Privacy & Cookies
Last updated: 17 July 2026
This policy explains what personal data ModNest (mod-nest.org) collects, why, and the choices you have - including cookies. ModNest is a mod aggregator for Euro Truck Simulator 2, American Truck Simulator, and Farming Simulator. The service is operated from the European Union and we process personal data in line with the GDPR.
1. Who we are
ModNest is an independent project operated from the European Union and is the "data controller" for the personal data described here. For any privacy question or to exercise your rights, contact [email protected].
2. What we collect
- Account data - your email address and a hashed password when you register (or, if you sign in with Google, your Google account ID and email address instead of a password); your email-verification and subscription status.
- Submissions - mods you submit for review (title, description, links, images).
- Technical data - IP address and request logs, kept briefly for security, abuse-prevention, and rate-limiting.
- Cookies - see section 4.
We do not sell your personal data.
3. Why, and our legal basis
- To run your account and subscription - performance of a contract.
- To send account emails (verification, password reset, receipts) - contract / legitimate interest.
- To keep the service secure and prevent abuse - legitimate interest.
- To show advertising that keeps the site free - your consent (which you can withdraw anytime).
4. Cookies
We use a small number of cookies and similar local storage. Strictly necessary cookies are always on (the site can't work without them); functional storage and advertising cookies only load if you accept them.
| Cookie | Purpose | Category |
|---|---|---|
| modnest_sess | Keeps you signed in. | Strictly necessary |
| modnest_theme | Remembers light/dark theme. | Strictly necessary |
| modnest_consent | Remembers your cookie choice. | Strictly necessary |
| modnest_func | Remembers your functional-storage choice. | Functional (consent) |
| modnest_dl (local storage) | Which pack mods you've downloaded, so they show a check. Stays on your device - never sent to us. | Functional (consent) |
| HilltopAds | Ad delivery, frequency capping, and measurement by our ad partner. | Advertising (consent) |
No functional or advertising storage is used until you accept it (via Accept all or the individual toggles). Functional storage lives only in your browser and is never transmitted to us. You can change or withdraw any choice anytime via - withdrawing functional consent deletes the stored data. Pro members see no ads and no advertising cookies at all.
5. Who processes data for us
We share the minimum necessary with providers that help run ModNest:
- HilltopAds - advertising (only after consent).
- AdMaven - advertising (only after consent), alongside HilltopAds. Some AdMaven formats open the advertiser in a new tab.
- Stripe - payment processing for the Pro subscription. Stripe handles your card details, which we never see or store, and works out any tax due on the sale. ModNest is the seller of record, so we hold your billing details (name, billing address, any tax number you provide, and your invoices) for as long as tax and accounting law requires us to keep them.
- Brevo - transactional email delivery.
- Google - only if you choose “Sign in with Google”. Google confirms who you are and tells us your Google account ID and email address; we do not receive your Google password, contacts or anything else. Google’s own privacy policy covers what it does on its side.
- Contabo - hosting. Our server and both databases sit in France (EU); Contabo GmbH is a German company.
- Cloudflare - content delivery, DDoS protection and DNS for mod-nest.org and toll-gate.org, which means Cloudflare processes the connection details (including your IP address) of every request to the site. Cloudflare also provides:
- the bot check on the sign-up and log-in forms (Cloudflare Turnstile), which looks at browser and interaction signals to tell a person from an automated script;
- off-site backups of our database (Cloudflare R2), which include account records;
- email routing for our contact address.
Download links are routed through toll-gate.org, an interstitial gateway we run ourselves on the same server - it is not a third party. It records the country and a coarse device class for each click so we can measure traffic; it does not store your IP address against those records.
Our hosting, email, payment and infrastructure providers act as data processors: they handle data on our instructions and under a data processing agreement with us. HilltopAds is different - an advertising network determines its own purposes for what it collects, so it is not acting solely on our instructions. That is why nothing reaches it until you consent, and why Pro members never load it at all. Some providers may process data outside the EU under appropriate safeguards (e.g. Standard Contractual Clauses).
6. How long we keep it
Account data is kept while your account is active and deleted (or anonymised) on request or a reasonable period after closure. Security logs are kept only briefly. Consent choices last up to 6 months, after which we ask again.
7. Your rights
Under the GDPR you may request access, correction, deletion, restriction, or portability of your data, and you may object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it anytime without affecting prior processing. Email [email protected]. You also have the right to complain to your local supervisory authority (in Romania, the ANSPDCP).
8. Changes
We'll update this page if our practices change and revise the date above. Material changes affecting advertising consent will prompt the cookie banner again.