Privacy policy

AshForge is a free set of modding tools for Ascent of Ashes, made and run by The AshForge Team ("we"). There are no accounts, no ads and no telemetry. This page explains everything that leaves your computer when you use AshForge, what we keep, and why.

Last updated October 2, 2026

The short version

• The AshForge apps don't send your files, mods, saves, settings or usage data anywhere, unless you tell one to (for example, uploading a mod to a server you set up yourself).
• Like any app that updates itself, they contact our servers to check for updates and download things. Those requests show us your IP address, your country and which app is asking.
• We use that to count downloads and active installs. IP addresses are kept for 90 days, then replaced with a scrambled code.
• Our website uses Cloudflare's cookie-free page-view counting. There are no ads and no advertising trackers.
• We don't sell your information or use it for advertising.

What the apps send

Each request below is a plain web request over an encrypted connection (HTTPS). None carries an account, an install ID or a machine ID, because the apps have none.

• Update checks: when an app starts, it asks updates.ashforge.dev whether a newer version exists. The request names the app and may include its version and your operating system; the Hub also says whether it is a stable or beta build.
• Downloads: installers, tools, updates and the mods you choose come from updates.ashforge.dev and ashforge.dev.
• Mod safety list: before the game launches, the Hub downloads a public list of mods that have been withdrawn for safety reasons, so it can switch them off.
• Mod catalog: the Mod Manager downloads the public list of mods to check yours for updates. The comparison happens on your computer; your list of installed mods is never sent.
• Connection check: if you run Diagnostics, it asks our server which IP address and country it sees you from, to help spot network problems.

A Diagnostics report stays on your computer until you copy or save it. It can include your Windows user name, folder paths and installed mods, so check it before pasting it anywhere public.

What our servers see and keep

Our website and download server run on Cloudflare. For each request, Cloudflare records the IP address it came from, the country, the page or file, and the browser or app name. We can see these logs for about a week. How Cloudflare itself handles them is covered by Cloudflare's privacy policy.

To know whether people really use AshForge, we copy the download and update-check part of those logs into our own records: date, file, country, IP address and app name. We keep IP addresses for 90 days. After that, each address is replaced with a scrambled code. The code only lets us recognise the same machine again, so our counts stay accurate. It can't be turned back into your address without a secret key that never leaves our stats computer.

During those 90 days, to tell real people apart from data centers and bots, we send some of these addresses to ip-api.com, which tells us who runs the network (for example, a home internet provider or a cloud host). After 90 days we keep only the network's type (home, mobile, VPN or data center), not its name. We don't look up people who only browse the website.

We use these records only to count downloads and active installs, filter out bots, and find broken download links.

The website

• Page-view counting: Cloudflare Web Analytics counts visits to our pages. Cloudflare says it uses no cookies or browser storage and doesn't fingerprint visitors. There are no ads and no advertising trackers.
• Your browser's storage keeps your mod cart and your tutorial progress. It never leaves your browser, and clearing your browser data removes it.
• Comments on mod pages are provided by giscus and stored on GitHub. When a mod page loads, the comment box loads from giscus.app, so giscus and GitHub can see your IP address; posting needs a GitHub account. GitHub's privacy statement applies.
• Videos: the FAQ page embeds a YouTube video in YouTube's privacy-enhanced mode. When it loads, YouTube (Google) can see your IP address; Google's privacy policy applies.
• Beta testers who enter the beta password get a sign-in cookie that expires after 12 hours. It's the only cookie we set ourselves.

Bug reports, mod submissions and Discord

Bug reports, feature requests and mod submissions happen in public GitHub issues, and our community is on Discord. What you post there is visible to others and covered by GitHub's and Discord's own policies. When you submit a mod from Depot, it opens a pre-filled GitHub issue with the details you entered; you attach the files yourself.

Who we share it with

We don't sell or rent your information, and we don't share our records with anyone. The only other companies involved are the services named above: Cloudflare (hosting and page-view counting), ip-api.com (network lookups), and GitHub, Discord and YouTube when you use them.

Where it's kept and how it's protected

Cloudflare serves AshForge from its worldwide network. Our own records are kept on a private computer in the United States: never in a public code repository, and with the scrambling key stored separately from them. Downloads and update checks use encrypted connections.

Your rights

You can ask us what we hold about your IP address, ask us to delete it, or object to how we use it. Email [email protected] with the address. We don't know names, so an IP address is the only way we can find your records, and records older than 90 days can no longer be matched to one. If you are in the EU or UK, we rely on our legitimate interest in running, securing and measuring a free service, and you can complain to your local data protection authority.

Children

AshForge isn't aimed at children under 13, and we don't knowingly collect anything about them.

Changes and contact

If this policy changes, we'll update this page and the date at the top. Privacy questions: [email protected]. Everything else: our issue tracker or Discord. See also our terms of use.