Contents
GDPR & CCPA
Your rights over your data under the GDPR and the CCPA, what we hold and why, and how to use them.
This page explains your rights over your personal data under the GDPR (EU and UK) and the CCPA (California, as amended by the CPRA), and how to use them. The Privacy Policy has the full picture of what packs collects.
Who's responsible
#The operator of packs.haruhime.moe is the controller of your personal data. Write to haruhime@haruhime.moe about anything on this page.
What we hold and why
#| Data | Purpose | GDPR legal basis | Kept until |
|---|---|---|---|
| Your osu! user ID, username, avatar URL, and country, read from your haruhime.moe account | Knowing who you are and which packs are yours | Contract | haruhime.moe keeps it until you delete your haruhime account there |
| Sign-in sessions, each with the IP address and browser User-Agent you signed in from, kept by haruhime.moe (packs only reads the session) | Keeping you signed in | Contract | Up to haruhime.moe; signing out on packs ends the session |
| Packs you save, with their name, description, maps, visibility, and magnet links | The service you asked for | Contract | You delete the pack or your packs data |
| Every saved version of a pack, with who saved it and when | Letting you see and keep a pack's history | Contract | You delete the pack or your packs data |
| Your API key, if you create one. We store only a hash of it, its first 12 characters, and when it was created and last used. | Letting your scripts and bots use the packs API | Contract | You revoke the key or delete your packs data |
| Rate-limit counters, if you save or change packs, use the API, or create a key, keyed by your account, or by your IP address when a request to the API has no valid key or a request to our pools service has no valid token | Protecting the service from abuse | Our legitimate interest in preventing abuse | About 2 minutes, or about an hour for the key-creation counter |
| A counter of packs data deletions, keyed by your osu! user ID | Protecting the service from abuse | Our legitimate interest in preventing abuse | About an hour |
| Rate-limit counters for osu! lookups (star ratings, maps the mirror doesn't have, and the lookups for a pack's stats when you save it), keyed by your IP address, signed in or not | Keeping one visitor from using up the site's osu! API quota | Our legitimate interest in preventing abuse | About 2 minutes |
| Request logs kept by our host, Vercel, such as IP address and browser type | Hosting and security | Our legitimate interest in running the site securely | As long as Vercel keeps them under its own policy |
Every IP-keyed counter groups an IPv6 address by its /64 network. Our server never forwards your IP address to osu!.
Your rights under the GDPR
- Access and portability. Get a copy of your data in a machine-readable file.
- Rectification. Have wrong data corrected.
- Erasure. Have your data deleted.
- Restriction. Ask us to pause using your data while a question about it is sorted out.
- Objection. Object to anything we do on the basis of legitimate interest.
- Complaint. Complain to your data protection supervisory authority.
Your rights under the CCPA
- Know, delete and correct. Ask what we hold about you, ask us to delete it, and ask us to correct it.
- Selling and sharing. We don't sell or share personal information.
- Opting out. We honor Global Privacy Control signals.
To use any of these rights, email haruhime@haruhime.moe.
How to use your GDPR rights
#- Download my data on your packs settings page gives you a JSON file with everything packs holds about you: your profile details, your saved packs, and your API key's prefix and dates.
- Delete my packs data on the same page deletes your API key and every pack you saved. Your haruhime account (your sessions and the osu! link) is deleted on haruhime.moe/account.
- Your name and avatar come from your osu! profile. Change them on osu!, and haruhime.moe picks up the new ones the next time you sign in.
- For anything else, email haruhime@haruhime.moe. We answer within 30 days.
More about the CCPA
#- What we collect. Identifiers (your osu! user ID, username, and IP address) and internet activity (request logs).
- Sensitive personal information. We don't collect any.
- Response time. We answer within 45 days.
packs is small and free, and it may fall below the thresholds where the CCPA applies. We give these rights to everyone anyway, wherever you live.
Changes
We may update this page. It was last updated on 2026-10-06.
Contact
haruhime.moe runs packs.haruhime.moe. For anything on this page, write to haruhime@haruhime.moe.