Last updated: 11 November 2026
VStanced is a non-commercial hobby community for car tuning and racing games. This page explains, in plain language, what we do with your personal data.
Who is responsible
VStanced (vstanced.com) is run from the United Kingdom by an individual, who is the data controller for this website.
Contact for anything in this policy, including reporting content: contact@vstanced.com
What we collect
Your account. Username, email address, password (stored only as a one-way hash), registration date, and anything optional you add: avatar, bio, location, website. If you turn on two-factor login we also store the shared secret that generates your codes.
What you post. Discussions, replies, private messages, chat messages, uploaded files, poll votes, likes, bookmarks and reports. Private messages and chats are visible to the people in the conversation and are stored on our server; they are not end-to-end encrypted.
Technical data. IP address, browser and operating system, the page requested and the time. Our web server keeps these in access logs for 14 days, to keep the site up, stop abuse and diagnose errors.
Anti-spam checks. When you register, your username, email address and IP address are sent as a spam check to the StopForumSpam database, a public list of known spammers. Registrations blocked by our spam filters keep the IP address for a limited time, so repeat offenders stay out.
Analytics. We count page views ourselves, on the server. There is no tracking JavaScript and no analytics cookie. Visitors are counted with a salted hash of IP address and browser that is regenerated every day, so nobody can be followed across days. Raw events are deleted after 72 hours and only anonymous daily totals remain.
Email. Our email provider (Brevo) handles delivery and records whether a message was delivered, bounced or marked as spam.
Cookies and local storage
There is no advertising, no tracking and no social login, so this site does not need a cookie banner: nothing here is optional tracking. All of it is required for the site to work or to keep it secure.
- flarum_session — keeps you signed in and protects forms against cross-site request forgery. Expires after 2 hours of inactivity or when you sign out.
- flarum_remember — only if you tick "remember me", so you stay signed in. Lasts up to 5 years, until you sign out.
- __cf_bm — set by Cloudflare, our CDN, to tell humans from bots. Lasts up to 30 minutes.
- Local storage — your browser may keep interface preferences, such as a draft post or a collapsed menu, on your device. That data never leaves your browser.
Storing information on your device that is strictly necessary for a service you asked for does not require consent (Section 25(2) TDDDG, and Article 6(1)(b) GDPR for the login itself).
Embedded videos
Some older posts embed YouTube videos. We show a placeholder, and nothing is loaded from Google until you press play. If you never press play, Google receives nothing.
When you press play, the video is loaded from youtube-nocookie.com. At that point Google Ireland Limited receives your IP address and may set cookies, under Google's own privacy policy. We have no control over that processing, and you can avoid it by not pressing play.
Links to other websites are just links. Those sites have their own privacy policies.
Who else processes your data
- OVHcloud — hosting and backups, servers in Germany.
- Cloudflare — CDN, TLS, and DDoS/bot protection, global network (US company).
- Brevo — sending email, France.
- StopForumSpam — spam check at registration, US.
- Google / YouTube — only if you play an embedded video, Ireland/US.
We do not sell your data, we do not run advertising, and we do not use Google Analytics, social pixels or similar trackers.
Transfers outside the EU and UK
Your data is mostly processed in the EU and the UK. Cloudflare and StopForumSpam are based in the United States; those transfers rely on the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses. Google is only involved if you choose to play a video.
How long we keep it
- Account and content — while your account exists. If you delete your account your profile is anonymised and your posts stay in the discussions, no longer linked to a person, unless you ask us to remove them.
- Access logs — 14 days.
- Analytics — 72 hours raw, then anonymous daily totals.
- Backups — 14 days for daily database dumps, 56 days for weekly full backups.
- Spam and moderation records — as long as needed to keep the community safe.
- Email delivery records — as kept by Brevo.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. You can also withdraw any consent you gave.
The fastest way is Settings → Personal data: Export data gives you a copy of everything we hold, and Erase account anonymises your profile. Otherwise write to contact@vstanced.com and we will answer within one month.
If you think we have handled your data badly, you can complain to the UK Information Commissioner's Office (ico.org.uk). In Germany you can complain to the data protection authority of your Bundesland.
Security
The site is served over HTTPS, passwords are hashed, two-factor login is available, only a few trusted people have administrative access, and we take daily backups. No system is perfect, but if a breach puts your rights at risk we will tell you and the regulator as required by law.
Children
You must be at least 16 to use VStanced. If we find an account belonging to someone younger, we will close it.
Changes
If this policy changes we will update this page and the date above, and announce anything significant on the forum.
Contact
contact@vstanced.com