Privacy

Files you scan on the website

The file itself, its name, size, hashes and the report we make from it. If you are signed in, the scan is linked to your account. If you are not, we store a keyed hash of your IP address with it, never the address itself. We use it to stop floods and to count people instead of requests.

We keep the files because they are how we test and improve detection.

Signing in

Sign in uses Discord with the identify scope only. We store your Discord id, name and avatar. We never see your email, your password or your servers. We store only a hash of each API key you create.

The Windows app

When the app first starts it registers with a random install id. We store that id, the app version, your Windows version, a keyed hash of your IP address and when the app was last seen.

The app checks mods by their SHA-256 hash. A mod we have never seen before is sent to us with its file name and handled like a website upload. Jars outside your mod folders that are not mods are only checked by hash and never sent.

Your history, quarantine, settings and folder paths stay on your PC. Signing in to the app is optional and only links the install to your account.

The Discord bot

When you use /scan, the bot downloads the jars you attached and sends them with their file names to ratscanner.org, where they are handled like website uploads. Your Discord id is not sent with them. The bot keeps the time of your last scan in memory to stop spam, and forgets it when it restarts.

The bot reads messages only to see if one is exactly $$count. It does not store, log or share message content, and nothing is used to train AI.

The name, hash and report of a jar can be seen by anyone who looks that jar up. Who scanned it cannot.

If you scan while signed in, your Discord name, avatar and id can show on the leaderboard with how many jars you scanned.

Members of our Discord server who have a plan role are listed with their Discord name, avatar and id on the supporters page. To do this the bot reads the member list of our own server only, never any other server it is in.

Cloudflare sits in front of the website, so it handles every request, including your IP address.

Discord handles sign in. Stored jars are also kept in a private Discord channel that only our bot posts to, and new uploads are posted to a private channel for our staff.

Modrinth gets the SHA-512 hash of a jar we scanned, so we can see whether it is the exact file published there. Only the hash is sent, never the file.

VirusTotal only gets a hash or a file when you press its button on a report. Uploading a file there shares it with antivirus companies, so that is a separate button.

Scans run on servers we control. We do not sell data, show ads or use trackers or analytics.

Uploaded jars and their reports are kept until someone asks us to remove them.

Sign in sessions last 30 days. Our web server's access logs include IP addresses and are deleted after 14 days.

Accounts and app installs are kept until you ask us to remove them.

Ask on our Discord to remove an upload, your account, your app install or your name from the supporters page, and we will do it by hand. You can sign out any time, and you can scan on the website without an account.

The website uses one cookie to keep you signed in, and two short ones that last 10 minutes while you sign in. Your last scan result is kept in your browser tab so a refresh doesn't lose it. There is nothing else.

Signing in uses Discord, which requires you to be at least 13.

If this page changes, the date at the top changes too. Questions go to discord.gg/ZuNycY2Hhh.