Privacy
This site runs no analytics service, sets no tracking cookies, and shows no advertising. That is what the code does, and the specifics are below so you can hold it to them.
No account, no sign-up, no contact form. Nothing you do here is profiled, and nothing is sold or shared for marketing. One preference is stored in your own browser, and the web server keeps ordinary request logs for fourteen days, which it also uses to count page loads per campaign label.
Buying MifBridge here is the one exception to all of that: Stripe takes the payment on its own page, and this site keeps what delivering and recording the sale needs. See Buying MifBridge on this site.
What is stored in your browser
Exactly one item, and only if you use it. Dismissing the announcement bar at the top of the page writesmif-announcement-dismissed to localStorage, so it stays dismissed on your next visit. It is a single flag, it never leaves your device, and clearing your site data removes it.
There are no cookies set by this site for visitors, no session identifiers, and no fingerprinting. The one exception is the staff area: if a MifBridge staff member signs in, the site sets the cookies sign-in needs (a session and an anti-forgery token) in that person’s browser, and nobody else’s. Typefaces are loaded from your own system rather than a font CDN.
Buyers who sign in to My purchases with Discord are the other exception. Signing in sets mif_oauth, a random value that lives for fifteen minutes while you sign in, and thenmif_buyer, which keeps you signed in for thirty days. It holds your Discord id, your Discord display name and, if Discord has verified it, your email address, signed so it cannot be altered. It stays in your browser (the server keeps no copy), and signing out deletes it.
Review badges
The footer on every page shows two badges, and both load from their own services while you read: Trustpilot’s review widget, a script and a frame from widget.trustpilot.com, and AlternativeTo’s badge, an image from alternativeto.net. Loading them sends those services your IP address and browser details, as any request does. Trustpilot’s widget runs in its own frame under Trustpilot’s privacy policy, and AlternativeTo’s policy covers the badge.
Embedded video
The showcase and product pages embed video from YouTube through youtube-nocookie.com, and the player is only loaded when you click to play. Until then the page shows a still image and YouTube receives nothing. Once you press play you are interacting with YouTube, and Google’s privacy policy governs that. The “nocookie” host defers storage until playback; it does not eliminate it.
Donations
The “Support the Project” button and the floating Donate button lead to Ko-fi, the service that handles donations. Nothing from Ko-fi loads while you read this site: the button is a plain link, and the floating panel loads Ko-fi’s page only when you open it. From then on you are interacting with Ko-fi, and Ko-fi’s privacy policy governs that. No payment details ever reach this site.
Buying MifBridge on this site
The payment. You pay on Stripe’s own checkout page, and Stripe sells MifBridge to you as the merchant of record. Your card or bank details, and the billing details tax needs, go to Stripe and never reach this site. Stripe’s privacy policy covers what Stripe holds.
What this site keeps. From Stripe the site receives your email address, your country, what you bought, the price and its tax, and Stripe’s references for the payment and the invoice. It records them, one line per event, in a log on its own server, and keeps a PDF copy of each invoice Stripe issues. Those are the store’s record of its sales, kept as long as tax and accounting rules require. Your license ID is worked out from the purchase and saved with the payment at Stripe. See the terms of sale.
Campaign links. Some links to this site carry a campaign label, such as ?ref=reddit on a link in an advert or in a creator’s video, or ?utm_source=bluesky on a link in one of our own social posts. Our short links, such as mifshowcase.store/fb, open the site with a label of the same kind. The page remembers that label while you move around the site, in its own memory only: no cookie is set and nothing is stored on your device, so reloading the page or opening a new tab forgets it. If you buy, the label is saved with your purchase at Stripe, so we can tell which campaigns and platforms lead to sales. The label names a campaign and never a person, nothing is sent to any advertising platform, and a visit that ends without a purchase leaves only the ordinary entry described under Server logs.
Emails. The purchase email, any new link you ask for at Get a new download link, and an email when a new version is out are sent through Resend. Every release email has a one-click unsubscribe, and an unsubscribe is stored as a keyed hash of the address, never the address itself.
Downloads. Each download is logged with the time, the purchase, which file, the version, the country Cloudflare reports, and a keyed hash of your IP address in place of the address. The address itself is held only in the server’s memory, for a few minutes, to limit repeated requests.
Discord, if you connect it. The Owner-role button and the My purchases sign-in use Discord’s own login. Discord then tells the site your Discord id and username, and for the sign-in, your email address if Discord has verified it, which is used only to find purchases made with it. Your Discord id and username are saved on your payment at Stripe, so that a refund can take the role back and My purchases can find the purchase, and the log records the link or the sign-in with your Discord id and name. With the permission you give on Discord’s screen, the bot adds you to the MifBridge Discord with the role.
Staff. A private staff channel on Discord gets one message per purchase: what was bought, the price and tax, the country, your email address with most of it hidden (like b***@example.com), the license ID and Stripe’s reference for the payment.
For a copy of what the site holds about your purchases, or to have what is not needed for its records deleted, write to [email protected].
Server logs
The web server keeps a standard access log so the site can be operated and abuse can be spotted. Each entry records the time, the path requested, the HTTP status, the referring page, and the browser’s user-agent string. We also count from it how many pages were loaded with each campaign label (a link’s ?ref= or ?utm_source=): totals per label, and nothing else is taken from it.
Your IP address is not in those logs. The site sits behind Cloudflare and the origin server has no real-IP restoration configured, so the address recorded against every request is a Cloudflare edge server, not yours. Logs rotate daily and are deleted after fourteen days.
Cloudflare itself does see your IP address, because it is the proxy that serves you the page. That is covered by Cloudflare’s own privacy policy rather than this one.
The MifBridge update check
From version 1.1 the MifBridge plugin asks this site whether a newer version is out: about ten seconds after the Unreal editor starts, and at most once every 24 hours, it sends one request to /api/version. The request carries no query string, no cookies, no credentials and no identifier. Its user-agent string names only the plugin’s and the engine’s version (for example MifBridge/1.2.0 UE/5.8), and the answer is the version on sale. The request is recorded like any other in the server logs, with a Cloudflare address in place of yours.
Turn it off in the editor under Editor Preferences ▸ Plugins ▸ Mif Bridge ▸ Check for Updates, or set the environment variable MIF_BRIDGE_NO_UPDATE_CHECK=1.
What is never collected
- No analytics or measurement product of any kind.
- No advertising, retargeting or conversion pixels.
- No email addresses, except a buyer’s, as described above.
- No card or bank details. Stripe takes the payment on its own page.
Buying a product
Products sold through Fab, like the Small Oil Rig FPS Map, are sold by Epic Games, which handles the transaction and holds whatever data that involves under its terms; nothing about a Fab purchase reaches this site. MifBridge bought on this site is covered above.
Changes
If what the site does changes, this page changes in the same commit. The review date at the top is the last time the claims here were checked against the running site rather than assumed.