Privacy Policy — MarginForge
MarginForge is an unofficial fan tool for Hypixel SkyBlock. It is not affiliated with, endorsed by, or connected to Hypixel, Mojang or Microsoft.
The short version
If you never sign in, MarginForge stores nothing about you beyond a short-lived record of your IP address used to stop one visitor exhausting the service for everyone. If you do sign in, it stores what Discord tells it about you, plus — if you buy something — an identifier issued by PayPal. It does not track you, does not run advertising, and sells nothing to anyone.
What is collected, and why
If you do not sign in
| Data | Why | How long |
|---|---|---|
| Your IP address | Rate limiting. Without it a single visitor can spend the request budget the whole site shares. | Held in memory only, for a rolling 60 seconds. Never written to disk. |
No cookie is set, no account exists, and no analytics or advertising scripts run on any page.
If you sign in with Discord
Signing in requests two Discord permissions, identify and email. From
those, the following is stored:
| Data | Why |
|---|---|
| Discord user id | Identifies your account across visits. This is the account. |
| Email address | Prefilled at checkout so your receipt reaches you. Only stored if Discord reports it as verified. |
| Display name and avatar URL | Shown to you in the corner of the page, so you can see you are signed in. |
| Account created / last seen timestamps | Operational. |
MarginForge never receives your Discord password, and does not request access to your servers, connections, messages or friends.
A session cookie (mf_session) is set. It contains a random token and
nothing else — no personal data is encoded in it. Only a hash of that
token is stored, so the database cannot be used to impersonate you. It
lasts 30 days from last use and is marked HttpOnly and SameSite=Lax.
If you buy something
Payment is processed by PayPal, whose name appears on your receipt and card statement. Card details are entered on PayPal's own pages and never reach MarginForge. This application never sees, handles or stores a card number.
Clicking to buy sends you to PayPal and back again. No script belonging to PayPal, or to anyone else, runs on this site — nothing about your visit is shared with them until you choose to buy.
| Data | Why |
|---|---|
| Your PayPal payer id, and the subscription id if you have one | Links your purchase to your account so access persists. |
| Subscription status and paid-through date | Determines whether you currently have access. |
| Whether you hold a lifetime purchase | Same. |
Your name, billing address and payment details are held by PayPal under its privacy statement, not here.
Who else receives your data
- Discord — when you sign in. You are subject to their privacy policy during that exchange.
- PayPal — when you buy something, and only then.
- GoDaddy — as the operator of the server this runs on, located in the United States.
That is the complete list. Your data is not sold, rented, or shared with advertisers or data brokers, and there is no analytics or tracking service of any kind on this site.
What you can do
Signed in, under Account on the dashboard:
- Download my data — returns everything stored about you as JSON.
- Delete my account — erases your account and all sessions immediately and permanently.
Deleting your account does not delete PayPal's payment records; tax and accounting law requires those to be retained. Once your account is gone, nothing on this side links that payer to you.
Deleting your account ends any access you have paid for, and no refund is issued automatically. If you have paid and want a refund, contact contact@marginforge.org before deleting.
Retention
| Data | Kept |
|---|---|
| Rate-limiting IP records | 60 seconds, in memory |
| Account records | Until you delete your account |
| Sessions | 30 days from last use; expired sessions are purged automatically |
| Backup copies | 7 days, then deleted. The two databases are copied nightly so the host's disk snapshots contain a consistent file; a deleted account disappears from those copies within a week. |
| Server logs | Errors only, which include the client's IP address. No log of ordinary requests is kept. Held in a rotating buffer of 30 MB per service, a few days at current traffic, then overwritten. |
Legal bases (UK/EU visitors)
- Rate limiting: legitimate interest in keeping the service available.
- Account data: necessary to perform the contract of providing you an account.
- Payment data: necessary to perform the contract, and to meet legal obligations for financial records.
You have the right to access, correct, erase, and export your data, and to complain to your data protection authority. Access, erasure and export are self-service in the app; for anything else contact contact@marginforge.org.
Peruvian visitors have the equivalent rights under Ley N.º 29733 and may complain to the Autoridad Nacional de Protección de Datos Personales.
Children
MarginForge is not directed at children under 13, and accounts are not knowingly provided to them. Sign-in is through Discord, whose own terms already require account holders to be at least 13. If you are under 18, use MarginForge only with a parent or guardian's permission, and do not buy anything without it.
If you believe a child under 13 has an account here, write to contact@marginforge.org and it will be deleted.
Changes
Material changes will be noted here with a new "last updated" date.
Back to the dashboard. Also: Terms of Service.