Privacy Policy

• Performance of a contract — creating your account, storing content you submit, and operating the features you use directly (Art. 6(1)(b) GDPR).
• Legitimate interests — server logs, security monitoring and aggregate usage statistics, kept only as long as needed to detect abuse, keep the service running and understand how it is used (Art. 6(1)(f)).
• Consent — anything optional, such as email notifications you opt into, or cookies and identifiers used for personalised advertising (Art. 6(1)(a)) — see Sections 6, 7 and 8.

We do not sell your personal data for money. Advertising cookies from our advertising partners can count as a "sale" or "sharing" under some US state laws, and Section 8 explains your choice about that. We use a small number of service providers to run the site, each only for the purpose described:

• Cloudflare — delivers and protects the site (network, caching, security and performance measurement). Cloudflare may set a cookie or similar technology for bot protection.
• Donorbox — processes donations made on our Donate page.
• Google (sign-in and advertising) — if you use Google sign-in, and for the advertising described in Section 6.
• NitroPay (advertising) — shows ads on the site together with Google. NitroPay, and the advertising exchanges and partners it works with, may use cookies and identifiers to choose, show and measure ads, as described in Section 6. Their own privacy policies describe what they do.
• Microsoft — if you use Microsoft sign-in.
• Buy Me a Coffee — only if you or a creator add a link to a Buy Me a Coffee page; clicking it takes you to their site, which has its own privacy policy.

If GDPR applies to you, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your account and associated personal data ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us using the details in Section 11. We'll respond within one month, as required by Art. 12(3) GDPR. We may ask you to verify your identity first, to make sure we're not handing your data to someone else.

We keep account and content data for as long as your account is active. If you request deletion, we remove your personal data within 30 days, except where we're required to retain something longer for legal or security reasons (e.g. abuse-prevention logs).

Hangar Addons is free to use and is funded by donations and advertising. We use Google AdSense and NitroPay, and the advertising partners they work with, to show ads, and we keep them out of the way: no pop-ups, no ads before a download, no countdown timers, nothing that blocks a download. As described on our About page, the site stays enjoyable whether you interact with an advertisement or ignore it.

How Google uses data for ads. Third-party vendors, including Google, use cookies and similar technologies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet. Google and its partners may also use data such as your IP address and device information to deliver, measure and secure ads and to prevent fraud.

Your choices.

• You can opt out of personalised advertising by visiting Google Ads Settings, or by visiting aboutads.info to opt out of some third-party vendors' use of cookies for personalised advertising.
• You can read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.
• Do Not Sell or Share My Personal Information: you can opt out of the sale and sharing of your information for advertising at Your privacy choices, at any time and without an account.
• You can block or delete cookies in your browser settings. The site's essential functions (signing in, downloading) keep working without advertising cookies.
• If you're in the EEA, the UK or Switzerland, see Section 7 for how consent works.

Cookies and local storage we set ourselves. We do not set advertising or tracking cookies of our own. Signing in stores a session token in your browser's local storage so you stay signed in, and we also keep small preferences there (theme, text size, which forum topics you've read, and the random online-count identifier mentioned above). This is needed for the site to work and isn't used to track you across other websites.

Direct advertising. Some of the messages on the site come straight from advertisers through our own system, and they use no cookies. For each one we add up how many times it was shown, how many times it was on screen long enough to count, and how many times it was clicked, together with the page type, the device type and the country your visit came from (as reported by our network provider). These are totals; they are not tied to your account or to a profile of you. To avoid showing you the same message too often, your browser keeps a small counter in its local storage, which never leaves your browser. Visits from crawlers and scripts are not counted. A click on one of these messages passes through our server before it reaches the advertiser, so the click can be counted, and the advertiser sees only the totals for their own campaigns.

If you advertise with us. When a company buys or manages an ad on the site, we keep the details it gives us: the name of the company, the account that manages it, an email address for invoices, the website the ad leads to, the ads themselves, and a record of the orders, invoices and payments, including when the advertising terms were accepted. Payments are taken by Stripe, which collects and keeps the card details; we never see or store a card number, only the type of card and its last four digits so you can tell which one is saved. Invoices and tax records are kept for as long as the law requires.

If you visit from the European Economic Area, the United Kingdom or Switzerland, ads that use cookies or similar identifiers for personalisation, measurement or fraud prevention only run with your consent. We use a consent message provided through Google's certified consent management tools. It lets you accept, decline, or choose which purposes and vendors you allow, and it records your choice.

• Declining does not limit your access to anything on the site. You may see non-personalised ads, or fewer ads, instead.
• Changing your mind: you can reopen the consent message at any time through the privacy and cookie settings link where the consent tool provides one, or clear this site's cookies and storage in your browser to be asked again.
• Withdrawing consent is as easy as giving it, and doesn't affect anything done before you withdrew.

Visitors elsewhere, including the United States, can use the opt-out tools in Section 6, and the choices described in Section 8.

This section is for residents of California and of other US states whose privacy laws give them rights over their personal information. It applies in addition to the rest of this policy.

What we collect and why. In the last 12 months we have collected: identifiers (your email address, username, display name and IP address), internet activity (the pages you view and the addons you download), content you post, your approximate location (the country your visit comes from) and device information (your browser and operating system). We use it to run the site, keep it secure, understand how it is used, and show advertising. We collect it from you and from your browser. We do not knowingly collect sensitive personal information, and we do not use any we hold to infer things about you.

Selling and sharing. We do not sell personal information for money. The advertising on the site is provided by Google and, where we add them, other advertising partners. Their cookies and identifiers can use your visit to show you ads based on what you have looked at on this and other sites, which some state laws call "sharing" for cross-context behavioural advertising, or a "sale". The categories involved are identifiers, internet activity and approximate location. We do not knowingly sell or share the personal information of anyone under 16.

Your right to opt out. You can opt out of the sale and sharing of your information at any time at Your privacy choices, where the link is also called "Do Not Sell or Share My Personal Information". If your browser sends the Global Privacy Control signal, we treat it as that choice. Opting out turns off personalised advertising in that browser, and passes your choice to our advertising partners. It is stored in a cookie, so it applies to the browser and device you make it in. We will not ask you to opt back in for at least 12 months.

Your other rights. You can ask us to tell you what personal information we hold about you and how we use it, to give you a copy, to correct it, or to delete it, and you can ask us to limit the use of any sensitive personal information. We will not treat you differently, for example by refusing you service or changing the quality of it, because you used any of these rights.

How to ask. Use our Contact page and say which right you want to use. We may ask you to confirm who you are by replying from the email address on your account, so we do not hand your information to someone else. We reply within 45 days, and tell you if we need longer. You can also ask someone to act for you, if they can show they are allowed to.

Hangar Addons is not directed at children under 13, and we don't knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we'll remove it.

Our infrastructure and our service providers may process data outside your home country. Where that involves a transfer out of the EEA/UK, we rely on appropriate safeguards (such as Standard Contractual Clauses) as required by GDPR Chapter V.

For any privacy question or to exercise a right under this policy, use our Contact page. If you're in the EEA/UK and unsatisfied with our response, you have the right to complain to your national data protection authority.

If this policy changes materially, we'll update the "last updated" date above. Continued use of the site after a change means you accept the updated policy.