Privacy Policy

Effective: 22 August 2026

DSH Studios ("we," "us," or "our") operates the website https://dshstudios.com and the related plugin directory, search, submission, and Pro subscription services (the "Service"). This Privacy Policy explains what data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

DSH Studios is an independent community project. We are not affiliated with, endorsed by, or sponsored by DeepSeek. DeepSeek Harness (DSH) is referenced solely to identify the open-source framework that third-party plugins on this directory target.

1. Information we collect

We collect the minimum data needed to operate the Service.

1.1 Data you give us directly

• GitHub OAuth account profile. When you click "Continue with GitHub," GitHub returns your public user ID, display name, avatar URL, and the email address associated with your GitHub account (only when you granted the email scope). We store these against your DSH Studios account so we can identify your session, surface your favorites and collections to you, and contact you about submission review outcomes.
• Plugin submissions. If you submit a plugin, we store the GitHub repository URL, plugin name, one-line description, category, tags, author/maintainer email, optional website, optional screenshot URL, and optional install instructions you provide.
• Email messages you send us. If you email us for support or to report a listing, we retain those messages to respond and to keep an audit trail of compliance requests.

1.2 Data collected automatically

• Server logs. Our edge network (Cloudflare) records your IP address, user-agent string, request path, response status, and a coarse geographic region (country and city) for each request. Logs are retained for up to 30 days for security and rate-limiting purposes and then deleted.
• Usage telemetry. We use first-party, cookie-light analytics (Plausible Analytics, self-hosted Cloudflare Workers Analytics). These record only the page path, the referring site, the screen size bucket, and the country — they do not record your IP address, do not set any cross-site cookies, and do not build a personal profile. We treat Plausible data as non-personal under the practical interpretation of GDPR.
• Payment data. Payment data is collected and processed by our payment provider and is not stored on DSH Studios servers. The payment provider returns only a non-sensitive subscription identifier, the plan tier, the renewal date, and the last four digits of the payment method, which we store against your account.

1.3 Data received from third parties on your behalf

• GitHub repository metadata. Our scheduled job fetches the public GitHub API for each listed repository and stores the repository name, description, star count, fork count, primary language, license, default branch, last-update timestamp, and social-preview image URL. We do not store GitHub user data beyond the public submitter's GitHub login.
• Repository content excerpts. We store the README HTML of each listed repository together with the SHA, the source URL, and the timestamp of the sync. The screen capture of an installed plugin (if any) and the in-repository screenshots referenced in the README are cached in our object store; each screenshot is rendered with a "Screenshot from repository README" attribution that links back to the original.

2. How we use your data

We use the data above for the following purposes, on the lawful basis of "legitimate interest" (operating a directory service you have asked for) except where another basis is named:

• Operating the directory (legitimate interest). Displaying plugins, search results, categories, and detail pages.
• Account state (contract). Showing you your favorites, your collections, and your submission history.
• Communicating with you (contract / legitimate interest). Sending review outcomes, critical security notices about your submissions, transactional emails (receipts, plan changes), and responses to your support requests. We do not send marketing email; if we add an opt-in newsletter later, we will request explicit consent first.
• Security and abuse prevention (legitimate interest). Rate limiting, bot detection, log analysis to keep the Service available.
• Product improvement (legitimate interest). Aggregated, non-personal usage analytics.

We do not sell personal data. We do not use your favorites, collections, or reading history to target advertising on this Service or on third-party sites.

3. Sharing of your data

We share data only as set out below. We do not share data with advertising networks, data brokers, or social-media platforms for marketing.

• Hosting and infrastructure providers. Cloudflare (CDN, Workers, R2 object storage, D1 database) processes the data needed to operate the Service under a data-processing agreement.
• GitHub. We use the public GitHub API to fetch repository metadata and READMEs. Submissions also flow through GitHub's notification system when you connect your account.
• Payment provider. Stripe (or whichever provider is in effect at the time of checkout) processes payment data. See the payment provider's privacy policy for that handling.
• Email service. Transactional email (submission review outcomes, receipts) is routed through our email provider. We do not send marketing email.
• Legal compliance. If we receive a valid subpoena, court order, or equivalent legal process, we may disclose the minimum data necessary to comply. If we are compelled to disclose a user's identity in connection with a DMCA counter-notice, we will follow the DMCA safe-harbor procedure (see Section 7).
• With your consent. Any other sharing requires your explicit, informed consent at the time of the request.

