Privacy Policy
This page explains what information JoyCode Viewer collects from visitors and registered users, how that information is used, and what choices you have. We built this site ourselves, so we can describe every data point precisely.
Who we are
JoyCode Viewer is a Second Life client application developed by Hi Enjoy!. This website is the account management portal for JoyCode users. You can reach us at [email protected] for any privacy-related question.
Information we collect
When you register
Registration requires a Second Life username. We use that username to look up your avatar on the Second Life platform, which returns a unique avatar UUID. This UUID is the primary identifier for your account, because SL usernames can change while the UUID stays constant.
We also fetch your public profile image from Linden Lab's profile service using that UUID. The image URL is public and is the same one visible on the Second Life web profiles.
Your password is put through the scrypt key derivation function before storage. Only the resulting hash is saved. We cannot recover or read your password.
When you sign in or browse
We store your IP address and browser user-agent string as part of the session record in the database. IP addresses are also held temporarily in our rate-limiting system to block brute-force login attempts (15-minute and 1-hour rolling windows, then discarded automatically).
In-world messaging
During registration and password recovery, we send a short confirmation code to your Second Life avatar using a network of LSL-scripted objects. The message content is only the code itself. We do not store message logs beyond what the delivery status requires.
How we use your information
- To authenticate you and maintain your session.
- To associate your account with a JoyCode subscription plan.
- To track usage against your plan's weekly allowance.
- To prevent abuse via rate limiting on login and password reset endpoints.
We do not use your data for advertising, behavioral profiling, or any purpose beyond operating the service you signed up for.
Cookies
This site sets four cookies. All of them are strictly necessary for the site to work.
| Cookie | Purpose | Lifetime |
|---|---|---|
jc_sess |
Keeps you signed in. Stores a random token; only its hash is in the database. | 1 day (30 days with "Remember me") |
jc_auth |
Readable hint that lets the page show the correct header (account menu or sign-in buttons) before the network responds, preventing a visible flash. | Same as jc_sess |
jc_csrf |
A random token compared against a request header to block cross-site request forgery on every form submission. | Session |
jc_pending |
A signed token that preserves your identity across the three registration steps. Automatically expires. | 15 minutes |
We do not set any third-party cookies, analytics cookies, or advertising cookies.
Data sharing
We do not sell, rent, or share your personal information with third parties. The only external service contacted during your account activity is Linden Lab's public profile API, which we call to fetch your avatar's profile image. That request includes your avatar UUID, which is a public identifier in Second Life.
Data retention
Sessions expire automatically (1 day or 30 days depending on your choice at login) and are deleted when you sign out. Pending registration tokens expire after 15 minutes. Rate-limiting records roll off their windows and are not kept indefinitely. Your account data, including your username, avatar UUID, and hashed password, is retained for as long as your account is active.
Your rights
You can ask us to delete your account and all associated data at any time by emailing [email protected]. If you are in the European Economic Area, the GDPR gives you additional rights: access to the data we hold about you, the ability to correct inaccuracies, and the right to receive a copy in a portable format. We will respond to any such request within 30 days.
Security
Passwords are stored as scrypt hashes with per-user salts. Session tokens are stored as SHA-256 hashes so the raw token value never touches the database. All state-changing requests require a CSRF token verified server-side. These measures are built into the codebase, not configuration that can be accidentally disabled.
Children
JoyCode is not intended for users under 18. Second Life itself requires users to be at least 16 years old in most regions. We do not knowingly collect data from children.
Changes to this policy
If we make changes that affect how your data is handled, we will update the date at the top of this page. Continued use of the site after a change constitutes acceptance of the updated policy.