Privacy Policy

• You can browse and download everything without an account.
• Some public catalog pages contain Google AdSense advertising.
• Where consent is required, you can accept, refuse, or manage advertising choices.
• An account stores what it needs to be an account, plus what you choose to give it.
• Your email address is private. Your username and your macros are public.
• We only email you about your account, your submissions, and changes to these documents.

The rest of this page is the detail behind those points.

You do not need an account to browse the catalog or download a macro. We do not create an account record about you merely because you browse, but the hosting, analytics and advertising services described below receive the technical information needed to provide their part of the page.

Your browser keeps a few small preferences locally so the site behaves sensibly between visits: things like your theme (gdm-theme), how you like the list laid out, what you viewed recently, and your favorites (gdmacros:favorites). These live in your browser's local storage. They are not sent to us, they are not an identifier, and clearing your site data removes them.

Cookies or similar browser storage can appear in these cases:

• When you sign in, Supabase sets a session cookie so you stay signed in. Signing out clears it.
• If you use the language menu, Google Translate sets a googtrans cookie to remember the language. Setting it back to English clears it.
• An embedded YouTube video can set cookies when you play it. That is YouTube, under Google's terms, not us.
• Google AdSense and its consent system can use cookies or similar storage to serve, limit, personalise and measure advertising according to your choices and the law that applies to you.

Public catalog and macro pages can show responsive advertisements supplied by Google AdSense. Ads are kept out of account, submission, settings, notification, support-ticket and admin pages. An advertisement is labelled and is not a recommendation or endorsement by GDMacros.

Loading an ad or the consent message makes your browser communicate with Google. Depending on your location, settings and consent, Google can process information such as your IP address, browser and device information, the page you visited, ad interactions and cookie or similar identifiers. Google uses that information to deliver, prevent fraud, measure and, where permitted, personalise advertising.

Visitors in the EEA, UK and Switzerland are shown a Google-certified consent message with choices to consent, not consent or manage options. Refusing personalised advertising does not prevent you from using the catalog. You can revisit the privacy choices through the Google message controls when they are available.

You can read how Google uses information for advertising and review your choices in Google's My Ad Center.

The site can perform a small on-device check to notice when common advertisement elements are hidden. If that suggests an ad blocker is active, a dismissible message asks whether you would like to allow ads. The check is not sent to our server, does not block the site, and the dismissal is remembered only in session storage for the current browser tab.

Accounts are handled by Supabase. Having one means storing:

• Your email address, used to sign in, confirm the account, reset a password, and send the messages described below.
• A hashed version of your password. We never see your actual password, and it is not something we can look up or recover.
• Session information that keeps you signed in.
• Your username.

Your username is public. It is the name shown on macros you record and on your profile page. Your email address is private: it is never shown publicly. A restricted admin account tool can reveal one address only after an admin enters the exact username, for account support and moderation. The submission review screen itself shows the username, never the address behind it.

Some data exists only because you asked for it. Today that means your favorites when you are signed in, your notification read state, and your preferences for which submission results are emailed to you. As the site gains options, new preferences of this kind are stored the same way and for the same reason: to make the site behave the way you set it.

None of it is used for anything other than providing that feature to you. Changing a setting changes the stored value; removing the feature or the account removes it.

Signed out, favorites stay in your browser only. We do not know what they are and they do not leave your device.

Submitting a macro stores what is needed to review and publish it:

• Which account submitted it, and the level, video link, recorder, macro author and any notes you entered.
• The .gdr or .gdr2 file itself.
• Timestamps and the current review status.

The uploaded file goes into private storage. It is not public and not listed, and no browser can reach it directly. Only an admin reviewing your submission can open it, and only through a short-lived link generated for that review. A reviewer can correct details such as a missing video link before publishing.

After an admin approves a submission, publishing happens automatically. The file is uploaded as a public download, the catalog entry is added, and the site is checked to confirm the macro is really live. Once that is confirmed, the private copy of your upload is deleted.

Public means the macro itself, and the credits shown beside it: the level, the recorder, and the macro author. Also public:

• Your username, once you choose one.
• Your profile page, which lists the macros credited to your name. Anyone can view it, and it is included in the site's sitemap.
• The catalog itself.

Nothing private travels with a published macro. The public file is named after the macro author, the level and the recorder. It does not contain your email address, your account ID, your submission notes, or anything from the review process.

The address on your account is used for:

• account mail such as confirmation and password resets,
• submission results, if you have those switched on in Settings,
• the result of a support ticket when an admin closes it,
• notice of a material change to the Terms or this policy,
• and important account, security or service messages.

All of it comes from support@gdmacros.com. This is not a newsletter and not advertising. There is no marketing mailing list on this site, and we do not send promotional email. You can switch off submission-result email in Settings; the results still appear on the site.

Sending mail reliably means keeping a short record of what was sent, so that an interrupted run can resume and nobody is sent the same message twice. Those records hold the message and its delivery state. Where a retry needs it, a copy of the destination address is held only for as long as the retry is safe, and is erased once the message is settled. They are never used to build a mailing list.

When you are signed in, a suggestion or broken-macro report opens a private support thread. It stores your account ID, username, the title and messages, timestamps, its status, and the macro page details when the report concerns a download. Only you and the admins can read that thread.

Open tickets stay available so the conversation can continue. When an admin resolves or closes one, you receive an in-app notification and an email with a link to its transcript. The ticket, every message, its notification, and the delivery job are permanently deleted 30 days after closure. Access stops at that deadline even if the scheduled deletion is a few seconds late.

