Your data.
Simply explained.

Who can you contact?

Unvalids / Roman in Austria. Send privacy questions and deletion requests to roman.schmitt4826@gmail.com.

Visiting the website

This website is hosted through OpenAI Sites and its hosting infrastructure with Cloudflare. Technical connection data is processed to serve the site. The website itself does not use advertising trackers or analytics services.

Wishes and feedback

We store wish titles, descriptions, optional nicknames, category, date and progress to review requests and improve the app. Approved wishes can be public. New wishes are also forwarded to the configured Discord channel using a webhook when connected. A private status link lets the submitter read a reply from Unvalids without publishing the wish.

Star reviews include a rating, text, optional nickname and date. They are displayed publicly with the submitter’s consent. Please do not include tokens, passwords or sensitive personal information. Visitor posts remain in their original language.

The forms use one-time tokens and a daily hash of the visitor IP for submission limits. The raw IP is not stored in the form table. Tokens are removed after 24 hours. Contributions remain stored until removed or a deletion request is received. Include the title or date of your contribution when contacting us.

You can request access, correction or deletion and contact the relevant data protection authority. Your private status-link key is stored only as a hash on the server.

Administration and Discord integration

Only the creator signs in through ChatGPT to manage the website. The confirmed account identity is checked against a server-side owner setting. A Discord webhook URL is encrypted before storage and never returned to visitors. It is used only to forward wishes to the configured channel. Visitors do not need an account to submit wishes or reviews.

Downloads and Discord

The public download counter records started downloads since publication of this website. Repeated downloads may count again; a start does not confirm completion. Resumed range downloads and technical HEAD requests do not increase the count. No profiles, IP addresses or cookies are stored for this counter.

The website does not ask for your Discord password or bot token. The app handles its own Discord sign-in. Optional AI runs on your computer.

App sessions online

From app version 0.8.1, a signed-in app with participation enabled sends a random session identifier and its version roughly once per minute. No Discord IDs, names, emails, tokens or project content are transmitted. Only a hash of the session identifier is stored; a fresh identifier is created when starting or rejoining. Disable participation any time in app settings.

A session stops counting after three minutes without a heartbeat. Sign-out, opt-out or closing the app removes it; expired records are cleaned on the next heartbeat. A daily IP hash limits automated submissions and is removed with the short-lived session record. This counts participating sessions, not distinct people.

Email contact

Your email address and message are used to answer your request. Use the wish form for public feature requests.

Google administrator sign-in and click sounds

The approved administrator can also sign in with Google. Google verifies the account identity; the server checks the verified email before granting access. An encrypted-transport, HTTP-only session cookie lasts up to eight hours and is removed on sign-out. The Google sign-in library connects to Google only on the administrator sign-in page. Click sounds are generated on your device; your on/off preference is stored locally in your browser and can be changed in the footer.