Skip to content

Privacy Policy

Last updated: 23 October 2026, when all the adverts moved to Monetag

modsdrop.com is a small file host for video game mods. It is run by one person in Hungary, not by a company. This page says what happens to your data when you visit. Everything below describes what the site actually does today, not what a template says it might do. The site now has accounts, so this page has been rewritten to cover them.

The short version

Who is responsible for your data

The data controller is Máté Geszti (CrashMozi), a private individual (this is not a company), XVII. utca 4., 5400 Mezőtúr, Hungary. E-mail: [email protected].

No data protection officer has been appointed. Requests go straight to the person who runs the site, at the e-mail address above.

What is collected, why, and the legal basis

1. Web server logs. Requests that reach the server are written to a log line by the web server (nginx). Each line holds your IP address, the date and time, the page or file you asked for, the user agent string your browser sends, and how many bytes were sent back. Nothing else. The logs are rotated and deleted automatically after 14 days. Cloudflare answers some requests from its own cache, so those never reach this log — but Cloudflare keeps logs of its own, under its own policy. Legal basis: legitimate interests, Article 6(1)(f) GDPR — keeping the site running, finding faults, and spotting abuse such as scripted mass downloading.

2. Downloads, rate limits and the download counter. When you click Download, the server sends you the file. No account is needed for any of this, and nothing on that path changed when accounts arrived. To stop abuse and to count each download once, the site stores short-lived markers in its own database (WordPress transients, on the same server). Those markers are keyed by a salted hash: your IPv4 address, or the first half (the /64) of an IPv6 address, is put through a hash together with a secret site salt, and only the result is stored. The address itself is not in them, and they expire by themselves within the hour. The counter that comes out of this is a number on the file page. Because authors can be paid by the download, each download also leaves one row, so that a figure that looks too good can be checked: the file, the time, a salted marker of the address and one of the browser’s user-agent string, and whether it counted (a robot, an author fetching their own file, or more than 25 downloads from one address in a day do not). The row is never linked to your account, holds no address, and is deleted automatically after 30 days. Legal basis: legitimate interests, Article 6(1)(f) — keeping the server standing up under load, keeping the download numbers honest, and making sure authors are paid only for real downloads.

3. Download statistics. Every download is counted once per network per file per hour, exactly as point 2 describes. Alongside that count the site records three things about the request, and only as a total: the country Cloudflare reports for the network the request came from; the address of the site you arrived from, if it was another website — the host name only, never the full address, and never this site itself; and whether the device was a phone, a tablet or a computer, read from the user agent string your browser already sends. These are added to a running total per file per day. In these per-file totals there is no row per visitor, no cookie and no identifier: two downloads by the same person cannot be told apart from two downloads by two people. The visitor statistics described in point 3b are a separate thing and do keep a row per visitor per day. The figures exist so that whoever uploaded a file can see how it is doing. Legal basis: legitimate interests, Article 6(1)(f) GDPR — knowing which files are used and where the site’s visitors come from. Once written, these totals identify nobody and are statistics rather than personal data; the request they were counted from is covered by point 1.

3b. Visitor statistics: views, visitors, and who is on the site now. Since 22 September 2026 the site counts its own page views rather than leaving that to somebody else. When a page has loaded, your browser sends one small message back to this site — no cookie, no third party, nothing stored on your device. From it the site keeps one row per visitor per day, holding: a salted marker of your network address (the address put through a hash with a secret site salt), the IP address itself as Cloudflare passes it on, the country Cloudflare reports, the title of the page you were last on, how many pages you looked at, how many files you downloaded, and when you were first and last seen. If you are signed in, the row also carries your account. The operator uses it to see how many people are on the site, where they came from, and who is downloading; it is shown to nobody else and sent nowhere. The address itself is blanked 7 days later, the whole row is deleted after 30 days, and what survives is a daily total — views, visitors, downloads — that identifies nobody. Robots, and the operator’s own browsing, are not counted at all. Legal basis: legitimate interests, Article 6(1)(f) GDPR — knowing how the site is used, and spotting abuse such as one machine pulling files in bulk.

4. Reports, contact messages and copyright notices. If you use the report button on a file page or the contact form — including to send a notice about illegal content or copyright — the site stores the reason you picked, the text you wrote, your e-mail address if you gave one, and the IP address the message came from. Without an address there is nothing to reply to, so a report sent without one gets no reply. Messages are stored as private posts in the site’s WordPress installation on the same server, and are also sent on to the operator by e-mail. Please do not put sensitive personal details into the message box; only enough to understand the problem is needed. Legal basis: legitimate interests, Article 6(1)(f), for reading and answering your message; and, for notices about illegal content or copyright, a legal obligation, Article 6(1)(c), because the EU Digital Services Act (Regulation (EU) 2022/2065) requires a hosting service to act on such notices.

5. Your account, if you make one. Accounts are for mod authors. You do not need one to download, and nothing on the download path changed when accounts arrived. Signing up at /register/ asks for a name (3 to 30 characters: letters, numbers, dot, dash or underscore), an e-mail address, and a password of at least ten characters. You have to tick that you accept the terms and this privacy policy. The form also carries a hidden honeypot field, which a real person never sees and never fills in.

