Privacy Policy

Yeepabase is operated by the community. It is not affiliated with, endorsed by, or run by Trass Games. Yeeps is their game. This is an unofficial scoreboard for it.

When you create a Yeepabase account, the database holds:

• Email address. Used to identify your account and let you sign in. It is stored encrypted, alongside a one-way fingerprint of it so two people cannot claim the same address.
• Display name. Shown on your profile.
• Password hash. Never the password itself. Hashed, and not reversible.
• Google account ID, only if you chose to sign in with Google. Never your Google password.
• Discord ID, username, and avatar, only if you linked Discord. Your Discord link is shown on your player profile and anyone can click through to it.
• Account created and last login timestamps, for basic housekeeping.

Nothing here is collected until you link your own Yeeps player, and linking requires the mobile code that Yeeps shows only to the owner of that account. That code is the consent step. Without it, a player cannot be added.

• Yeeps username, display name, and Meta username, to identify the player on the roster.
• Mobile code, kept so stats can be pulled again later. It is a credential, not a stat, so it is never shown in full anywhere on the site or in the JSON API. Only the last 3 characters are ever displayed.
• Account ID and mobile password returned by the Yeeps API, stored server-side so refreshing your stats does not need your code again. Never displayed, never returned by the API.
• Public stats: coins, beans, sessions, pets, items, stashes found, community worlds, cosmetics worn, join date, and public role.
• Outfit: equipped cosmetics, plus skin and eye colour.
• Purchases, meaning which bundles and paid unlocks you own. No real payment amount is stored or reported by the Yeeps API. The profile shows an estimated spend worked out only from the public store price of a bundle ($29.99 each), and paid unlocks are not counted. It is an estimate from a public price, not a record of what anyone actually paid.
• Timestamps: when you were added, and when your stats were last pulled.

Profile customisation is optional and entirely yours to fill in or leave empty. All of it is public, because it appears on your player page.

• Bio text you write.
• Links you paste, including a music track if you add one.
• Theme choices: your accent colour and background.
• Favourites: the pet, card, and gadget you pick from a fixed list. The Yeeps API does not report these, so they are your choices rather than game data.
• An uploaded avatar or banner, if you replace the default. Images and short GIFs are held in the database. Video banners are stored with Vercel, our host, and served from their storage domain rather than from this site.
• Likes. Liking a profile records that your account liked that player, so the count is accurate and you cannot like twice. Players see the total, not a list of who.

If you connect the widget, we send your public Yeeps stats to Discord so they can appear on your Discord profile. We store when you connected, whether the last send worked, and the error Discord returned if it did not, so the widget page can tell you the truth about it.

Only stats that are already public on your roster entry are sent. Your email, credentials and mobile code are never part of it. Disconnecting stops future sends. What Discord does with data on its own platform is covered by Discord's privacy policy, not this one.

The Yeeps API returns more than the site keeps. These fields are read past on purpose, and never written to the database or shown to anyone:

• Moderation state: ban status, mute status, remaining ban hours, ban and warning reasons, pending warnings.
• Internal segmentation and analytics keys.
• Session and access tokens returned alongside your account data.
• Community world join codes. Worlds you own, staff, or hold VIP in are only ever counted, never named. Publishing the codes would let anyone into those worlds.

A community stats page has no business holding any of that.

Two things are logged to stop abuse rather than to learn anything about you:

• Failed login attempts, recorded against the email address tried and the IP address it came from, so passwords cannot be guessed at speed.
• Rate-limit counters for actions like signing up or refreshing stats, keyed to your account or your IP address.

These are the only place an IP address is kept, they are never shown publicly or exposed through the API, and old rows are cleared out as they age. There is no analytics product here, no advertising network, and nothing that follows you to other sites.

Your roster entry, stats, outfit, purchases, and anything you added to your profile are public. That is the point of a scoreboard, and you opted in by linking. Your email address, password hash, Google ID, Discord ID, mobile code, and API credentials are never public. They are not shown anywhere on the site and not exposed through the JSON API, and your email, mobile code, account ID, and mobile password are kept encrypted, so they are not readable in the database itself.

The site runs on Vercel and the database is hosted by Supabase, so both hold the data on our behalf. Video banners are stored in Vercel's file storage. Signing in with Google or Discord sends you to them and back, and the widget sends stats to Discord if you turn it on. Stats themselves come from Trass Games' own Yeeps API. Each of those companies has its own privacy policy covering what it does on its side.

This site sets cookies only to run itself. There is no advertising cookie, no analytics cookie, and no third-party tracker, so there is nothing here to sell or share and no consent banner to click through.

• yeepabase_sess, set when you log in so each page knows it is still you. It holds a session id and nothing else, and your browser drops it when you close it.
• yeepabase_remember, set only if you tick "remember me" at login. It stores a random token, never your password, and logging out revokes it.

Both are marked HttpOnly and SameSite=Lax, so no script can read them and another site cannot make your browser send them along. Both are strictly necessary for logging in, which is why they need no consent banner under the GDPR or the ePrivacy Directive. Blocking them is fine if you only want to browse the roster, but you will not be able to log in.

Unlink your player from your account page and its row is deleted from the roster. Stats, outfit, purchases, profile customisation, uploaded images, mobile code, and stored credentials go with it. Nothing is retained after an unlink.

Delete your whole account from the same page. Deletion is scheduled rather than instant: your account is locked for 3 days and then purged, and logging back in during that window cancels it. That window exists so a mistake or someone else reaching your account is recoverable.

If you connected the Discord widget, disconnect it too. Removing your data here does not reach into Discord's own copy of what we already sent.

If the list of stored fields changes, this page changes with it. It is meant to describe the database as it actually is, not as it was intended to be.

Last updated 24 July 2026.