privacy
the diy hrt community gets surveilled enough by hostile governments, payment processors and pharmacy chains. this site is built to add as little to that pile as possible. here's a plain-language overview of what gets stored, why, and how to nuke it.
no google. no meta. no amazon. no analytics platform. no ads. the only third-party we ever talk to is discord, and only because that's how login works.
we keep some basic usage information so we can tell what's working and what's broken — things like which pages are hit and rough device/browser info. it's collected on our own servers, never sold, never shared, and never linked to anything identifying.
we obey do-not-track signals. if your browser sends DNT: 1, the Global Privacy Control header, or you're running an analytics-blocking extension (ublock origin, privacy badger, etc.), we collect nothing for that session. no fingerprinting, no rough-location logging, no analytics cookies.
we sit behind cloudflare as a CDN / reverse proxy. that means every request to diyhrt.coffee passes through their network before reaching us — TLS terminates at their edge, they cache static assets, and they handle a chunk of the bot / DDoS protection layer.
two things cloudflare injects automatically that we cannot strip server-side:
- a small bot-detection script loaded from /cdn-cgi/... on each page. it's first-party from your browser's point of view (same origin as the rest of the site) and used to distinguish humans from automated traffic. cloudflare's own privacy policy covers what they do with it.
- an HTTP-level Network Error Logging header that asks browsers to report FAILED requests (only failures, not successful loads) to cloudflare so they can spot regional outages.
this is the only third-party path our visitors take, and it's a CDN-level relationship — not a tracker we chose to embed. blocker extensions like ublock origin / EasyPrivacy deliberately do NOT block /cdn-cgi/challenge-platform/ (it's how cloudflare distinguishes humans from bots, and blocking it tends to break sites). if you want to block it anyway, you can add a custom rule: ||diyhrt.coffee/cdn-cgi/*. the site still works without it.
when you click "continue with discord" we store:
- your discord user id
- your discord username + global display name
- a reference to your discord avatar (we never copy the image — your browser fetches it from discord directly)
- an account-creation timestamp and a last-seen timestamp
we also keep a short discord OAuth token so the "pick a server / pick a channel" flow can list the servers you're in when you configure alerts. those tokens are encrypted at rest using strong authenticated encryption — the key never lives in the database, so a database copy alone doesn't expose them. tokens are never logged and never sent anywhere except discord's own API.
your session itself is a signed cookie that's only sent over HTTPS, not readable by javascript, and limited to our origin. nothing else is stored client-side.
each alert destination you create stores: the kind (webhook / DM / server channel), the config you provided (a discord webhook URL, or a guild + channel id, or your discord user id for DMs), and any filters you set (item / shop / region / keyword choices, an optional role id to ping).
stock-change events that match your filters get sent to those destinations. we don't log the message contents.
the bot posts restock alerts into the channels you point it at. what it stores about your server is just what it needs to do that: the server id, the channel id you picked, and the filters and optional role to ping.
it does not read, store, or log channel history. it reads a message only when that message is a command addressed to it, and it keeps nothing afterwards. it never collects member lists, profiles, voice data, or attachments.
removing the bot from a server stops everything immediately. deleting the destination in settings removes the stored ids.
your message + the type you chose + (optionally) the contact handle you typed get sent to the maintainer as a discord DM and are not stored long-term. your ip is included in the DM so we can spot abuse; that's the only place your ip is recorded.
no ads. no third-party analytics platforms — no google analytics, no plausible, no fathom, no posthog, no segment, no facebook pixel, no tracking pixels in emails (we don't send emails either). the basic usage info we keep is first-party, lives on our own servers, and respects DNT / GPC / blocker extensions as described above.
third-party domains your browser does touch when you use the site: cdn.discordapp.com (to load your avatar) and discord.com (only on the OAuth login flow), plus the cloudflare CDN paths described in the previous section.
you can delete your account or request a copy of your data at any time — hit the contact form. deletions are hard and immediate: your user record, your discord tokens, every alert destination you set up, and every filter on them — gone. no soft delete, no "deactivated" state, the row stops existing.
a self-serve "delete my account" button on /settings is on the way.
we follow standard practices for web auth and data-at-rest protection: encrypted transport, signed sessions, strict content security policy, and encrypted storage of sensitive tokens. we're intentionally vague about implementation details because publishing them is free intel for attackers.
if you find something security-relevant, please report it via the contact form (pick the "bug report" kind) before posting publicly.
last updated: 2026-08