WordPress stores your name, your e-mail address, a hashed password (never the password itself), the date you registered, a display name, and the “subscriber” role. On top of that, this site stores whether your address has been confirmed, how many confirmation mails have been sent to you, a salted hash of the IP address you signed up from (not the address itself), and, if you signed in with Google, the identifier Google uses for your account.

WordPress also records, for each login session, the session token, the IP address of that login, and the user agent string of the browser you logged in with. These sit in your account’s session data. That is WordPress core behaviour rather than something I added, but it is true, so it is written here rather than left out.

The address has to be confirmed before the account can be logged into. You confirm it by opening the link in the mail, and that link is good for 48 hours. At most four confirmation mails are sent per account, one per ten minutes. The other limits are counted per network rather than per person: three sign-ups an hour and ten a day, ten log-in attempts per fifteen minutes per network and ten per account, three password-reset requests an hour, and three confirmation resends an hour.

You can change your password on /account/. You can change your e-mail address there as well: the new address has to open a confirmation link before it takes effect, and the old one is told that it happened. Members cannot reach the WordPress admin area; a member who goes looking for it lands on /account/ instead. An account holds the details above, your files if you upload (point 7), your balance, and the payout details and requests described under point 8. There are no premium tiers or API keys.

Legal basis. For your name, e-mail address, hashed password, registration date, display name, role and Google identifier: contract, Article 6(1)(b) GDPR — these are what the account is, and you asked for the account. For the confirmation state, the count of confirmation mails sent, the salted hash of the sign-up IP address, the rate limits above, and the session records WordPress keeps: legitimate interests, Article 6(1)(f) — checking the address is real, keeping other people out of your account, and stopping mass sign-ups by script.

How long. An account that is never confirmed is deleted automatically seven days after it was made, by a job that runs once a day. A confirmed account is kept until you delete it. You do that yourself: sign in, open Settings → Your data, and the button there deletes the account, your settings, your payout details and every file you uploaded, immediately and for good. If there is money on the account — a balance, money on hold, or past payouts — the button records the request instead, and a person completes it within 30 days, so that the payments can be settled first. The same screen hands you a copy of everything first, as a file, without asking anybody.

5. Signing in with Google. The sign-in page at /login/ offers Google as an alternative to a password. If you use it, the site receives your e-mail address, your Google display name, and the identifier Google uses for your account. That is all it receives. ModsDrop never sees your Google password. What you are shown and asked at that step is Google’s own consent screen, governed by Google’s own privacy policy, and it is outside my hands. Legal basis: contract, Article 6(1)(b) — creating your account and signing you in.

6. The operator’s own login. I sign in to WordPress to run the site, which sets the same kind of login cookies for me.

7. Files you upload. A file you upload is stored with your account: the file itself, the name and description you give it, its size, a SHA-256 fingerprint and its VirusTotal result. To be checked, the file is sent to VirusTotal (part of Google), which keeps it and may share it with security researchers — so do not upload anything private. The fingerprint of a file taken down for a rights complaint, a breach of the rules or malware is kept after the file is gone, so that the same file cannot be published again; that list holds fingerprints and file names, not people. Files carried over from crashmods.com may have a VirusTotal result stored alongside them, and the file page shows which state each one is in.

Cookies and analytics

If you are not signed in, the site itself sets one cookie, md_consent2, and only once you answer the cookie question (see below); what Google Analytics does is the next paragraph. If you sign in, WordPress sets its login cookies so that the next page knows it is still you. There is no way to offer accounts without them; they are strictly necessary for a service you asked for, so they do not need your consent.

Google Analytics 4 runs on this site, added through Google’s Site Kit plugin in September 2026. Here is exactly what that means, because the honest version is more useful than a reassuring one.

When you open a page, your browser fetches Google’s measurement script from googletagmanager.com. That request on its own tells Google your IP address and which page you are on. What happens next depends on where you are. In the countries of the EEA, the United Kingdom and Switzerland the script is started in consent mode, set to deny storage: it stores nothing on your device, reads nothing back, and sends Google an anonymous signal rather than a visit tied to a browser. That is the state it stays in until you say yes to the site’s cookie question. Outside those countries the script behaves as Google ships it and does set its own cookies.

Signed-in members are not measured at all — the script is not placed on the page for them. There is no social media button that phones home and no fingerprinting. The advert is described under “Adverts”. What Google does with what it receives is governed by Google’s own terms, not by this page.

One exception is outside my hands: Cloudflare sits in front of the site to keep it fast and to absorb attacks, and if it decides a request looks automated it may set a strictly necessary security cookie of its own to remember that the check was passed. That is a security function rather than tracking, and it is not something this site reads.

The site asks once whether Google Analytics and the adverts may store anything, and keeps your answer for six months in its own cookie, md_consent2. In the EEA, the United Kingdom and Switzerland no advert loads until you say yes; elsewhere the adverts run and the question is about Analytics. You can change your answer at any time with the “Cookie settings” link at the bottom of the page. Apart from that, and from the md-pop time described under “Adverts”, this site stores nothing on your device.

