Publishing a mod stores more than a player's likes and comments: your pack or native library, a report on each, a virus scan, your images and a record of each review. Views, downloads and what every player shares are on Your data.
Your files
Each file you upload is stored on Lucidpedia's server under a random name. The site also keeps the file name you gave it, its size and its SHA-256 hash. It reads a pack once and keeps a report:
- the Godot version that built it, how many files it holds and the name of its mod folder;
- for a mod built on QualiaMods, what its
mod.cfgsays: the name, version, author, description, game and API version, load order, dependencies, whether players may change its settings, and the name and type of each setting; - the path of every file outside its own mod folder, or of every file in the pack if it has none;
- the path of each script, whether the check could read it, and which risky calls it makes;
- the check's notes on what it found, which can name paths in the pack.
For a native library it reads the headers once and keeps: the machine it's built for, the linker version and the timestamp the linker wrote, its size in memory, the functions it exports and imports, its sections, whether it carries a signature, and the path of its debug file when the build names one. That path often contains your Windows user name, and it sits inside the library itself: players who download the library after it's published can read it, and so can VirusTotal, which gets the file at the first scan, before a moderator decides. The site only leaves the path out of the public report and the Public API. To keep it out of the file, build with debug_symbols=no, or link with /PDBALTPATH:%_PDB% so only the file name stays, and upload again. The rest of the library's report is public like a pack's, on the mod page and in the Public API. Players download the library as libgdblocks.windows.template_release.double.x86_64.dll; the name you gave it is shown only to your team and the moderators.
The report holds no script source, only that list. The source stays inside your pack, which the site keeps and anyone can download once the version is public.
For every published version, the whole report is public, on the mod page and in the Public API, together with the file name you gave it, the hash and the size. That includes the check's notes: the mod page shows them only to your team and the moderators, but the API returns them to anyone. Players use the report to see what a mod changes before they install it.
The upload itself stores no IP address or browser details. Like every request to the site, it is written to the server log with your IP address and browser, which is kept for about two weeks (see Your data). An upload you don't turn into a version within 24 hours is deleted, file and all.
The virus scan
The site first asks VirusTotal whether it knows your file's SHA-256 hash. If it doesn't, the site sends VirusTotal the whole file. A pack and a library are sent separately. VirusTotal is a separate company and keeps what it receives under its own terms. Its report on your file is public: the mod page links to it, and anyone who has the hash can open it.
Lucidpedia stores the result: how many engines flagged the file, how many checked it, and the link to the report. Don't upload a file here if its contents must stay private.
The mod page
The name, summary, description, tags, license, source link and dependencies become public when the mod is listed. The AI use you tick in Details stays between your team and the moderators: it isn't shown on the mod page or in the API. Until then, a draft is seen only by your team and the people you invite to it, and a mod waiting for review by your team and the moderators. A mod that staff publish for you from the game's Discord is also seen by the staff who publish for Discord authors, until you sign in.
Before an image is stored, the site removes the metadata inside the file: the camera, the place a photo was taken, editing details, comments, and the name and serial number of the display a colour profile was made for. A photo the camera marked as sideways is turned upright first, which saves it again at about the same quality. Otherwise the pixels stay as they are, and colours and animation are kept. The site also keeps each image's original file name. A new image goes public when a moderator approves the mod, when a trusted author on the team saves or publishes it, or when a moderator makes you a trusted author. For a YouTube video, the site stores only the video id and your caption.
Your team
The owner and co-authors are listed on the public mod page. Your public profile also lists your public mods, their total downloads and likes, how many people follow you, and the badges they earn you. With Incognito on, the public sees "Incognito" in your place and your profile isn't shown, but your co-authors and the moderators see your name.
The site records which author uploaded each version, and moderators see it. When staff upload a version for you before you sign in, the site records them as well. When your version goes live without review, the notification to the mod's followers, or for a first release to its authors' followers, also shows your name, unless you're incognito.
Stats
The Stats tab shows daily totals of downloads, views and likes, and the downloads of each version. Everyone who can open the mod sees the same numbers. It shows no list of who viewed or downloaded your mod, and the database keeps none (see Views and downloads). The server log still records every request with its IP address for about two weeks; authors never see it.
Reviews and moderation
| Record | Who can see it | How long it stays |
|---|---|---|
| Trusted author: set when a moderator approves a mod you own, or grants it directly | Moderators. You see it as a Publish button where other authors see Submit for review. | Until a moderator removes it |
| A moderator's note when they send a mod back, reject or hide it, or reject or hide a version | Your team and moderators, never the public | Until a moderator approves or restores it; on anything rejected, for good. The moderators' log keeps a copy. |
| The moderators' log: each decision, who made it and why | Staff | No end date |
| Reports about your mod | Moderators | No end date |
You never see who reported your mod or what they wrote. If a moderator hides your mod or a version, you get their note.
A ban stops uploads and every change you make to your mods. Mods you already published stay up, and a version already waiting for its scan can still go live on its own.
Removing a mod or a version
| You want to | What happens |
|---|---|
| Delete a mod that was never public (owner only) | The mod, every version and every version file are deleted, rejected versions included. Its images stay in the site's image store, and the moderators' log keeps its entries about the mod, notes included. |
| Withdraw a version that is still being scanned or waiting for review | The version and its file are deleted. The upload record with the file name, hash and report is deleted within 7 days. |
| Take down a published version | It is hidden. The file and the record stay, and the same file can't be uploaded again while it is down. You can put it back unless a moderator hid it. |
| Remove an image from the page | It leaves the page. An image that was public stays at its address until a moderator removes it. |
| Remove a mod that has been public | You can't delete it. Taking down every version takes its page off the site until you put one back; the mod and its record stay. A moderator can also hide it. |
When a moderator rejects a version, its file is deleted 30 days later. The record stays and stops the same file from being uploaded again, unless you delete a mod that was never public: its rejected versions and their files go with it at once. A rejected mod can't be deleted.
In your browser
While you upload, the site saves the id of your pending upload and the release fields you haven't submitted in your browser, under keys that start with lucidpedia:mod-studio:v1:. For a mod not created yet it also saves the name, summary, description and address. A reload then loses nothing, and nothing in these keys reaches the site until you submit.