Privacy at disc.id

Information we collect

When a player sets up a URL, we collect their chosen display name, URL, and email address. If they change the URL, we also record the change and any previous URLs they choose to keep active. We record URL review decisions, administrative blocks, and the reason for a required change. Player setup does not ask for a profile photo, phone number, or details about individual discs. If a player tells us their discs are marked, we record the date.

When someone opens an invitation from a player or organization, we count the page view and whether they start setup. If they set up a URL, we record which player or organization invitation led them there so we can measure whether the invitation worked.

When a player returns a disc, we collect the required pickup note, submission time, the URL written on the disc, and a photo taken or chosen from their device. If they cannot add a photo, they can continue with a detailed note.

After a return is sent, the player returning the disc may optionally add an email address and first name for a private receipt and one pickup update. The address remains private contact information. The first name may be shown to the player getting the disc back and used in later messages about that return.

We also record delivery and pickup status, an optional thank-you choice, and basic device and request information, such as a browser user agent, country code, and Cloudflare request ID, to prevent abuse and diagnose failures. We do not store raw IP addresses.

How the information is used

We use this information to maintain player URLs, provide private player dashboards, send one reminder to mark discs, send return notices, show private return receipts, send an optional pickup update, carry a verified email into optional URL setup, retry failed deliveries, answer support requests, and prevent abuse.

Who can see it

A player's public return page shows the display name and URL they choose. It does not show their contact information, including an email address or phone number.

We send the player the pickup note and photo without showing either player's contact information to the other. Returning a disc does not require an account, name, email address, or phone number.

Authorized disc.id administrators can access stored records and review newly activated player URLs. Administrative notification emails may include the player's URL, display name, and email address. Cloudflare stores application data, and Resend delivers email.

Private sign-in, pickup, and receipt links contain random tokens. We store hashed versions of those tokens. A secure session cookie keeps a player signed in to their dashboard.

Storage and retention

Return photos and other information are stored privately. Administrative access requires an authorized account, and photo access is recorded.

To support returns through a poor signal, a return photo and its pickup details may be stored temporarily in the browser on the device that submits them until they can be sent. The service may also cache public pages and site files on that device for offline use.

An unverified email address and optional first name for a return are deleted after 24 hours. Verified contact information is deleted 30 days after pickup, or 90 days after the return if pickup is never confirmed. Stopping updates removes that contact information immediately. The private receipt and return record follow the service's separate return-record lifecycle and are not absorbed into a player account.

We retain player setup and return records so we can operate and support the service. A previous URL stays linked to the player when they keep it active for marked discs. A URL they say was never written on a disc can be released for another player. Players can permanently delete their account, return history, and stored pickup photos from the private dashboard. We may keep limited records when needed for security, fraud prevention, or legal obligations.

Your choices

A player returning a disc can continue without a photo, but must always provide a clear pickup note. After the return is sent, they may opt into or stop private email updates without creating an account. Players can update their name, URL, and notification email, pause or reactivate the public return form, download their data, and delete their account from the private player dashboard. When changing a URL, they choose whether the old one should stay active for marked discs or be released because it was never used. For help with access, correction, or deletion, email selvin@disc.id.