Privacy Policy

Last updated: 28 August 2026

1. Who we are

GoyHub is operated by goyhub ("we", "us", "our"), registered in the Autonomous Island of Anjouan, Union of the Comoros under registration number 69676420, with its registered office at 1 Main RD, Mutsamudu, Autonomous Island of Anjouan, Union of the Comoros. We are the controller of the personal data described in this policy.

2. Scope

This Privacy Policy explains what personal data we collect through the GoyHub website, community forum and desktop application (together, the "Service"), why we collect it, who we share it with, and what choices you have. It forms part of our Terms & Conditions.

By using the Service you acknowledge the practices described here.

3. What we collect

3.1 Account data

When you create an account we collect and store:

• Username — public, shown alongside everything you post.
• Email address — not shown publicly. We hold it to identify your account, to verify requests you make about it, and so we can contact you about security or service matters. We do not currently offer an automated password reset: if you lose your password, contact us.
• Password — stored only as a salted PBKDF2-HMAC-SHA256 hash. We never store, log or transmit your password in plain text and cannot recover it for you.
• Account status — your role (member or administrator), whether the account is banned, and when it was created.

3.2 Content data

The threads, replies, configurations, crosshair codes and other material you submit, together with associated metadata such as timestamps, view counts and the category you posted in.

3.3 Application data

Where you sign in to the GoyHub desktop application, we may collect information the application needs to function — such as your linked game profile identifier, match statistics it retrieves on your behalf, saved configuration profiles, application version, and diagnostic and crash information.

3.4 Support tickets

When you open a support ticket — with an account or without one — we collect and store:

• What you write — the subject, every message in the conversation, and any file you attach.
• How to reach you — your account's email address, or, if you have no account, the address you give us. A ticket opened without an account is protected by a private link; only a hash of that link's key is stored, so we cannot reconstruct it and neither could anyone who obtained a copy of our database.
• Technical context — the IP address and browser user-agent the ticket was opened from, so we can investigate abuse of the support system itself.
• Handling data — the status, priority, topic and tags of the ticket, which staff member handled it, response times, any rating you leave, and internal notes our staff write about the ticket or about your account. Internal notes are never shown to you and are not part of your conversation.

3.5 Other correspondence

If you contact us by email or through another channel, we keep the message, your contact details and our reply.

4. Cookies

The Service sets a small number of strictly necessary first-party cookies. It does not set advertising cookies.

• ghsession — keeps you signed in. HttpOnly, SameSite=Lax, expires after 7 days, and marked Secure over HTTPS.
• ghcsrf — a cross-site request forgery token that protects forms from being submitted by third-party sites.
• ghflash — a short-lived cookie (about 60 seconds) that carries a one-off status message between pages.
• ghterms — records that you accepted the Terms, and which version, so the notice is not shown again.
• ghtickets — set only if you open a support ticket without an account. It remembers the private keys to your own tickets on this browser so you do not have to keep the emailed link to hand. HttpOnly, expires after about four months, and holds nothing but those keys. Deleting it does not delete your tickets — you will simply need the link we emailed you.

These cookies are required for the Service to work; blocking them will prevent you from signing in or submitting forms. You can delete cookies through your browser settings at any time.

5. How we use your data

We use the data described above to:

• create and maintain your account and keep you signed in;
• operate, display and deliver the forum, the website and the application;
• protect the Service and its users — detecting and investigating abuse, spam, bot activity, credential-stuffing and brute-force attempts, ban evasion, and multiple-account abuse; and enforcing rate limits;
• moderate content and enforce our Terms & Conditions;
• respond to your support requests and send you service-related messages;
• understand how the Service is used, produce aggregate statistics, and develop and improve our features;
• comply with legal obligations and respond to lawful requests;
• establish, exercise or defend legal claims.

Where the law requires a legal basis for this processing, we rely on the performance of our contract with you (operating your account), our legitimate interests (security, abuse prevention, moderation and improving the Service), your consent where we ask for it, and compliance with legal obligations.

6. Public content

The forum is public. Your username, your posts, the time you posted, your join date and your post count are visible to anyone visiting the site, including people without an account, and may be indexed by search engines and copied or archived by third parties beyond our control.

Do not post personal information — yours or anyone else's — that you do not want to be public and permanent. We are not responsible for information you choose to disclose publicly.

7. Support tickets & AI assistance

7.1 Who can see your ticket

A support ticket is private between you and our staff. It is not public, it is not indexed, and it is not shown on your profile. Staff can see it; other members cannot.

If you opened the ticket without an account, anyone holding the private link can read and reply to it. Treat that link like a password: do not post it publicly or share it with anyone you would not want reading the conversation. You can have a fresh link emailed to you at any time, which retires the old one.

7.2 AI assistance

Where the operator of this site has configured it, we use Google's Gemini API to help us handle tickets. Specifically, the text of your ticket may be sent to Google in order to:

• suggest help-centre articles that might solve your problem before you even send the ticket;
• sort the ticket into a topic and priority, and flag obvious spam;
• write a summary and draft replies for a member of staff to read, edit and decide on.

