Who runs ctbpol Tools
ctbpol Tools is run by Violet Crystal, an individual based in Dublin, Ireland, who is responsible for your data (the "data controller" under the GDPR). For anything about this policy or your data, email icryst4lctb@gmail.com.
What's collected and why
- Your osu! account, when you sign in
- osu! shares your user ID, username and avatar. They're used to sign you in, show your account in the menu and check whether your account has access. ctbpol Tools only asks osu! for this basic public profile, never for permission to act on your behalf.
- The list of approved accounts
- Only the osu! user IDs of accounts that have access, used to decide who can use the tools, plus the date each account was added. It's stored in a database in London.
- Score links you enter
- The score ID is sent to osu! to fetch that score and build the title. ctbpol Tools doesn't save it, though the request can briefly appear in the hosting logs below.
- Visit statistics
- Vercel Web Analytics counts page views anonymously: the page, where you came from, your approximate location (country, region and city), browser, operating system and device type. It uses no cookies, and the temporary visitor identifier is discarded after 24 hours.
- Hosting and security logs
- Like any web host, Vercel records technical details of requests, such as your IP address, browser and the page requested, to deliver the site and protect it from abuse. Signing in includes an automatic check that you're using a real browser.
The legal basis for all of this is legitimate interests (GDPR Article 6(1)(f)): running the tools for approved accounts, understanding how the site is used and keeping it secure. You don't have to sign in, but without signing in you can't use the tools.
ctbpol Tools never sees your email address or your osu! password, which you only ever enter on osu!'s own site. There are no ads, no tracking across other sites, and your data is never sold or shared for marketing.
Cookies
ctbpol Tools only uses cookies needed for signing in. Under Ireland's ePrivacy Regulations 2011, strictly necessary cookies don't require consent, so there's no cookie banner. There are no analytics or advertising cookies.
| Cookie | Purpose | Lasts |
|---|---|---|
next-auth.session-token | Keeps you signed in | Up to 30 days after your last visit, or until you sign out |
next-auth.csrf-token | Protects signing in and out from forged requests | Until you close your browser |
next-auth.callback-url | Returns you to the page you signed in from | Until you close your browser |
next-auth.state | Checks that the osu! sign-in you return from is the one you started | 15 minutes |
| Vercel security check | Remembers that your browser passed the check when signing in | 1 hour |
On the live site, cookie names may start with __Secure- or __Host-, which make browsers handle them more securely.
Who else handles your data
- Vercel Inc. runs the site's servers in Dublin, Ireland, delivers pages through its worldwide network, and provides the visit statistics and security checks. Vercel is a US company, so some data may be processed outside the EU, including in the United States, protected by its EU-US Data Privacy Framework certification and standard contractual clauses. Vercel's privacy policy
- Neon (part of Databricks) hosts the database of approved accounts in London, United Kingdom. The EU recognises the UK as protecting personal data to EU standards. Databricks' privacy notice
- ppy Pty Ltd runs osu!, which handles signing in and provides score data. Your osu! account itself is covered by osu!'s privacy policy.
How long data is kept
- Sign-in cookies: as listed in the cookie table above.
- Approved accounts: until access is removed.
- Score links: not saved by ctbpol Tools.
- Visit statistics and hosting logs: for the periods set by Vercel, as described in its privacy policy.
Your rights
Under the GDPR you can ask to see the data held about you, correct it, delete it, restrict or object to how it's used, or get a copy of it. Removing your account from the approved list deletes everything ctbpol Tools stores about you. Email icryst4lctb@gmail.com and you'll get a reply within one month. You may be asked to confirm the request from your osu! account, to make sure it's really you.
If you're unhappy with how your data is handled, you can complain to Ireland's Data Protection Commission.
Using ctbpol Tools
ctbpol Tools is free and provided as is, with no guarantee that it will always be available or error-free. Only approved osu! accounts can use the tools, and access can be removed at any time. Unauthorized copying, redistribution, or use by any third party is strictly prohibited.
ctbpol Tools is not affiliated with or endorsed by ppy Pty Ltd. osu! is a trademark of ppy Pty Ltd.
Changes to this policy
If this policy changes, the updated version will be posted on this page with a new "last updated" date.