Privacy Policy — Mad Mammoth Labs

Last updated: October 27, 2026

This policy explains what personal data the Mad Mammoth Labs website (the “site”) collects, why, and what you can do about it. The site is run by Mad Mammoth Labs (“we”, “us”), which is responsible for your data. You can reach us at business@madmammothlabs.com.

The short version

You can browse without an account. Signing in is only through Discord, and we never see your email address or password.
We keep what we need to run your account and the rewards: your public Discord profile, your sign-in sessions, and your giveaway entries and codes.
Google Analytics runs only if you accept analytics cookies. We don’t run ads, and we don’t sell your data.

What we collect

When you browse

You don’t need an account to look around. Like any website, our server receives your IP address and browser details with each request, which it needs to send you the page. Our server doesn’t keep a log of the pages you visit. During sign-in, your IP address is held in memory for a minute or two to limit repeated attempts.

Pages that show Discord avatars load them straight from Discord’s servers, so Discord receives your IP address when your browser fetches them.

If you accept analytics cookies, Google Analytics also records your visit (see Google Analytics, below).

When you sign in with Discord

We ask Discord only for the identify permission. If we check membership of our Discord server for members-only rewards, we also ask for guilds.members.read, which lets us see whether you’re in that one server. From Discord we store:

your Discord user ID, username and display name;
the ID of your avatar, so we can show your Discord avatar;
whether you’re a member of our Discord server, as a simple yes or no, and only when we check it.

We never receive your email address, password, messages or the list of servers you’re in. Discord gives us a temporary access token, which we use once to read your profile and then revoke; we don’t store it. Your profile is refreshed from Discord each time you sign in.

Your account

your role on the site (player, or staff such as studio editor or admin);
when you joined, when you last signed in, and when you were last active (updated at most every five minutes while you’re signed in);
if the account is banned: when, and the reason;
notes our admins may write about the account, for moderation.

Sign-in sessions

When you sign in, we set a cookie holding a random token. We store only a SHA-256 hash of that token, never the token itself, together with when the session started and when it expires, and the IP address and browser (user agent) you signed in from. Your Account page lists your sessions by device and lets you sign out of all of them.

Rewards

When you enter a giveaway we store your entry, when you made it and whether you won. When you claim a code we store which code you got and when.

The activity log

We keep a log of new sign-ups and of what staff do in the admin panel, for example changing someone’s role or banning an account, with the time and the IP address it came from. It keeps the admin panel accountable and helps us investigate abuse.

Images uploaded by staff

Images uploaded in the admin panel are re-encoded on our server, which strips their metadata, such as camera details and GPS location. We keep the original file name and who uploaded it. Players can’t upload anything.

How we use it

to sign you in and keep you signed in;
to run rewards: check eligibility, keep it to one entry or code per account, draw winners and show you your codes;
to show who won (see below);
to keep the site secure, with rate limits, bans and the activity log;
if you accept analytics cookies, to see how the site is used, with Google Analytics;
to run and fix the site.

We don’t use your data for advertising, we don’t build marketing profiles, and we don’t sell or rent it to anyone.

What other people can see

If you win a giveaway, your Discord display name and avatar appear in the list of winners on the Rewards page, which anyone can see. Codes you claim are shown only to you. Our admins can see the account details described above, to run the site.

Legal bases (EU and UK)

If you’re in the EU or the UK, we rely on:

contract, to provide your account and the rewards you take part in;
legitimate interests, to keep the site secure, prevent abuse and keep the activity log;
consent, for analytics cookies;
legal obligation, where the law requires us to keep or disclose data.

Cookies

Session cookie (__Host-mml_session) keeps you signed in. It lasts up to 30 days and is renewed while you keep using the site, and it’s removed when you sign out. It is strictly necessary, so it doesn’t need consent.
Sign-in cookies (oauth_state, oauth_verifier, oauth_next) protect the Discord sign-in step and remember which page to bring you back to. They last at most 10 minutes and are deleted as soon as you return from Discord.
Cookie choice (mml_consent) remembers whether you accepted or declined analytics cookies, for 6 months, so we don’t ask on every visit.
Analytics cookies (_ga and _ga_<ID>) are set by Google Analytics, only if you accept them. They tell visits apart and last up to 2 years.

