Last updated: 2026-10-14.
This English version is the binding one; the Japanese, Chinese and Korean translations are for convenience.
Who runs this
soku.cleista.cc ("the site") and the Soku Discord bot are run by one person, Cleista, as an unofficial, non-commercial fan project for the Touhou Hisoutensoku community. There are no ads, and no data collected is sold.
This policy covers the site, its sign-in, and the Discord bot: the application that posts the hostlist in the Soku Discord server and answers its slash commands. Questions and requests about your data can be sent to cleista.celeste (at) gmail.com
TL;DR Data usage
- Public netplay matches from the public hostlist are spectated and recorded with in-game profile names, characters, decks and results
- Your IP address and port are listed publicly when you /host in Discord, because that is how people connect to you. This information is no longer displayed after someone joins your host.
- Accounts are optional, and the site is mostly functional without one unless you need account-specific features.
- Your Discord id, name and avatar and the email address you sign in with (if you use that) are stored for the purposes of making the account system work.
- The site serves no ads, has no analytics or tracking scripts, does not sell or share your data beyond what is publicly displayed here, and does not use it to train AI.
- The bot does not proactively read message content. Message content is read for administration purposes in a limited number of channels (e.g. #soku-palettes) to auto-import the palettes, for user administration purposes (transferring hisocoins from Discord to the server), or for the planned beginner ranking system (which requires it to read which members of #hisouten hold the beginner roles).
What we collect and why
Each item says what is kept, why, and who can see it.
- Discord sign-in. Your Discord user id, display name, avatar and, when Discord marks it verified, your email address; we ask Discord for the identify and email permissions only. The token Discord gives us is used once to read your profile and then discarded: we store no Discord token. Your display name, handle and avatar are public on your profile; your email address is shown only to you.
- Email sign-in. Your email address, and a one-time code and link sent through Resend, which we store only as hashes. They expire after 15 minutes and are deleted an hour later. A new email account starts with the part of the address before the @ as its display name, which is public; you can change it.
- Sessions. A random session id in a cookie, stored on our side as a hash with your account and an expiry (90 days, renewed while you use the site). We do not store your IP address or browser with it.
- IP addresses. Our server sees your IP address, which is how the internet works. The site does not keep a log of requests; the web server keeps its standard access log on the host, and the site is served through Cloudflare for performance reasons (see Third parties) which means Cloudflare's policies apply. The server will block suspicious traffic, which may result in false positives - appeal via Discord.
- Hosting a game. When you publish a host, from the game or with the bot's /host, the hostlist stores and lists publicly your profile name, message, IP address and port, as the hostlist protocol requires, and the bot reposts it in the #hisouten Discord server. Our server checks that the host can be reached and may join the match as a spectator. For the country flags, the addresses of the host and their opponent are looked up with ipwho.is, and the country is kept with the address. With the bot's /optout you can keep your address out of the Discord repost, or leave the list.
- Matches and replays. We record public matches from the hostlist as replays (the game's inputs, not video): in-game profile names, characters, decks, results, times, country flags and the room chat sent during the match. We also mirror the public archive of SokuReplays, without its users' addresses. For a replay you upload we keep what you enter; who uploaded it, and the file's name and date, are stored privately and never shown. Replays are public.
- What you post. Live chat (public; linked to your account when you chat under its display name), comments, profile text, links and media, avatars and banners, palettes, decks, savestates, playlists, follows, clips, practice trials, Boxdle results and uploaded packs. Public items are visible to everyone; private ones only to you and the admins. Images and videos uploaded to profiles have their metadata removed.
- Hisocoins and predictions. The hisocoin ledger (what you earned, spent, gave and bought) and your predictions on matches. Your balance and the prediction history (by handle) are public. So that bots cannot farm coins, pages you watch while signed in send short activity summaries: counts and timings of key presses, clicks and mouse movement, never what was typed or where you clicked. These are kept for 14 days and only admins can see them.
- Claims. The in-game names you claim as yours, and the replays you mark "not me". A claim links the replays under that name to your profile and stats. Claimed names are public on your profile; the "not me" list is seen only by you. When our bot published the host of a match, we keep that host's Discord id with the replay to verify claims; it is never shown.
- Ratings and stats. Ratings, records and statistics computed from public matches and your claims. You can see your own; the full leaderboard is admin-only for now. A beginner-only bracket is planned, using the Discord roles described under The Discord bot.
- Moderation and audit. Admin actions (moderation, grants, corrections) are logged with who did them and what changed. Edited and deleted comments keep their earlier text for moderation, and reports you file are kept. Only admins see these.
The Discord bot
The bot works only through slash commands, buttons and forms. What it handles:
- Commands. /setip and /host save your Discord id with the address and port you give. /wait keeps your message for two hours. /link, /profile, /balance, /replays, /follow and /hisocoin pass your Discord id (and, for /link, your username) to the site to act on your linked account. /room, in the Relink server, reads the screenshot you attach with text recognition on our own server and then deletes it. /verify, in the pjsk.cleista.cc server, asks the pjsk site whether your Discord account is verified there and gives you a role.
