1Who we are
Forward Development is the trade name of Tygo Alferink, based in the Netherlands. In this policy, “we” and “us” mean Tygo Alferink, trading as Forward Development.
We are the controller of the personal data described here. That means we decide how it is used and are responsible for it under the General Data Protection Regulation (GDPR).
Questions and requests go to legal@fwdscripts.com, or open a support ticket in the Forward Development Discord server.
2What this policy covers
This policy covers:
- the Forward Development Discord app (the bot)
- the Forward Development Discord server
- Pro subscriptions bought through Discord
- the portal, where you link your Cfx.re and Minecraft accounts and claim keys
- this website and the web store at store.fwdscripts.com
It does not cover Discord itself. Discord collects its own data when you use it, under the Discord Privacy Policy.
It also does not cover data sent by scripts or tools you run on your own servers. If any of them start sending data to us, this policy is updated before that release.
3What we collect
When you use the bot, the server or the portal
- Your Discord user ID, username, display name and avatar
- The roles you have in our server, such as Pro
- The commands and buttons you use, where you used them, and when. Discord sends this to the bot every time you interact with it.
Outside support tickets, the bot does not read or store your messages.
When you open a support ticket
The messages in the ticket, including anything you choose to add, such as server details, logs or screenshots. A transcript is saved when the ticket closes.
When you subscribe to Pro
Discord handles the payment, so we never see your card or bank details. Discord tells us whether you have an active subscription, which one, and when it started, renews or ended.
When you get access to Pro scripts
To grant you a licence for escrowed Pro scripts, we may need the account you use on the platform that issues it, such as your Cfx.re account. We store the link between that account and your Discord account.
When you link a Minecraft account
You link a Minecraft: Java Edition account in the portal by signing in with Microsoft. We keep only the account’s UUID and player name, and when you linked it. No Microsoft, Xbox or Minecraft token is kept: they are used once, during the sign-in, and then discarded. We never see your Microsoft password.
Plugin keys you claim are locked to that UUID. Once a week we ask Mojang’s public profile service for the current name of each linked UUID, so the name we show stays right.
When you download a free script or plugin
Free scripts and plugins need no account. We count free downloads per script, version and day, as totals: nothing about you is part of the count, we never keep your IP address for it, and with Do Not Track or Global Privacy Control on in your browser, nothing is counted. Whether you ticked the licence box before the download is not sent or stored. The file comes from Cloudflare (scripts) or Vercel (plugins), or from the site a download link points to; each processes your IP address to deliver it.
When you email us
Your email address, your name if you include it, and what you write.
When you visit our websites
This website does not use cookies, analytics or tracking. Signing in to the portal sets two cookies, both needed for it to work: one, for up to an hour, checks that the Discord sign-in came back to the browser that started it, and the other keeps you signed in.
The web store sets no cookies and stores nothing in your browser. Each page you open there sends us one anonymous signal: the page, whether it loaded, and the site you came from, with no cookie and no visitor ID. Pressing play on a video sends one more. We keep only daily totals from them: how often a page, a product, a video play, a kind of device, a language or a referring site came up, never a person, an address or an ID. With Do Not Track or Global Privacy Control on in your browser, nothing is sent.
A product in the web store can show a video. The YouTube player loads only when you press play, from youtube-nocookie.com. From then on YouTube may store data in its own player, under Google’s privacy policy.
Our hosting provider processes technical data, such as your IP address and browser type, to deliver pages and protect the sites against abuse.
4Why we use it
The GDPR requires a legal basis for every use of personal data. These are ours.
| What we do | Legal basis |
|---|---|
| Run the bot and respond to your commands | Contract: providing what you use under our Terms of Service |
| Give subscribers the Pro role, Pro channels and script licences | Contract |
| Link your Minecraft account, keep its name up to date and lock plugin keys to it | Contract, and legitimate interest in enforcing our licence |
| Count visits to the web store, as anonymous daily totals | Legitimate interest: knowing which pages and products people look at |
| Count free downloads, as anonymous daily totals | Legitimate interest: knowing which free scripts and versions people use |
| Answer support tickets and emails | Contract for subscribers, legitimate interest for everyone else |
| Keep the bot and server secure, prevent abuse and enforce our licence | Legitimate interest: protecting our work and the people who use it |
| Keep business and tax records | Legal obligation under Dutch tax law |
| Tell you about changes to our terms, this policy or Pro | Contract |
We do not sell your data, use it for advertising, or make decisions about you by automated means alone. When someone is banned, a person makes that decision.
You can object to any use based on legitimate interest. See Your rights.
5Who we share it with
We share personal data only with the parties below, and only what each one needs.
- Discord runs the platform the bot and server live on, and processes Pro payments. Discord is responsible for its own processing.
- Microsoft and Mojang: when you link a Minecraft account you sign in with Microsoft, which handles that sign-in under its own privacy statement. To keep a linked account’s name up to date we send Mojang’s public profile service its UUID, and nothing else.
- Our hosting providers run the bot, its database, this website, the portal, the web store and the free downloads.
- Our email provider sends and receives email.
- Licensing platforms, such as Cfx.re or Tebex, receive what they need to issue or revoke a licence for escrowed scripts. They are responsible for their own processing.
- Authorities, when Dutch or EU law requires us to share data.
Hosting and email providers process data only on our instructions, under a data processing agreement.
6Transfers outside the EU
Our hosting provider and some other services store or access data outside the European Economic Area, including in the United States. Those transfers are protected by the EU-US Data Privacy Framework, where the provider is certified under it, or by the European Commission’s Standard Contractual Clauses.
You can ask us which safeguard applies to which provider.
7How long we keep it
| Data | Kept for |
|---|---|
| Discord ID, roles and linked platform accounts | Until you have left the server and have no active subscription, then deleted within 30 days |
| Your linked Minecraft account: its UUID, name and when you linked it | Until you unlink it or your account is deleted. Plugin keys stay locked to the UUID for as long as they exist, also after you unlink |
| Command and error logs | 30 days |
| Support ticket transcripts | 12 months after the ticket closes |
| Emails | 12 months after the last message in the conversation |
| Subscription records | 7 years, because Dutch tax law requires us to keep business records that long |
| Records of bans and licence violations | As long as the ban or measure applies |
| Website server logs | A short period set by the hosting provider |
When a period ends, the data is deleted or made anonymous.
8Your rights
Under the GDPR you have the right to:
- get a copy of the personal data we hold about you
- have incorrect data corrected
- have your data deleted
- limit how we use your data
- object to uses based on legitimate interest
- receive your data in a format you can take elsewhere
Email legal@fwdscripts.com or open a support ticket. We reply within one month. We may ask you to confirm that the request comes from the Discord account it is about.
Deleting some data ends what depends on it. Without your Discord ID we cannot give you the Pro role. Records the law requires us to keep stay until that period ends.
If you are unhappy with how we handle your data, you can complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority, or to the authority in the EU country where you live.
9Age
You must meet Discord’s minimum age for your country to use the bot and server. We do not knowingly collect data from anyone younger. If you think a child has given us personal data, tell us and we will delete it.
10Security
Only the people who run Forward Development can access bot data. Data is encrypted in transit between Discord, the bot and our providers.
If a data breach puts your data at risk, we report it to the Autoriteit Persoonsgegevens within 72 hours, and tell you directly when the risk to you is high.
11Changes to this policy
When we change this policy, the date at the top changes. Significant changes are announced in the Forward Development Discord server at least 14 days before they apply.