There are no advertising cookies.

Changing your choice. Open cookie settings at any time. It clears your choice, deletes any Google Analytics cookies, and shows the cookie banner again.

Google Analytics

We use Google Analytics 4 to see which pages people use, only if you accept analytics cookies in the banner. Until you accept, nothing is loaded from Google, and if you decline, nothing is loaded at all. When you accept, Google Analytics collects:

the pages you view, how you arrived (such as the site that linked you), how long you stay, and some interactions, such as scrolling and clicks on links to other sites;
your device type, browser, operating system, screen size and language;
your approximate location (country, region and city), which Google works out from your IP address. Google Analytics 4 doesn’t log or store IP addresses.

Google processes this data on our behalf, as our processor, under Google’s data processing terms. Google’s advertising features are switched off: Google signals and ad personalisation are disabled, and consent for ad storage, ad user data and ad personalisation is always set to “denied”. Google keeps the detailed data for 2 months, after which only aggregated reports remain.

You can withdraw your consent at any time in cookie settings, or block Google Analytics on every website with Google’s opt-out browser add-on. Google explains how it uses data from sites that use its services.

Who else is involved

Discord handles sign-in, and your avatar loads from Discord’s servers. Discord’s privacy policy applies to your Discord account.
OVHcloud hosts the server and database the site runs on.
Let’s Encrypt issues the certificate that secures the connection (HTTPS). It receives no personal data about you.
Google runs Google Analytics, if you accept analytics cookies (see above).
Stake: we link to Stake’s sites, but we don’t send them any data about you. If you follow a link, their privacy policy applies.

We may also disclose data if the law requires it, or to protect our rights or other people’s safety.

Discord and Google are based in the United States, so data they handle may be processed there, under the safeguards they provide for international transfers.

How long we keep it

We don’t run automatic deletion schedules on our own database. In practice:

Your account, giveaway entries and claimed codes are kept for as long as your account exists, so there is a record of each draw and of who claimed which code.
Sessions are deleted when you sign out. A session that simply expires stays in our database until that browser visits the site again, you use “sign out everywhere”, or your account is deleted.
The activity log is kept as a security record. If your account is deleted, its entries are no longer linked to your account, but they can still contain your username and the IP address recorded at the time. We’ll remove those on request unless we need them to investigate abuse.
Backups of the database are kept for a limited time, so deleted data can remain in a backup until that backup is deleted.
Google Analytics data is kept by Google as described above.

Deleting your account, and your other rights

There is no delete button on the site yet. To have your account deleted, email us at business@madmammothlabs.com; we may ask you to confirm the request from your Discord account. Deleting your account removes your profile, your sessions and your giveaway entries, and unlinks you from any codes you claimed.

Depending on where you live (for example in the EU, the UK or some US states), you may also have the right to:

see the data we hold about you, and get a copy of it;
correct it (most of it comes from Discord and is refreshed each time you sign in);
have it deleted;
object to, or ask us to restrict, how we use it;
withdraw your consent to analytics cookies, at any time, in cookie settings.

To use any of these rights, email us at business@madmammothlabs.com. We’ll reply within the time the law requires. Your Account page already shows your sessions, the giveaways you’ve entered and the codes you’ve claimed. You can also complain to your local data protection authority (in the UK, the Information Commissioner’s Office).

Security

The connection to the site is encrypted (HTTPS). Session tokens are stored only as hashes, scripts on the page can’t read the session cookie, and the admin panel is open only to staff, with their actions logged. No system is perfectly secure, but we work to protect your data.

Children

The site is for adults only (18+). We don’t knowingly collect data from anyone under 18. If you believe a minor has signed in, email us and we’ll delete the account.

Changes to this policy

When we change this policy we’ll update the date at the top. For significant changes we’ll also post a notice on the site.

Contact

Questions or requests about your data: business@madmammothlabs.com.