- Hostlist reposts. Every few seconds the bot posts the current hostlist in the Soku server's #soku-hostlist: player names, flags and messages, the avatars of hosts it published, and hosts' addresses unless they opted out.
- Beginner roles (planned). For a beginner-only rating bracket, the bot will read, in the Soku server only, which members hold the roles Beginner [0-3 months], Beginner [3-6 months], Beginner [6-9 months], Beginner (temp), Graduate and Graduate 2026, and when that changed. This uses Discord's Server Members Intent. We keep it only for members whose Discord id matches a site account they linked themselves, and only those roles and their dates; nothing about other members is stored.
- Bot storage. A small file on our server with Discord ids and the addresses saved with them, /wait entries, the in-game names of hosts the bot published, and the ids of its own messages. The server's system log records some actions with a Discord id. The bot keeps no copy of messages.
What the bot does not do:
- It does not actively read or store message content. The Message Content intent is used for limited administrative purposes only in servers that I own or is an administrator of.
- It does not read presence (online status or activity), and keeps nothing about members beyond what is listed above.
- It does not sell or share Discord data, or use it for advertising.
- It does not use Discord data to train AI or machine-learning models.
Cookies and browser storage
The site sets only the cookies it needs to work. None are for advertising or tracking:
- soku_sess keeps you signed in (90 days, renewed while you use the site).
- soku_oauth_state and __Host-soku_csrf protect sign-in and forms (ten minutes, and until you close the browser).
- soku_lang remembers the language you picked (one year).
- Browser storage (localStorage, sessionStorage, IndexedDB) holds your settings for the site and the replay player, practice setups and trials, and game data read from your own files, which stays in your browser unless you upload it; plus edit keys for replays you uploaded while signed out.
You can clear all of this in your browser at any time; you will be signed out and lose those settings.
Third parties
These services help run the site and see the data described. We do not sell data, or give it to anyone else.
- Discord: sign-in, the bot, and avatars (which we copy and serve from our own server).
- Cloudflare: all traffic to the site passes through its proxy and CDN, which sees your IP address and requests. Game files and approved packs are served from its R2 storage.
- Hetzner: hosts our server, where the database, replays and logs are kept.
- Resend: sends the sign-in emails, so it receives your email address.
- ipwho.is: looks up the country of hosting players' IP addresses, for the flags.
- Konni and SokuReplays: we read their public hostlist and replay archive. We send them nothing about you.
- YouTube: rooms that play a playlist load YouTube's player, so your browser connects to YouTube.
Our data is stored on our server at Hetzner. Discord, Cloudflare and Resend may process it in other countries, including the United States.
How long we keep it
- Sign-in codes: about an hour. Sessions: until you sign out or 90 days without use. Rate-limit records: 24 hours.
- Hisocoin activity summaries: 14 days. Notifications: 90 days, at most 200.
- Your account, profile, posts, claims, hisocoins and predictions: while your account exists. Deleted comments, palettes and savestates are hidden at once, but their text or files are kept for moderation unless you ask us to erase them.
- Replays, their chat and the room chat logs: kept as an archive of public matches, with no set end.
- Hosting: a listing lasts while you host. The country found for an address, and the addresses saved with the bot, are kept until you ask us to remove them.
- Server logs: rotated by the server's standard log rotation, not kept as an archive.
- Beginner role data: while your Discord account is linked to a site account; removed when you hold none of the roles, or your account is deleted, or you ask.
Your choices and rights
You can do these yourself: edit or remove your profile text, media and links; delete your comments, palettes, savestates, decks, playlists, packs and follows; release claims and mark replays "not me"; hide your country flag; and keep your address out of the Discord repost with the bot's /optout.
For anything else, write to the admin email at the top of this page from the email address or Discord account linked to your account, so we can tell it is you. There is no automatic account deletion or download yet: the operator handles each request by hand, normally within 30 days. You can ask to:
- get a copy of the data we hold about you;
- delete your account and the data tied to it, or particular items, such as a chat line, a replay you uploaded or a deleted comment's text;
- remove a linked Discord or email sign-in, your beginner role data, or an address saved with the bot;
- stop showing matches under your in-game name, or correct something that is wrong.
Deleting an account removes your profile, sign-ins, claims, posts and hisocoins. Public matches you played stay in the archive under your in-game name unless you also ask for them to be removed or anonymized. If you live in the EU, the UK or somewhere with similar laws, you can also complain to your data protection authority.
Children
You must be old enough to use Discord (13, or older where your country requires it) to sign in or use the bot. The site is not meant for younger children; if we learn an account belongs to one, we will delete it to comply with regulations.
Security
The site is served only over HTTPS. Sign-in links, codes and session ids are stored only as hashes; there are no passwords, and no Discord tokens are kept. The server, its database and the bot's token are accessible only to the operator. No system is perfectly safe: if a breach affects your data, we will say so on the site.
Changes
When what we collect changes, this page and the date at the top change with it. For important changes we also post a notice on the site or in the #hisouten Discord server.