Privacy Policy

Last updated: July 12, 2026

This policy describes how SubZero Studios LLC (“we,” “us,” or “our”) handles information when you use subzerostudios.dev and related services we operate (the “Site”). It is provided for transparency and is not legal advice. If you need certainty for your situation, consult a qualified attorney.

1. Who we are

The Site is operated by SubZero Studios LLC. For privacy-related requests, reach us at subzero@subzerostudios.dev or through the same channels we publish on the Site (for example, our public Discord invite in the footer).

2. Information we collect

Depending on how you use the Site, we may process:

  • Steam sign-in and account. Steam is how you create and sign into a Site account. We receive identifiers and profile details from that process (such as your Steam ID, display name, and avatar URL) and store them with your account. We also store internal account fields needed to run the Site (for example, a placeholder email format used by our application framework, login and last-seen timestamps, community role choices, staff or contributor flags where applicable, and ban or messaging-restriction markers if applied).
  • Linked accounts (Discord, GitHub, Twitch). If you connect these providers from your profile settings, we store the identifiers and profile fields they return (such as user ID, username or login, display name where provided, and avatar URL), plus when you connected. Twitch linking may also involve periodic checks of live status, viewer count, and stream category so we can show live indicators where the Site already does. You can disconnect these links from the Site when that control is available.
  • Steam and s&box activity we sync. To power community profiles, leaderboards, org pages, and related features, our servers may request public data from Valve’s Steam Web API (including s&box playtime for the relevant Steam app) and from Facepunch / sbox.game package and profile surfaces (for example, org membership pills and published package metrics such as votes or player counts). We store cached copies of those fields on your account or creator profile. Those requests are subject to the third party’s terms and policies.
  • Sessions, cookies, and security. We use cookies and similar technologies to keep you signed in, protect against abuse (including CSRF protection), maintain basic session state, and reduce duplicate page-view counts on certain public pages. These are operational cookies for running the Site. We do not use third-party advertising trackers on the Site. Standard server and application logs may include information such as IP address, user agent, timestamps, and requested URLs.
  • Usage logging. For many HTML pages, we record the URL path visited, the time of the request, and, if you are signed in, an internal user reference. We do not use this for JSON/API responses, and we exclude certain staff and internal routes from this logging. Aggregated path counts may appear as page-view stats on public creator or org pages when that display is enabled.
  • Community and creator profiles. When you use community features, we store what you submit or publish: display name and bio/tagline, skills and interests, “looking for” flags, links, visibility settings, organization details you provide or that we discover from public s&box sources, and similar records tied to your account. Public profiles and directory listings show the information you choose to make public.
  • Messaging and reviews. Direct messages and related conversation metadata are stored so you can message other members. Staff announcements and in-app notifications (and related metadata) may also be stored. Creator reviews or feedback you submit (rating, message, anonymous flag where offered, and moderation status) are stored and may be shown publicly when approved.
  • Team applications. If you apply via /team/apply, we store your role choice, written answers, pitch, portfolio links and uploaded images, Discord identifiers associated with the application, cached s&box playtime used in review, and application status. Staff may also see applications in Discord channels we operate for recruiting.
  • Discord server metrics. Our Discord bots and webhooks may send us aggregated activity for Discord user IDs (daily message counts and voice minutes, not message content) for leaderboards and community features, and join/leave events (Discord user ID, timestamp, and invite code when available) for server stats. If we previously operated an experimental on-Site Discord channel mirror, we may still retain message text and display names from that feature.
  • Staff Cloud Library. Staff and authorized contributors may upload asset files, thumbnails, and metadata to our Cloud Library. Access tokens and download activity related to that tool are stored so we can run and secure it. Library content is not a public member profile feature.