A reply is never sent to you by an AI. Every message in your ticket was written or approved and sent by a person. The one place you may see text a model wrote is the "try this first" suggestions on the contact form, where the one-line reason beside a help article is labelled as an AI suggestion.

Before any text leaves this site it is passed through an automatic filter that masks things that look like credentials — long tokens, API keys, wallet addresses, anything written after "password:". That filter is a safety net, not a guarantee: please do not put passwords, licence keys, recovery phrases or private keys in a support ticket in the first place. We will never ask you for them.

Attachments are never sent to the AI provider — only the text of the conversation is.

If you would rather none of this happened, tick "Don't use AI on my ticket at all" on the contact form. That switches off the live matching in your browser, stops your text being sent for it, and marks the ticket so our staff cannot run the AI assist on it either. You can also just say so in your first message and we will do the same by hand.

7.3 Staff alerts

Where configured, a short notification may be sent to our staff's internal chat when a ticket is opened or escalated. It contains the ticket reference, subject, topic, priority and who opened it — not the contents of your messages.

8. Sharing & disclosure

We do not sell your personal data. We may share it in the following circumstances:

• Service providers. Hosting, storage, content delivery, email delivery, error monitoring, analytics and security providers who process data on our instructions in order to run the Service.
• AI processing. Where the operator has enabled it, support ticket text is sent to Google (Gemini API) for the purposes described in section 7.2. Attachments are not.
• Legal and safety. Where we believe in good faith that disclosure is required by applicable law, regulation, legal process or governmental request, or is reasonably necessary to enforce our Terms, investigate suspected fraud or abuse, or protect the rights, property or safety of us, our users or the public.
• Business transfers. In connection with a merger, acquisition, reorganisation, financing, or sale of all or part of our business or assets, in which case your data may be transferred to the counterparty subject to this policy.
• Affiliates. With companies under common ownership or control with us, for the purposes described in this policy.
• With your direction. Where you ask us to share it, or publish it yourself.
• Aggregated or de-identified data. Statistics that do not identify you may be published or shared freely.

9. Retention

We keep personal data for as long as we consider necessary for the purposes it was collected for. In practice:

• Account data — for as long as your account is open, and afterwards where we need it for security, legal or dispute-resolution purposes.
• Session records — deleted automatically when they expire, and immediately when you sign out or are banned.
• Forum content — retained indefinitely as part of the public record of the forum, including after an account is closed.
• Support tickets — kept while the ticket is open and afterwards for as long as we may need it to handle a related dispute, payment query or abuse investigation. If you delete your account, the ticket survives, but the account link, your email address and the IP address on it are removed and every message is re-attributed to [deleted].
• Ticket attachments — the file contents are deleted on a schedule after the ticket is closed (six months by default); the record that a file was attached, and when, remains on the conversation.
• Correspondence — for as long as needed to handle your request and keep a record of it.

Where we no longer need data in identifiable form, we may anonymise it and keep it as aggregate statistics indefinitely.

10. Security

We take reasonable technical and organisational measures to protect your data, including:

• salted PBKDF2-HMAC-SHA256 password hashing — plain-text passwords are never stored;
• server-side sessions where only a hash of the session token is stored, with HttpOnly cookies;
• cross-site request forgery protection bound to your session;
• rate limiting on sign-in, sign-up, posting and downloads;
• a proof-of-work human-verification check on sign-up;
• a strict content security policy and other hardened HTTP security headers;
• administrator access restricted to authorised accounts.

No online service can be completely secure. You are responsible for keeping your password confidential and for the security of the device you use. If we become aware of a breach affecting your personal data, we will act in accordance with applicable law.

11. Your choices & rights

You can at any time:

• ask us to correct or update the details on your account;
• stop using the Service and ask us to close your account;
• delete cookies through your browser;
• ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it.

Depending on where you live, you may have additional statutory rights — for example under the EU or UK General Data Protection Regulation, or comparable laws — including rights of access, rectification, erasure, restriction, objection, portability, and the right to lodge a complaint with your local supervisory authority. We will honour valid requests to the extent applicable law requires.

To make a request, email privacy​ [at] goyhub.st from the address registered to your account. We may ask you for information to verify your identity before we act, and we will respond within the period required by applicable law.

Please note two limits. First, we may retain records needed to enforce bans or to establish, exercise or defend legal claims, even after an account is deleted. Second, deleting an account does not delete the threads and replies you posted: removing them would break the conversations other members took part in, so they stay on the forum and are reattributed to [deleted], with your username removed from them. If a specific post needs to come down, ask us and we will consider it on its merits.

12. International transfers

We operate from the Autonomous Island of Anjouan, Union of the Comoros, and our hosting and service providers may be located in other countries. Your personal data may therefore be transferred to, stored in and processed in countries whose data-protection laws differ from those of your own country and may offer a lower level of protection.

Where required by applicable law, we put appropriate safeguards in place for such transfers. By using the Service, you acknowledge these transfers.

13. Children

The Service is not intended for children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact privacy​ [at] goyhub.st and we will delete the account and associated data.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will change the "last updated" date at the top of this page and, where the changes are material, make reasonable efforts to notify you through the Service. Changes take effect when published, and your continued use of the Service afterwards means you accept the updated policy.