If we are ever acquired or transfer the Service to another operator, personal data may be transferred under terms no less protective than this Policy; we will notify registered users of any change of controller by email at least 30 days in advance.

4. Cookies and similar technologies

DSH Studios uses cookies minimally.

• Strictly necessary. The session cookie that keeps you logged in (session) and the CSRF token cookie used by the authentication flow. These are required to provide the Service and are not used for tracking.
• No third-party advertising or analytics cookies. We do not deploy Google Analytics cookies, Facebook Pixel, TikTok Pixel, or any other cross-site advertising tracker. The first-party Plausible deployment uses no cookies and no persistent identifiers.
• Preference cookies. If you adjust non-essential preferences (such as a future "compact / comfortable" view toggle), we store that preference locally in your browser (localStorage). We do not transmit it to any third party.

You can clear cookies in your browser at any time; clearing the session cookie will sign you out. Blocking strictly-necessary cookies will break login.

5. Data retention

We keep data only for as long as needed for the purposes described in this Policy or as required by law.

When a plugin is removed from the directory (status: removed), we retain a redirect stub so external links do not break, but the listing body and screenshots are deleted within 30 days of removal.

6. Your rights

You have the following rights. To exercise any of them, contact us through the channels on the Disclaimer page. We will respond within 30 days (15 days for users in the EU/UK, where applicable).

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to correct inaccurate or incomplete data.
• Deletion ("right to be forgotten"). Ask us to delete your account and personal data, subject to the retention rules in Section 5.
• Restriction. Ask us to pause processing while a question is being resolved.
• Portability. Receive your data in a machine-readable JSON export.
• Objection. Object to processing that we base on legitimate interest; we will stop unless we can demonstrate compelling legitimate grounds that override your interests.
• Withdraw consent. Where we rely on consent (for example, an opt-in newsletter), withdraw it at any time without affecting prior processing.
• Lodge a complaint. EU and UK users can lodge a complaint with their supervisory authority. We encourage you to contact us first so we can resolve the issue.

If you are a California resident, you have the additional rights under the CCPA/CPRA: know what categories of personal data we collect, opt out of any "sale" or "sharing" (we do neither), correct, and delete. We do not collect sensitive personal information for inferring characteristics.

7. DMCA notice-and-takedown

If you believe that a listing on DSH Studios contains content that infringes your copyright, send a DMCA notice to the contact on the Disclaimer page that includes:

1. Identification of the copyrighted work claimed to be infringed.
2. Identification of the infringing material and its URL on DSH Studios.
3. Your contact information (name, address, telephone, email).
4. A statement that you have a good-faith belief the use is not authorized.
5. A statement, made under penalty of perjury, that the information is accurate and that you are the copyright owner or authorized to act on the owner's behalf.
6. Your physical or electronic signature.

We will remove or disable access to the allegedly infringing material, notify the submitter, and follow the counter-notice procedure under 17 U.S.C. §512(g). Submitter counter-notices must include the same elements required by the statute.

8. Children

The Service is not directed to children under 13 (or under the age required by local law to give valid consent), and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it within 7 days.

9. Security

We protect data with industry-standard practices: TLS for transport, least-privilege access to D1/R2, scoped service tokens, parameterized queries, daily off-site encrypted backups, and access reviews when team membership changes. No method of storage or transmission is risk-free; we cannot guarantee absolute protection.

If we determine that a security incident has materially affected your personal data, we will notify you by email at the address on your account without unreasonable delay and in any event within the timeline required by applicable law.

10. International transfers

DSH Studios is operated from the United States. By using the Service, you understand that your data may be transferred to, stored in, and processed in the United States and in the European Economic Area by our infrastructure providers. Where required, we use Standard Contractual Clauses or rely on adequacy decisions.

11. Changes to this Policy

We may update this Policy from time to time. The "Effective" date at the top of this page reflects the latest update. For material changes, we will email registered users at least 14 days before the change takes effect. Continued use of the Service after the effective date of a change constitutes acceptance of the updated Policy.