This page describes the information handled by the MyBB Plugin Catalog application. The organization operating a deployment should add its name before opening maintainer accounts or accepting reports.
Browsing plugin listings does not require an account. The application does not add analytics trackers or advertising cookies. Necessary session and security controls may be used by the web framework and hosting provider.
When you download a package or use the API, the application serves the request but does not create a per-download account record. The hosting provider, reverse proxy, object-storage service, or web server may keep request logs that include an IP address, time, requested path, and user-agent. Their operators and retention settings are deployment-specific.
A report stores its plugin, selected reason, optional description, submission status, and timestamps so moderators can review it and prevent duplicate submissions. Contact or identity details are not requested in the report form. Open reports remain until resolved. Resolved report details are automatically purged after 365 days by default; deployments can configure a longer period, with a minimum of 30 days. Audit events for report decisions are retained separately.
Maintainer records include a name, email address, role, password hash, encrypted TOTP authenticator secret, last accepted authenticator counter, and account timestamps. Privileged changes create audit events containing the actor, action, subject, time, request identifier, and relevant moderation details. Passwords and authenticator secrets are not written to those audit events.
Login sessions are used for the maintainer area. The application configures encrypted, HTTP-only, secure, same-site cookies and a 120-minute session lifetime by default. Operators may change deployment configuration and should use HTTPS and restrict access to session storage.
Plugin and release records store submitted descriptions, author names, license and source information, rights evidence references, changelogs, compatibility metadata, review decisions, and package integrity data. Uploaded package bytes are kept in private configured storage for published or reviewable releases. Review feedback is shown to the submitting maintainer; private moderator notes and other maintainers' submissions are access-controlled.
Catalog operators should retain account and audit records only as needed to secure the service, review releases, and investigate abuse. Application request logs are not a download analytics database; infrastructure log retention is controlled separately by the deployment operator.
For account or privacy requests, contact the operator through the support channel.