Privacy Policy

This policy explains what packs.haruhime.moe collects, why, and what stays on your own device.

Your rights under GDPR and CCPA have their own page, with a table of what we hold, why, and how long we keep it.

Sign-in happens on haruhime.moe, the account every haruhime tool shares. It stores your osu! user ID, username, avatar URL, and country, a record linking your account to osu! (never your osu! tokens), and the sessions that keep you signed in, with the IP address and browser User-Agent each one started from. haruhime.moe's own privacy page covers them. packs only reads that account and session to know who you are, and writes nothing to it.

Only if you sign in, packs itself stores:

• packs you choose to save: the pack name, description, beatmap IDs, slot layout, visibility, and any magnet links you choose to record on a pack (we keep only the torrent's fingerprint, name, size, and our own tracker list).
• every saved version of a pack (its name, description, beatmap IDs and slot layout, with who saved it and when), kept until the pack is deleted. Only you see it unless you turn on "Anyone who can see the pack" for that pack's history.
• If you create an API key: a SHA-256 hash of it (never the key itself), its first 12 characters so you can recognize it, when you created it, and when it was last used (updated at most once an hour).
• If you save or change packs (magnet links included), use the API, or create a key: short-lived request counters, by account, to enforce rate limits. They're deleted automatically within about two minutes, or about an hour for key creation.
• If you delete your packs data: a counter of deletions, by osu! user ID, deleted automatically within about an hour.
• If you set a pack to Public, it's listed on the public packs page with your osu! username and avatar.

If you don't sign in, we don't keep an account or any profile about you. If you send a request to the API without a valid key, we keep your IP address in a short-lived counter (about 2 minutes) to stop key guessing. Our host (Vercel) keeps standard request logs, such as IP address and browser type, for security and operations.

Every place packs uses your IP address:

• Sign-in sessions. haruhime.moe stores the IP address you signed in from with each session, as listed above. packs never stores it.
• osu! lookups. While you build or view a pack, signed in or not, your browser asks our server for star ratings with mods (/api/osu/star-ratings) and for maps the mirror doesn't have (/api/osu/beatmaps). Our server counts these requests per IP address in short-lived counters, so one visitor can't use up the site's osu! API quota. When you save a pack, on the site or through the API, our server looks up its maps to work out the pack's stats, and any osu! calls it makes for that count against your IP address's share too. The counters are deleted automatically within about two minutes.
• API requests without a valid key. Counted per IP address for about 2 minutes, to stop key guessing.
• Requests to our pools service without its token. Only pools.haruhime.moe has the token for the endpoints it publishes packs through. A request to them without the token is counted per IP address for about 2 minutes, and an address that keeps failing is told to slow down.
• Our host's request logs. Vercel keeps standard request logs, including your IP address.

Every counter groups an IPv6 address by its /64 network, so the addresses in one network share a counter. Our server never forwards your IP address to osu!: the osu! API sees only our server.

• Files. No beatmaps, audio, images, or videos ever pass through or rest on our servers.

packs sets no cookies of its own. It reads two that haruhime.moe sets on .haruhime.moe when you sign in there:

• The session cookie keeps you signed in. It's HttpOnly, so page scripts can't read it.
• haruhime-signed-in tells the page to check whether you're signed in. Page scripts can read it, and it holds no personal data.

Signing out on packs asks haruhime.moe to end the session and clears both cookies.

We use no tracking or advertising cookies, so there's no cookie banner.

When you build or export a pack, your browser requests beatmap data and files directly from the beatmap mirror (mirror.hinamizawa.ai), cover images from osu!'s CDN (assets.ppy.sh), and player avatars from osu! (a.ppy.sh). Those services see your IP address and browser details, under their own policies.

Magnet links on a pack page were added by the pack's owner. If you open one, your torrent app contacts the trackers listed in it and other peers, and they see your IP address: that's how torrents work. packs lists only its own set of public trackers in these links.

When the mirror doesn't have a map, your browser asks our server, and our server asks the osu! API (osu.ppy.sh) for that map's details. Only beatmap IDs are sent to osu!, never anything about you. To show star ratings with mods, our server also sends osu! a beatmap ID and the mod names (like HD or DT), and nothing else.

After a pack is saved, our server works out its stats (star rating, length and BPM ranges), and a daily job fills in what it couldn't get. It asks the beatmap mirror (mirror.hinamizawa.ai) for the maps' details, and osu! for maps the mirror doesn't have and for ratings with mods. These requests carry beatmap IDs and mod names only, and our server never downloads beatmap files.

So a saved pack's page can list its maps before your browser has loaded anything, our server also asks the mirror for the maps' details when it builds that page (at most about once a day per pack, not once per visitor). That request carries beatmap IDs only.

Pack drafts are kept in your browser's IndexedDB, and downloaded beatmap files are cached in your browser's private file storage so a second export doesn't download everything again. Your download options (videos and backgrounds) are saved in this browser's local storage, and removing backgrounds happens on your device too. When you filter public packs, this tab's session storage remembers how many results were showing and how far down you'd scrolled, so the Back button takes you there again. It's gone when you close the tab. This data stays on your device. You can delete it anytime with the "Clear local data" button at the bottom of every page, or by clearing site data in your browser.

Service providers

• Vercel hosts the website and runs its server functions.
• MongoDB Atlas stores the pack data listed above.
• haruhime.moe runs sign-in and keeps the account and sessions packs reads to know who you are.
• osu! (ppy Pty Ltd) confirms sign-in for haruhime.moe and answers lookups for maps the mirror doesn't have.

We don't use analytics or advertising trackers, and we don't sell personal data.

The GDPR & CCPA page has a table of each kind of data we hold, why, and how long we keep it.

Download my data on your packs settings page gives you a copy of everything packs holds about you, as a JSON file. Delete my packs data on the same page deletes your API key and every pack you saved, along with its saved history. Your haruhime account itself (your user record, sessions, and linked osu! account record) is deleted on haruhime.moe/account; delete your packs data first if you want it gone too. You can also email us to ask for a copy or for deletion.

Changes

We may update this page. It was last updated on 2026-10-06.

Contact

haruhime.moe runs packs.haruhime.moe. For anything on this page, write to haruhime@haruhime.moe.