Privacy Policy

Last updated: 15.10.2026

1. General provisions

This Policy explains what personal data AORY.TOP processes, why, and how it is protected.

1.1. The personal data operator is the Administration of AORY.TOP (the "Operator").
1.2. The Policy applies to aory.top, its subdomains and all services available on them (the "Site").
1.3. Data is processed in accordance with Russian Federal Law No. 152-FZ "On Personal Data" of 27.07.2006.
1.4. By registering, submitting the contact form or otherwise providing data through the Site, the User consents to its processing under this Policy.

We collect only the data needed for Site features to work.

2.1. Account data: username, email address, password (stored only as a cryptographic hash; the original password is not accessible to anyone), avatar, registration date.
2.2. Technical data: IP address, browser and device information (User-Agent), approximate location by IP address (country, city), sign-in history and active sessions.
2.3. Voting data: the nickname entered, the selected world, the date and time of the vote, its status and rejection reason.
2.4. Publications: reviews, comments and server owner replies.
2.5. Requests: messages and attachments in support tickets; name, email and message from the contact form.
2.6. Server owner data: server and world details, website and social links, banners, Vote API keys (stored only as a hash).
2.7. Purchase data: service, period, amount, payment method and status. The Site does not receive or store bank card details.
2.8. Statistics: daily view and click counts for servers, worlds and ads — in anonymized form.

Data is used only for the purposes listed.

3.1. Registration, sign-in, email confirmation, password reset and email change.
3.2. Protecting accounts and the Site: detecting password guessing, suspicious sign-ins, vote boosting, spam and abuse.
3.3. Running voting and the ranking, including ensuring that no more than one vote per day is counted from one IP address and for one nickname.
3.4. Listing servers, reviews and comments, and moderating them.
3.5. Providing Paid services and recording purchases.
3.6. Replying to support tickets and contact form messages.
3.7. Sending service emails: email confirmation, password reset and change, verification codes. The Site does not send marketing emails.

The Site uses only cookies required for it to work.

4.1. Session cookie (refresh token) — keeps you signed in across all Site subdomains. It is not accessible to page scripts (httpOnly) and is sent only over a secure connection.
4.2. Language, theme and cookie-consent cookies — remember your settings so the cookie notice is not shown again.
4.3. A short-lived access token is kept only in the tab's memory and is cleared when the tab is closed.
4.4. The Site does not use third-party advertising or analytics cookies. Disabling cookies in your browser makes signing in impossible.

We do not sell personal data and share it only as far as needed for the Site to work.

5.1. Cloudflare Turnstile — bot check in forms; the service receives technical browser data and the IP address.
5.2. Hosting and cloud storage — hosting the Site, the database and uploaded files. Ticket attachments are kept in private storage and opened via temporary links.
5.3. Email service — delivering service emails to your address.
5.4. Payment provider — processing payments for Paid services; card details are entered on the provider's side.
5.5. Server owners receive via the Vote API only the nickname, world, vote date and vote ID. Voters' accounts, emails and IP addresses are not shared with them.
5.6. Only the author's username and avatar are publicly visible next to their reviews and comments. Email and IP address are never published.
5.7. Data may be disclosed to government authorities only in cases and in the manner provided by law.

Data is kept no longer than needed for the purposes of processing. Outdated data is deleted automatically.

6.1. Account data — while the account exists.
6.2. Sign-in history, ended and expired sessions — 90 days.
6.3. Votes — until the end of the current month: on the 1st at 00:00 Moscow time, last month's votes are deleted.
6.4. Email confirmation, password reset and email change links and codes — until they expire (15 minutes to 24 hours), then deleted.
6.5. Technical markers used to count views, clicks and votes per IP address — until the end of the current day, Moscow time.
6.6. Reviews, comments, tickets and requests — while the account exists or until deleted.
6.7. Purchase records — for the periods required by law for accounting documents.

The Operator takes organizational and technical measures to protect personal data.

7.1. Data is transmitted only over a secure HTTPS connection.
7.2. Passwords and API keys are stored only as hashes.
7.3. Rate limiting, captcha and temporary blocking against password guessing.
7.4. Every session is verified on the server and the User can end any session; if session theft is suspected, all sessions of the account are ended.
7.5. Role-based staff access and an audit log of staff actions.
7.6. Uploaded files are checked for type, size and image dimensions.

The User has the right to manage their personal data.

8.1. Obtain information about which of their data is processed.
8.2. Change their username, email, password and avatar in the Dashboard or request correction of inaccurate data.
8.3. View active sessions and end any of them.
8.4. Withdraw consent and request deletion of their data and account via support. Withdrawing consent makes further use of the account impossible.
8.5. Appeal the Operator's actions to the authority for the protection of data subjects' rights (Roskomnadzor) or in court.
8.6. Requests are handled within the time limits set by law — no more than 10 business days.

The Site is not intended to collect data from children.

9.1. Persons over 14 may register on the Site. Users under 18 may use Paid services only with the consent of their parents or legal guardians.
9.2. If you learn that data of a child under 14 was provided without a legal guardian's consent, let us know and we will delete it.

The Policy may be updated when Site features or the law change.

10.1. A new version takes effect once published on this page. The update date is shown at the top of the page.
10.2. Continuing to use the Site after an update means you accept the new version.

For questions about personal data processing, contact the Operator.