Privacy Policy

What this covers

This notice describes what Project Phantasm collects when you use https://projectphantasm.com, including when you sign in with Discord or link a Roblox account. It matches how the website actually works today.

Who we are

Project Phantasm is a fan game on Roblox and a community website. We are not affiliated with Roblox Corporation or The Pokémon Company. For questions, join the Discord community.

If you only browse

You can read the public pages without creating an account. The web server keeps a normal access log of requests (including IP address, time, and URL) so we can run and protect the site.

If you sign in with Discord

Sign-in is optional. Discord will ask you to share your identity (the identify scope only: user ID, username, display name, and avatar). We store:

• your Discord user ID
• username and display name
• avatar hash (so we can show your Discord avatar)
• the first and last time you signed in, and how many times you have signed in

We use Discord’s access token once to read that profile, then revoke it. We do not keep Discord access or refresh tokens.

If you link a Roblox account

After you are signed in with Discord, you can choose to link a Roblox account. Roblox will ask you to share openid and profile. We store:

• your Roblox user ID
• your Roblox username
• the time the accounts were linked

A Roblox account can be linked to only one Discord user at a time. We use Roblox tokens once to read that profile, then revoke them. We do not keep Roblox access or refresh tokens. You can unlink Roblox from the website at any time.

Cookies

After Discord sign-in we set a first-party session cookie on https://projectphantasm.com (HttpOnly, Secure, SameSite=Lax, lasting 7 days) so the site knows who you are. Short-lived cookies (about 10 minutes) are also used while you complete Discord or Roblox’s consent screens, to protect the sign-in flow. We do not use advertising cookies.

Your IP address and prices

The web server’s access log includes request IP addresses. Sign-in callbacks also keep a 60-second in-memory hit count per IP for rate limiting.

If supporter prices are shown, your IP is used only to pick a display currency. We send a coarse network prefix (not your full IP) to a geolocation service (ipwho.is, falling back to country.is). We do not store the IP or the country. Only the currency code is kept in a short-lived memory cache. Converted prices are approximate; they are not used to charge you.

Who can see this data

The stored Discord and Roblox IDs exist so the Project Phantasm Discord bot, running on the same machine, can tell whether you have signed in or linked Roblox. We do not sell this information.

How long we keep it, and how to delete it

You can sign out and unlink Roblox yourself on the website. Account rows stay until you ask us to remove them. To delete the stored Discord and Roblox records, contact us in the Discord community.

Children

Discord and Roblox require users to meet their own age rules (typically 13+). Do not use sign-in or Roblox linking if you are below the age those services allow.

Services we use

Discord (sign-in), Roblox (account linking and public game statistics), ipwho.is and country.is (currency only), frankfurter.app (exchange rates), and GitHub (the game-codes source is fetched on our server, not by your browser).

Changes

If this notice changes, we will update this page. The date at the top is the last revision.