Adverts

Since 7 October 2026 modsdrop.com shows adverts from an advertising network; since 23 October 2026 that network is Monetag, for every advert on the site. They take four forms, all on file pages only: a small notification-style box, a full-screen banner with a close button, browser notifications if you allow them, and one advert that opens in a new tab on the first press of the download flow.

On the page. File pages carry a small notification-style box that floats in a corner of the screen and can be closed, and a full-screen banner with a close (×) button that may appear after a tap or click; the second step of the download, the “Your file is ready” page, carries the same. They are loaded from Monetag’s servers, which receive your IP address and browser details the way any website does and may set their own cookies. What is advertised is chosen by Monetag and its advertisers, not by this site, and they do not carry the file’s code. In the EEA, the United Kingdom and Switzerland nothing of this, and not the download advert below either, loads until you say yes to cookies.

Browser notifications. A file page may ask whether this site can send you notifications. If you allow it, Monetag sends advertising notifications to your browser through a small script this site installs for that purpose (/sw.js), including when you are not on the site. You can withdraw that at any time in your browser’s site settings, under Notifications, and the script then sends nothing. If you refuse, nothing is installed.

The download advert. The first time you press Generate link or Download on a file page, an advert from Monetag opens in a new tab, and your download carries on in the page you were on. It does not open again for the same file for six hours (another file can open it): your browser keeps the time of that press, file by file, in its own local storage for this site, under md-pop, which is not a cookie and is never sent to this site or to anyone else. The advert carries the file’s code (the part after /f/ in its address), so that Monetag can report what each file’s page earned — that is the figure an uploader’s share is worked out from. It carries nothing else from this site: no account, and no cookie of ours. It never opens for signed-in Premium members, for staff, or for an uploader looking at their own file. No box of this site imitates a download button, and nothing stops or delays the file. What happens in the new tab is between your browser and Monetag, under Monetag’s privacy policy, not this page. Closing the tab is enough to leave it.

The Google AdSense code that was loaded on every page from 24 September 2026 has been removed.

Who else sees your data

Hetzner, Cloudflare and Brevo act as processors under their standard data processing terms; they may use the data only to provide their service to this site. Google, at the sign-in step, acts as its own controller under its own privacy policy. Nobody buys data here, because none is sold.

Transfers outside the EU

The servers, the files, the site database and therefore the accounts are in Germany. Brevo processes within the EU. Cloudflare, however, is a US company running a worldwide network, so a request of yours may be handled by one of its data centres outside the EU or EEA. If you sign in with Google, that exchange is with Google, also a US company. Those transfers rest on the European Commission’s standard contractual clauses and, where the provider is certified, on the EU–US Data Privacy Framework. You can ask at [email protected] for details of the safeguards in place.

How long things are kept

Your rights

Under the GDPR you may ask me to:

Nothing here makes an automated decision about you that produces legal effects or similarly significant effects, and there is no profiling. The rate limits described above are automatic, but they only slow down or refuse a request; they do not build a picture of you.

To use any of these rights, e-mail [email protected], or write through /contact/ if it concerns your account. One honest warning about access and deletion requests from visitors without an account: the log lines and rate-limit markers hold nothing that identifies you by name, so unless you can tell me the IP address and roughly when you visited, your records genuinely cannot be found — and I will not ask you for extra identity documents just to create a link that does not exist (Article 11 GDPR). For an account it is simpler, because the account is tied to a confirmed e-mail address.

Complaining to the authority

If you think your data has been handled badly, please write to me first — it is usually faster. You also have the right to complain to the Hungarian supervisory authority:

If you live in another EU or EEA country, you may complain to your own national data protection authority instead. You can also take the matter to a court.

Security

Passwords are stored by WordPress as hashes and never as text, and a password must be at least ten characters. An account cannot be logged into until its e-mail address has been confirmed, and one that is never confirmed is deleted after seven days. Sign-ups, sign-in attempts, password-reset requests and confirmation resends are all rate-limited, counted per network. The sign-up form carries a honeypot field for scripts. Members have no access to the WordPress admin area. Where the site needs to recognise a visitor for a rate limit or a download count, it keeps a salted hash rather than the IP address itself.

That is the list, and I am not going to pad it out. No system is perfect, and the moving parts here are kept few on purpose.

Children

This site is not aimed at young children and does not knowingly collect data from them. You do not need an account to download anything. There is now a sign-up form, and I will be straight about it: there is no age check anywhere on this site, and no minimum age is stated or enforced. Signing up asks for a name, an e-mail address and a password, and nothing is done to establish who is behind them. If you believe a child’s personal data has arrived here, through a message or through an account, tell me at [email protected] and it will be deleted.

Changes to this policy

The site is new and still being built, so this page changes when the site does. Accounts arriving is what prompted this version. The date at the top shows when it last changed. There is no mailing list and no announcement banner, so checking that date is the only way to tell.