Privacy policy

Last updated: 2026-10-31

Privacy is a core principle of NoxFrame: we collect as little data as possible, use no advertising, no tracking cookies and no third-party services in your browser, and we do not store IP addresses.

1. Controller

Kay Kletzsch, Bertramstraße 25, 51103 Köln, Deutschland – e-mail: info@noxsframe.com

2. Hosting

The website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (data centre in Frankfurt am Main, Germany). To deliver the site, the server necessarily processes your device's IP address. The web server writes no access logs containing IP addresses. Legal basis: Art. 6(1)(f) GDPR (secure and stable operation). A data processing agreement is in place with the host.

Error log: If a technical error occurs on the server or in your browser, we store the error message, the affected page (without query parameters) and technical details of the program flow so we can fix it. Neither your IP address nor your account is stored. Entries are deleted at the latest 90 days after the last occurrence, fixed errors after 30 days. Legal basis: Art. 6(1)(f) GDPR (error-free operation of the website).

3. No third parties in your browser

Fonts are self-hosted. Item images and market prices (warframe.market) are loaded through our server, so your browser does not connect to these services directly. Only when you click an external link (e.g. Warframe wiki, warframe.market) do the privacy policies of those providers apply.

4. Visitor statistics

We count page views without cookies and without identifiers: we only store the day, the page, the language and – if present – the domain of the referring website (e.g. “google.com”), each as a total. No individual can be identified from this.

Only with your consent (cookie banner: “Allow statistics”) we also count unique visitors per day. For this, a hash is formed from your IP address and browser identifier together with a random value that changes daily. It only exists in memory, is never stored and becomes useless after 24 hours at the latest. Only the total count is stored. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG; you can withdraw your consent at any time via “Cookie settings” in the footer.

If the search (Ctrl+K) finds no item for a term, we store that term together with the day, the language and a count – without IP address, account or cookie. This shows us which content is missing or named differently. Terms that look like e-mail addresses, links or long numbers are discarded. Entries are deleted after 90 days. Legal basis: Art. 6(1)(f) GDPR (our interest in improving the search and the database).

5. Cookies and local storage

• nf_session – only after signing in, keeps you signed in (30 days, httpOnly). Strictly necessary.
• nf_oauth_* – only during the Discord sign-in (max. 10 minutes), protects against abuse. Strictly necessary.
• nf_consent (your browser's local storage) – remembers your cookie banner choice.

The legal basis for strictly necessary storage is § 25(2) no. 2 TDDDG.

6. Account and Discord sign-in

To use the web builder and to save, publish and vote on builds, you sign in with Discord (OAuth 2.0, scope “identify”). Discord sends us your Discord profile. We store the numeric Discord ID solely as a one-way hash created with a secret key (HMAC-SHA256). On your first sign-in we take your Discord name once as the initial display name; you can change it at any time. We also store a reduced copy of your Discord avatar (128 px) and refresh it at every sign-in, so your browser never loads images from Discord; you can remove it on your account page at any time. Your e-mail address and Discord access token are not stored; we revoke the access token right after the sign-in.

We also store your display name, your registration date, your builds and your votes. Legal basis: Art. 6(1)(b) GDPR (providing your account). The privacy policy of Discord Inc. (discord.com/privacy) also applies to the sign-in.

Published builds are visible to everyone together with your display name.

7. Contact form

When you write to us via the contact form, we store the chosen category, subject and message, the contact detail you optionally provide (e.g. e-mail or Discord name), the optionally given page, the language of the website and the date. If you are signed in, the message is linked to your account. No IP address is stored; to prevent abuse it is only held briefly in memory to limit the number of messages.

To prevent spam, your browser solves a short computing task before sending (“I’m not a robot”) if you are not signed in. Task and solution are exchanged only between your browser and our server. No cookies are set, no personal data is stored and nothing is passed on to third parties; the solution is only kept briefly in memory so that it cannot be used twice.

The data is used solely to handle your request. Legal basis: Art. 6(1)(f) GDPR (our interest in handling requests, bug reports and suggestions), and Art. 6(1)(b) GDPR where it concerns your account. We delete messages as soon as they are no longer needed, at the latest after 12 months. If you delete your account, the link to it is removed.

8. Retention

We keep account data until you delete your account. Sessions expire after 30 days. The anonymous statistics totals are kept indefinitely because they are not personal data.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) and to withdraw any consent. In your account you can download your data and permanently delete your account at any time. You may also lodge a complaint with a data protection supervisory authority.

10. Contact

Privacy questions: info@noxsframe.com