Privacy

Unofficial community hub · not affiliated with Swiftpoint Ltd. This page says what Swiftpoint Hub stores and why, in the same order as the code that does it.

Signing in

The only way to have an account here is Discord OAuth, and the site asks Discord for exactly one piece of information: the identify scope, which gives your account id, display name and avatar URL. There is no password, and the site never sees your email address or anything else about your Discord account.

Signing in sets one cookie, swiftpoint.sid, for 12 hours. It is HttpOnly and SameSite=Lax, and it is the only cookie this site sets.

What is stored

• users — your Discord account id, display name, avatar URL, and the day you joined
• profiles — the .spcf you uploaded, its title, game, description and tags
• comments — what you wrote on a profile, and when
• votes — which profile you up- or down-voted, and when
• reports — what you reported, and the status the moderation queue put it in
• notifications — what happened while you were away: replies, votes on your profiles, admin messages
• pageviews — a hashed client IP and the page path, for traffic statistics

Everything above lives in a SQLite database on the server. The public API does not publish anyone's Discord account id: ownership questions ("is this your comment?") are answered by the server, so a visitor can read a page without learning who is behind it. Avatars are Discord CDN URLs and are public by nature.

What never leaves your device

• the .spcf Checker reads the file in your browser and uploads nothing
• the Profile Builder keeps your profile in your own browser, and on the site only if you publish it
• the OLED Editor draws to a canvas in your browser
• an uploaded .spcf is stored byte for byte and downloads identical to the original

Publishing is the one action that sends anything, and it only happens when you press publish. Replaying a recorded guide downloads a guide; it does not upload your profile.

What is stored in your browser

• sph-theme — which colour scheme you picked
• swh-docs-fold — which guide sections you collapsed
• sph:editor:pane-w, sph:editor:rail-w, sph:editor:rail-collapsed — the widths you dragged the Builder panels to
• sph:editor:draft — the profile you are working on in the Builder, kept in this browser so a reload or a sign-in does not lose it, and replaced by the next one you open or by a new blank profile

All of it is localStorage in your own browser. Clearing site data removes all of it, and nothing on the server depends on any of it.

Analytics

Page views are counted with hashed client IP (HMAC) with the page path. The client IP is never stored in the clear: only a keyed hash of it, which cannot be turned back into an address, is kept alongside the path that was visited. The hash is used to count unique visitors and cannot identify you across sites.

How long it is kept

• Page-view statistics are deleted automatically after 30 days.
• Everything else — your account, your profiles, your comments, your votes — is kept until you ask for it to be removed.

Your choices

• Ask for a copy of your data, or ask for your account and everything attached to it to be deleted.
• Both are handled by the same person who runs the site, and both need a way to tell it is really you — that is what signing in with Discord is for.

You can also delete a profile you uploaded yourself, and edit or delete any comment you wrote, from the page it is on. Both are gone from the public site immediately.

Contact

Questions, requests and complaints go to the operator of this site (see the repository linked in the header). This is a volunteer-run community project; there is no support desk and no response time to promise.

Last reviewed September 2026.