3. How we use information

We use the information above to:

  • Provide, operate, and improve the Site and its features (community directory, profiles, messaging, spotlight, leaderboards, team tools, and related pages);
  • Authenticate users, maintain sessions, and enforce bans or messaging restrictions when needed;
  • Display public community and creator content you choose to publish, including live Twitch indicators when applicable;
  • Review team applications and operate staff workflows (including Discord notifications our bots post for recruiting and operations);
  • Communicate operational messages and on-Site notifications where applicable;
  • Protect the security and integrity of the Site, investigate abuse, and comply with law when required.

4. Legal bases (EEA, UK, and similar regions)

Where GDPR or similar laws apply, we rely on appropriate bases such as: performance of a contract (providing the services you request, including a signed-in account and features you use); legitimate interests (security, fraud prevention, improving the Site, operating community discovery and leaderboards, and understanding aggregate usage), balanced against your rights; and consent where we specifically ask for it (for example, optional account linking).

5. Sharing of information

We do not sell your personal information. We do not share personal information for cross-context behavioral advertising. We may share information with:

  • Service providers that help us host, operate, or secure the Site (for example, our VPS host and infrastructure vendors), subject to confidentiality and processing terms appropriate to the service.
  • Valve / Steam when you use Steam sign-in or when our servers call Steam’s APIs, as governed by Valve’s policies.
  • Discord, GitHub, and Twitch when you choose to connect those accounts or when our bots and webhooks exchange data with Discord for features described above, as governed by those companies’ policies.
  • Facepunch / sbox.game when our servers request public package or profile-related data used on the Site.
  • Other Site users and visitors when you publish a public profile, review, org affiliation, or other public content, or when you send someone a direct message (visible to participants in that conversation, and to staff when needed for abuse or safety review).
  • Law enforcement or others if we believe disclosure is required to comply with law or to protect rights, safety, or security.

6. Retention

We keep information for as long as needed to provide the Site, meet legal obligations, resolve disputes, and enforce our agreements. You can edit or remove much of your public profile content through the Site. You can disconnect linked Discord, GitHub, or Twitch accounts from profile settings when that control is offered. Pending team applications may be withdrawn from the apply page. For account deletion or other deletion requests that the Site does not fully automate, email us at subzero@subzerostudios.dev or use the channels described under Who we are; we may need to verify your request. Some logs, backups, or legally required records may persist for a limited time after deletion.

7. Your choices and rights

Depending on where you live (including the EEA, UK, and certain U.S. states such as California), you may have rights to access, correct, delete, or export personal information, or to object to or restrict certain processing, and to appeal a denial where the law requires it. To exercise these rights, email us at subzero@subzerostudios.dev or reach us through the channels described under Who we are. We may need to verify your identity before fulfilling certain requests. You may also have the right to lodge a complaint with a supervisory authority.

Browser controls can block or delete cookies; blocking essential cookies may prevent sign-in or other Site features from working.

8. International transfers

We may process and store information in the United States or other countries where we or our providers operate. If we transfer personal information from regions that require safeguards, we use appropriate mechanisms as required by applicable law.

9. Children

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you live in a region that sets a higher digital-consent age (often 16 in parts of the EEA/UK), you may use the Site only if you meet that age or have verifiable parental authority as required by local law. If you believe we have collected information from a child in violation of this policy, email us at subzero@subzerostudios.dev or contact us through the channels under Who we are, and we will take appropriate steps to delete it.

10. Third-party sites and embeds

The Site may link to or embed third-party websites or services (for example, Discord, YouTube, Twitch, Steam, sbox.game, or partners). Their privacy practices are governed by their own policies. Embedded content may set or read cookies according to the third party’s rules.

11. Security

We use reasonable technical and organizational measures appropriate to the nature of the Site (including HTTPS in production, access controls for staff tools, and session protections). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes

We may update this policy from time to time. We will post the revised version on this page and update the “Last updated” date. Continued use of the Site after changes means you accept the updated policy, to the extent permitted by law. For material changes, we may also provide additional notice through the Site when practical.