Logging & Data Retention
Last updated: July 30, 2026
Purpose
This page documents what the UCP records automatically. We publish it so players and staff know what is stored, why it is stored, and how it may be used in moderation, security investigations, or legal proceedings.
Audit log
Security-sensitive actions are written to an audit_log table in our database. Each entry typically includes:
- Timestamp — when the event occurred (UTC)
- User ID — linked account when known; null for unknown failed logins
- Action — event type (see table below)
- Metadata — optional JSON with context (e.g. login identifier on failed login, API URL on unauthorized access)
- IP address — derived from the request (via
x-forwarded-forwhen present, otherwise recorded as unknown)
We do not store plain-text passwords in the audit log.
| Action | When it is recorded |
|---|---|
register_success | Successful account registration |
login_success | Successful sign-in (includes account role in metadata) |
login_failed_unknown_user | Failed sign-in — identifier not found (identifier stored in metadata) |
login_failed_bad_password | Failed sign-in — wrong password for a known account |
logout | User signed out |
password_change_success | Password changed successfully |
password_change_failed_bad_current | Password change rejected — current password incorrect |
unauthorized_api_admin | Non-staff user attempted a staff-only API route |
unauthorized_admin_attempt | Non-staff user attempted admin access |
Sessions
When you sign in, a random session ID is stored in the database and set as an HTTP-only cookie (sa_ucp_session). Sessions expire after seven days. Signing out deletes the session record.
Rate limiting
To reduce abuse, we track request counts per IP address and action (for example auth:login, auth:register) in a rate_limits table. This stores a counter and reset time — not full request bodies. Limits include:
- Login: 8 attempts per minute per IP (additional API-level cap applies)
- Registration: 5 attempts per minute per IP
- Password change: 5 attempts per minute per IP
- General API routes: per-route limits as configured
Application and account data
Form data you submit (applications, settings changes) is stored in the database as part of normal UCP operation. Application payloads may include character references, Discord names, forum links, and written answers. Staff with appropriate access can view this data for review.
What we do not log
- Plain-text passwords (only bcrypt hashes are stored)
- Full page browsing history outside API requests handled by the UCP
- Third-party Discord or Google OAuth data (not yet implemented)
Retention
Audit logs and account records are retained for as long as needed for security, moderation, and legal compliance. There is no automatic public deletion schedule. Staff may purge or export records when required by policy or legal process. Account deletion requests are handled case by case — see the Privacy Policy.
Access and disclosure
Authorized staff (owner, admin, staff roles) may query audit logs and account data for legitimate administration. Records may be disclosed to law enforcement or parties in litigation when we are legally compelled to do so or when disclosure is necessary to protect players, staff, or the integrity of the service.
Changes
As we add features (OAuth, new APIs, game-server integration), logging may expand. We will update this page when materially new data is collected. See also our Terms of Service.