THE TPP PROTOCOL

Privacy

Data Handling & Security Directive // Last Updated: March 2026

THE TPP PROTOCOL believes in minimal data extraction. We do not sell your data, we do not track you across the web, and we do not serve third-party advertisements. This document outlines exactly what we collect and why.

1. Information We Collect

To maintain the operational integrity of the leaderboard and prevent spam, we collect the following essential data upon account creation:

  • Username: Displayed publicly on your submissions and comments.
  • Email Address: Used strictly for account verification, password resets, and critical run moderation updates.
  • Password: Cryptographically hashed using bcrypt. We cannot see your password.
  • Platform Data: The URLs, timestamps, and metadata you actively submit to the database.

2. Strict Cookie Policy

Unlike commercial web platforms, we do not employ behavioral tracking or advertising cookies. Our system operates with a dual-cookie architecture strictly limited to functional, necessary operations:

1. token (Session Security)

An HTTP-Only JSON Web Token (JWT) issued upon login, cryptographically signed to authenticate your identity and authorize requests. Because it is marked HTTP-Only, it is inaccessible to client-side scripts, protecting your session against cross-site scripting (XSS).

2. user_meta (Interface State)

A functional, client-readable cookie storing cosmetic UI profile state (username, clearance role, supporter status) to render navigation controls and terminal headers smoothly without exposing the cryptographic session payload.

Because both cookies are strictly functional and necessary for the site to function, and because we deploy zero marketing, tracking, or analytics cookies, our platform is exempt from requiring an intrusive "Cookie Consent" banner under EU ePrivacy Directive (Directive 2002/58/EC) regulations.

3. Third-Party Subprocessors & Embedded Media

We do not share, sell, or rent your personal information. We interface with the following trusted infrastructure partners and external services to deliver platform functionality:

  • Railway: Cloud hosting provider securing our core NestJS backend and PostgreSQL database.
  • Resend: Secure transactional email dispatch for account verification, password resets, and moderation status updates.
  • Buy Me A Coffee: Payment processor handling voluntary financial contributions via secure webhooks (no credit card or billing details are stored on our servers).
  • RAWG API: Game registry provider used to fetch public game titles and box art (no personal user data is ever transmitted).

YouTube Privacy-Enhanced Mode (Evidence Playback)

User-submitted proof videos are embedded using YouTube's Privacy-Enhanced Mode (youtube-nocookie.com). This configuration prevents YouTube from setting tracking cookies on your device unless you actively click to play the embedded evidence video.

4. Your Rights (GDPR & CCPA)

You own your data. You have the absolute right to:

  • Request a full export of your telemetry data.
  • Request the correction of inaccurate data.
  • The Right to Erasure: Request the permanent deletion of your account, submissions, and communications from our database.

To execute any of these rights, initiate a request by contacting the system administrator at support@ttpprotocol.com.

5. Policy Modifications & Future Monetization

As this platform evolves, our data collection practices may change (for example, if we introduce third-party advertisements to support server costs). We reserve the right to update this Privacy Protocol at any time.

If our cookie policy changes to include tracking or marketing cookies, we will immediately implement a GDPR-compliant consent banner. Continued use of the platform after updates indicates your acknowledgment of the new data practices.