you’ve signed into.
Retrieving Your Data
Other major platforms support providing users with a convenient package of their personal data. This is awesome, and we wish we could do it for you, but it just isn’t possible for us currently. We can, however, direct you toward where you can retrieve that information yourself where it’s available.