Privacy notice

This notice explains what personal data Zdex processes and why. The controller is TheHolyOneZ, reachable at the contact form on zsync.eu. Zdex is designed to store as little about you as it can.

Browsing without an account

The web server writes standard access logs (IP address, time, requested URL, browser user agent). They are used to keep the site running and to defend it against abuse, and they are deleted after 14 days. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). No analytics or advertising scripts are loaded, and the site makes no requests to third parties except for Discord avatars when you signed in with Discord.

Cookies

Zdex sets one session cookie (zdex_sid) that is needed for signing in and for protecting forms. If you choose "keep me signed in", a second cookie (zdex_rm) stores a random token for 30 days. There are no tracking cookies.

Accounts

• Email and password. Your email address, a hash of your password (Argon2id, never the password itself), your display name, registration date, last sign-in and the IP address used for it.
• Discord. If you sign in with Discord, Zdex receives your Discord ID, username, avatar hash and, if you allowed it, your verified email. The OAuth token is used once and discarded.
• Emails sent to you. Only transactional: verification, password reset, and account security notices. No newsletters.

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR). Account data is kept until you delete the account, which you can do at any time from the account page. Security-relevant events (sign-ins, password changes, uploads, moderation actions) are kept in an audit log for 12 months.

Uploads

An uploaded dump is linked to your account and shown with your display name. The dump itself contains engine metadata, not personal data; it does include the executable name and memory base address of the process it was taken from. For every upload I keep the account, the time and the IP address it came from, so that content can be attributed to the person who published it — that is what makes the notice-and-action process in the terms work. When you delete your account, published dumps stay online without your name unless you ask for their removal.

Your acceptance of the terms (version and time) is recorded with your account.

Takedown requests

If you send a takedown notice, I store your name, email address, organisation, the message and the IP address it came from, for as long as the matter and any follow-up last, plus three years for documentation. The substance of the notice — not your email address — is passed to the uploader so they can respond. Legal basis: legitimate interest in running a lawful hosting service (Art. 6(1)(f) GDPR) and legal obligations (Art. 6(1)(c)).

Disclosure to third parties

I do not sell or share account data. Upload records (account, time, IP address) are disclosed only when a law, a court or a competent authority obliges me to, and I inform the affected user where I am permitted to.

Rate limiting and security

To stop brute-force and spam, the number of sign-in attempts, registrations and uploads per IP address is counted in short time windows. These counters contain a hash of the IP and are discarded within 24 hours.

Hosting

The site runs on servers of IONOS SE, Montabaur, Germany, in the EU. Transactional emails are sent from [email protected] through STRATO AG, Berlin. That mailbox is not read; use the contact form for questions.

Your rights

You can ask for access to, correction or deletion of your data, or object to processing based on legitimate interest, by writing to the address above. You also have the right to complain to a data protection authority; in Germany that is the authority of your federal state.