An admin can block an account from opening new tickets when the feature is abused. The block stores the account ID, the reason, who applied it, and the time. It does not hide an existing conversation or prevent replies in one.

Mail sent to support@gdmacros.com travels through more than one company before it reaches a person, so it is worth being clear about the path:

• Resend receives the message.
• Resend calls a webhook on this site.
• The site forwards the message to a private mailbox, which is a Google Gmail account.

That means Resend, Vercel and Google can each process support correspondence. The message normally includes your email address, the name your mail client sends, the subject, the body, any attachments and ordinary email headers. We use it to answer you and to deal with abuse reports and takedown requests.

Replies come from support@gdmacros.com using the same infrastructure. The private mailbox address is not published anywhere. support@gdmacros.com is the only address you need.

When an account is created, we record that account's internal ID, which version of the Terms and Privacy Policy were current at that moment, and the time. That is the whole record. It does not include your address, your IP address, or anything about your browser.

Each of these performs one role. That is how to read this list: if a feature changes, it is almost always still one of these companies doing the same job.

• Supabase stores accounts and everything attached to one: sign-in, profiles, favorites, submissions, the private files you upload, review state, support tickets, preferences and the records described above.
• Vercel hosts the site and runs its server code. Vercel Web Analytics and Speed Insights are enabled. They report aggregate traffic and page performance, and are not used to build a profile of you or to advertise to you.
• Resend handles email, both the messages we send you and the support mail you send us.
• Google is involved through Gmail, where support mail is read; Google Translate, if you use the language menu; and Google AdSense, which provides consent choices and advertising on selected public pages.
• GitHub hosts the source code, the catalog and every public macro download. Downloading a macro means your browser talks to GitHub, under GitHub's own terms.
• GDBrowser is used to look up Geometry Dash level details. Those lookups are made by our server, not by your browser, so GDBrowser does not see you.
• YouTube provides showcase videos. Searching for one during submission happens on our server and uses no API key. An embedded player on a macro page is loaded by your browser and is subject to Google's terms.
• Lanyard supplies the live Discord status shown on the About page. That request is made by your browser. It asks only for the public Discord profile of the site owner, and there is no way to make it look up anyone else.

Macros used to be hosted on MediaFire. They were all moved to our own hosting, and nothing in the catalog links to MediaFire any more. The old copies still exist as a fallback in case something ever needs to be restored from them. We are not putting a date on removing them.

The MediaFire links on the install page are a separate thing. They are how you download xdBot itself, and they are not macro downloads.

Everything not listed as public above. In particular:

• Your email address, visible only to you and authorised administrators using the exact account lookup.
• Your password, which is only ever stored hashed.
• Files you upload, until and unless a macro is accepted and published.
• Your submission notes and anything from the review process.
• Your support-ticket threads.
• Your settings, your notification state and your favorites.
• Support email you send us.
• Records of messages sent to your account.

The rule is that something is kept while it is still doing its job, and removed when it is not. Most records follow an event such as a decision or account deletion; closed support tickets are the exception with a fixed deletion timer. Here is what that means in practice:

• A submission stays until it is decided or you withdraw it. Once it is accepted and confirmed live, the private copy of your upload is deleted; a rejected or withdrawn one is removed along with its file.
• A published macro stays in the catalog, because it is catalog content rather than account data.
• An open support ticket stays while the conversation is active. A resolved or otherwise closed ticket, its transcript and its notification are permanently deleted after 30 days.
• Your other account data, including settings, favorites, notifications and your submission history, stays while the account exists.
• Delivery records hold a destination address only while a retry could still need it, and are erased once the message is settled.
• Support email stays in the mailbox unless it is deleted by hand.
• The ad-block notice dismissal lasts only for the current browser-tab session. Google's advertising and consent data follows Google's own retention settings and your consent choices.
• Deleting your account removes the account and the data tied to it. Macros already published stay in the catalog.

You can permanently delete your own non-admin account in Settings after typing a clear confirmation. Any submissions still in review must be withdrawn first. Published macros remain in the catalog, as explained above.

You can also write to support@gdmacros.com from the address on the account. That covers deletion, asking what is stored about you, correcting something, and takedown requests.

Please do not open a public GitHub issue for anything about your account. That is a public tracker and account matters do not belong there.

Private data sits behind database access rules rather than being hidden by the interface, so a request for someone else's data is refused by the database itself. Uploaded files are in private storage that no browser can read. Nobody can promise perfect security and we are not going to, but the design assumes the front end can be bypassed.

Geometry Dash has a young audience. We do not knowingly collect more from a younger visitor than from anyone else, and you can use the whole catalog without an account and therefore without giving us anything. If you believe a child's information is stored here and it should not be, write to support@gdmacros.com and we will remove it.

GDMacros is actively developed, and features get added. This page is written by category rather than by feature so that it keeps describing the site accurately as that happens: a new preference, a new kind of message, or a new page is already covered by the categories above.

What that is not is a blank cheque. It does not permit collecting a new kind of information, using what is here for a new purpose, or handing data to a company not named above. Any of those is a change to this page, and this page changes before it happens.

When it does change, the version and date at the top change with it, so you can tell whether you are reading something new. For a material change we may email the address on your account. Where the law that applies to you requires more than notice, an email on its own is not us claiming you agreed to anything.

Questions about privacy, your account, or anything on this page: support@gdmacros.com.

Terms of ServiceFAQGuidelines