Privacy notice

The controller responsible for processing personal data on this website is Nero, operating as ERGO Center.

Contact: Meros.Basement@gmx.net. This address is the primary contact for data-protection requests. A full postal address can be provided on request.

meros_basement.web presents software projects, Discord bots and development services. Visitors can read the site without an account. Signing in with Discord is only needed for developer features: submitting a bot and managing existAPI applications.

The site is a static Next.js export; privileged work (accounts, submissions, API keys) is handled by a Cloudflare Worker and stored in a Supabase-hosted Postgres database.

We do not store message content, voice data, member lists or email addresses from Discord. We do not use tracking pixels or third-party analytics.

Do not send passwords, API keys, access tokens or other credentials through the commission, support or report forms. They are not needed to answer a request.

• Art. 6(1)(b) GDPR — providing the account and developer features you asked for (submissions, API access).
• Art. 6(1)(f) GDPR — legitimate interest in operating the site securely, moderating a public directory and preventing abuse.
• Art. 6(1)(c) GDPR — where a legal obligation requires storage or disclosure.

There is no processing for advertising or profiling.

No tracking, analytics or marketing cookies are used.

Cookies set by this site after you start a Discord sign-in:

• mb_oauth — short-lived, signed OAuth state and PKCE verifier. Deleted after the callback; 10 minutes at most.
• mb_at — access token for API requests, 1 hour.
• mb_rt — refresh token, 30 days or until sign-out.

All three are HttpOnly, SameSite=Lax and Secure on HTTPS, so page scripts cannot read them. Your chosen theme is stored in localStorage and stays on your device.

Sign-in uses Discord OAuth through Supabase Auth. Only the default identity scope is requested: Discord user id, username, display name and avatar. The site never receives your email, password, guild list, messages or friend list from Discord.

Discord processes the sign-in itself under its own privacy policy. Supabase stores the auth user and session records and issues the tokens described above.

Approved listings show the bot name, description, links and tags publicly, together with the developer's display name and avatar. Moderation notes, review history, applications, key hashes and usage counters are not public and are only readable through the authenticated API or by moderators.

API keys are stored only as a salted hash. The full key is shown once at creation and cannot be recovered from the database.

• Cloudflare — hosting, request handling, rate limiting, technical logs.
• Supabase — Postgres database and authentication.
• Discord — OAuth sign-in and the platform the listed bots run on. The support page may embed a Discord widget, which Discord can process.
• Netlify — a separate protected dev environment. It is not part of the platform described here, but links to it may exist.

Some providers are based in the USA, so processing can take place outside the EU/EEA. Where that happens, it relies on the Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or an adequacy decision such as the EU-US Data Privacy Framework where the provider is certified.

Fonts are embedded at build time; visiting the site does not contact Google or another font provider.

Data is kept only as long as it is needed for the purposes above. Session cookies expire on their own. Withdrawn submissions are deleted immediately; revoked keys stay listed so you can see what was used.

There is no self-service account deletion yet. Send a deletion request to Meros.Basement@gmx.net from the account or with enough information to identify it. Deleting the auth user removes the profile, listings, applications and keys through database cascades; moderation audit entries keep the event but lose the account reference.

There is no automatic retention schedule in the current implementation. That is a stated limitation, not a promise of automated cleanup.

Personal data is not sold or shared for advertising. It is disclosed only to the processors listed above, where you ask for it, where a legal basis exists, or where the law requires it.

Moderation decisions are made by people. Automated systems only enforce technical limits such as rate limits and body-size caps; they do not decide whether your account or listing is approved.

Within the legal requirements you may have the right to:

• access the personal data processed about you,
• rectify inaccurate data,
• erase data or restrict processing,
• object to processing based on legitimate interest,
• data portability, where applicable,
• withdraw consent with effect for the future, and
• lodge a complaint with a competent data-protection supervisory authority.

Requests can be sent to Meros.Basement@gmx.net. You can also correct your display name and avatar by signing in again after changing them on Discord.

This notice is updated when the implementation, the providers or the legal requirements change materially.

Last updated: 25 October 2026