Privacy

Last updated 13 October 2026.

Buildworks Studio is a free, non-commercial fan project run by Elyon, the author of the Knox Buildworks mod, who is the controller of the personal data described here. In short: we keep only what the studio needs to work, we never sell or share it for advertising, there are no ads and no tracking cookies, and you can download or delete your data yourself at any time.

Using the studio without an account

• The editor runs in your browser. The blueprint you are working on is autosaved in your browser (IndexedDB), together with a few preferences: the quickbar, panel layout and the last room colour (localStorage). None of this is sent to us unless you save or publish a blueprint.
• Offline cache: a service worker keeps the editor, the content packs and static files on your device so the editor loads quickly and works offline. It never stores personal pages.
• Visit statistics: we use Vercel Web Analytics to count page views. It sets no cookies and stores no IP addresses; it records the page, the referring site, the country and the type of browser, operating system and device, and tells visits apart by a hash that changes every day, so you cannot be followed across days or other websites.
• Server logs: like every website, our host briefly logs requests (time, page, IP address, browser) to run the service and investigate errors and abuse. These logs are kept only for a short time by the host.

What we store when you have an account

• Sign-in: which methods you connected and their account ids (for Steam, your public SteamID64; for Discord, your user id). From Steam we read the name and avatar on your public Steam profile; from Discord only your username and avatar (the "identify" permission, no email, servers or messages). If you sign in by email, your email address. Access tokens from these services are not kept.
• Profile: your handle, display name, avatar and "about" text. Handles you used before are kept so old links still lead to you and nobody else can take them over.
• Content: blueprints with every saved version and their thumbnails, descriptions, tags, comments, likes, collections, the co-editors you add, and reports you file.
• Session cookie: one signed and encrypted cookie keeps you signed in for up to 30 days. During sign-in a few short-lived security cookies protect the sign-in itself. These cookies are strictly necessary, so no consent banner is needed.
• Abuse protection: counters per account or network address for rate limits (for example, how many comments were posted in the last ten minutes). They expire on their own, after at most 24 hours.
• Moderation: if staff act on your account or content, the action, the reason and the moderator are written to an audit log so decisions stay accountable. When staff remove a comment, the log keeps the first 200 characters of it as evidence.

What others can see

Your profile (handle, display name, avatar, about text, public blueprints), your comments, and public or unlisted blueprints with their version history are visible to others; unlisted ones only to people who have the link. Private blueprints are visible only to you, the co-editors you add and moderators. Your connected sign-in methods, email address and SteamID are not shown on your profile.

Why (legal bases)

• Providing the service you asked for (GDPR Art. 6(1)(b)): your account, profile, blueprints and everything you post.
• Legitimate interests (Art. 6(1)(f)): keeping the site secure and free of abuse (rate limits, logs, moderation records) and understanding which pages are used (cookieless statistics).
• Your browser's own storage holds only what you create in the editor and is strictly necessary for it to work.

Who processes it for us

These providers run the infrastructure and only process data on our behalf, to provide their service:

• Vercel: hosting, server functions, file storage (blueprint files and thumbnails) and visit statistics.
• Neon: the database (accounts, profiles, blueprints, comments).
• Upstash: rate-limit counters.
• Cloudflare: the domain's DNS and forwarding of email sent to our contact address.
• Resend: sending sign-in links and our replies by email.

Steam (Valve) and Discord see that you signed in here when you use them, under their own privacy policies. Avatars are loaded directly from Steam's and Discord's image servers, so your browser contacts them when a page shows an avatar. These services are mostly located in the United States; where data leaves the European Economic Area, they rely on the safeguards the GDPR allows, such as the European Commission's Standard Contractual Clauses.

We never sell personal data, never share it for advertising, and do not use it to train AI models.

How long we keep it

• Your account and content: until you delete them.
• When you delete your account: your account, profile, sign-in methods, former handles, blueprints and their files, comments, likes, collections and co-editor roles are deleted immediately. Versions you saved on someone else's blueprint, reports you filed and tags you created stay, without your name. Copies can remain in the database provider's short restore history for a few days before they are gone for good.
• Rate-limit counters: at most 24 hours. Server logs: a short period set by the host.
• Moderation records: as long as needed to handle repeated abuse and appeals.
• Emails you send us: as long as the conversation needs, then deleted.

Your rights

• Access and portability: download everything we hold about you as JSON from your page.
• Correction: edit your profile and blueprints at any time.
• Erasure: delete your account yourself from your page, or delete single blueprints and comments.
• Sessions: "Sign out everywhere" on your page ends every session at once.
• Objection and restriction: write to contact@elyonmods.com. We answer within a month.
• You can also complain to the data protection authority of the country you live in. We would appreciate the chance to sort it out with you first.

Children

The studio is not meant for children under 13. Sign-in uses Steam or Discord, which have the same minimum age (or higher, where local law requires it).

Changes

When this notice changes, the date at the top changes too. If a change affects how your existing data is used, we will say so on the site before it takes effect.

Contact

contact@elyonmods.com For security issues see the security page.