Privacy policy

Last updated 4 November 2026

This policy explains what personal data scp261.org processes and why. It follows the Swiss Federal Act on Data Protection (FADP) and, for visitors in the EU and UK, the GDPR.

Who is responsible

Artur Markus, Brotkorbstrasse 30, 4332 Stein, Switzerland. Contact for anything about your data: info@scp261.org.

What we process

When you browse

The server sees your IP address and browser type, as every website does. We use them to protect the site from abuse (rate limits, held in memory, not stored) and for simple visitor statistics. For statistics we store only a daily-changing, salted hash of IP address and browser type, the page and the campaign tag of the link you came from. The hash cannot be turned back into an address and cannot link your visits across days. No analytics cookies, no third-party trackers.

Fonts are served from this site. The payment component from Stripe is loaded on the machine page and may set cookies of its own for fraud prevention.

When you vend

Payment is handled by Stripe; we never see your full card number. We receive and store your email address, the payment reference, the amount and the time, and link them to the item you received. The number you type on the keypad and the power setting become part of the item. We use your email to send you your item and, if you ask, a sign-in link to your items. We do not send newsletters or marketing.

The item itself (text and picture) is published in the public archive and mirrored on GitHub, without your name or email.

When you sign in to “Your items”

We store a session identifier in a cookie that is necessary for being signed in, and on our server, for up to 30 days or until you sign out.

Legal basis

Performing our contract with you (payment, delivery, sign-in), our legitimate interest in running a secure site and knowing how it is used (abuse protection, statistics), and our legal obligation to keep accounting records.

Who else processes data

• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): payments.
• Railway (Railway Corporation, USA; servers in the EU): hosting and database.
• Resend (Resend, Inc., USA; sending from the EU): emails.
• OpenAI and Replicate (USA) generate the items. They receive only the item’s rarity, category, price and power setting, no personal data.

Where data reaches the USA, the transfer relies on the Swiss-US and EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep it

Payment records are kept for 10 years, as Swiss accounting law requires. Your email stays linked to your items until you ask us to remove it; after that, the item stays in the public archive without any link to you. Statistics are kept in the hashed form described above.

Your rights

You can ask for a copy of your data, have it corrected or deleted, object to its processing and, under the GDPR, take it with you. Write to info@scp261.org. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU or UK, to your local data protection authority.

See also the terms of sale and the legal notice.