Cascade

Privacy Policy

Last updated: 13 October 2026

Cascade is an osu!mania beatmap editor at cascade.sheepex.net, available in the browser and as a Windows app. Both run the same editor and this policy covers both. You can use the whole editor without an account; everything you make stays on your device unless you log in. Account settings sync automatically after login, while projects and skins are uploaded only when you choose their cloud actions. This page explains what is stored where, and how to get it removed.

Using the editor without an account

• Projects, autosaves, imported audio/skins and your editor settings are stored locally on your device (localStorage / IndexedDB, kept in the app's own data folder in the Windows app). They never leave your device and we cannot see them. Clearing this site's data, or uninstalling the app, removes them.
• We record a small usage event when the editor is opened, when a project is created and when a feature such as an export or an import is used. Each event holds the event type, the browser or embedded webview name and version, your operating system name, whether it came from the website or the Windows app, and the Cascade version you are running. No IP address and no map content is included in these events. If you are logged in, the event is linked to your account so we can see which build you are on and support you; if you are not, it is stored with no account attached.
• To see whether people come back and get as far as exporting a map, your browser also keeps a short list of milestones on your device and reports each one once: the first time you open Cascade, whether you open it again exactly 1, 7 or 30 days later, and the first time you create, edit and export a map. Each of these reports carries the details above plus the date you first opened Cascade in that browser, and nothing that links it to another report or to your account, even when you are logged in. At most once a week your browser also reports that someone edited a map in it, with no first-open date and no account attached. Clicks on our Discord links are counted with the place the link was shown, and so are visits that came from the Cascade button on someone's Discord status.
• You can turn all of these usage events off in Settings, under Privacy. They are always off when your browser sends a Do Not Track or Global Privacy Control signal.
• We use no advertising and no third-party tracking scripts.

The Windows app

The desktop app is the same editor in a native window. It uses the same account, the same cloud features and the same usage events described above, with two differences you should know about:

• Its usage events are marked as coming from the app rather than the website, and carry the app version, so we can see which builds are still in use and stop supporting old ones sensibly.
• Downloading an installer is counted. We store the version, which installer it was (setup, MSI or portable) and the operating system name from the request, and nothing else. No IP address, no account and no device identifier is kept with it, so a download cannot be traced back to a person. The installers themselves are served from Cloudflare R2.

The app checks for its own updates and installs them when you accept. It has no crash reporting and no background reporting. It never sends us your file paths, your installed programs or anything else about your PC, and it only talks to our services when you use a feature that needs them.

Discord status

If Discord is running, the Windows app can show what you are working on as your Discord activity. This is the one feature that sends anything about your maps to a company other than us, so it has its own setting under Settings, Presence:

• Show the map (the default): the song artist and title, the difficulty name, the key count, whether you are playtesting and how long your session has been running go to the Discord app on your PC, which shows them to whoever can see your profile.
• Only show Cascade: only the fact that Cascade is open. No song, no difficulty, no activity. Cascade drops those details before they leave the app, not just before displaying them.
• Off: nothing is sent and the connection is closed.

We never see any of this; it goes from the app to Discord on your own machine. Once it reaches Discord it is covered by Discord's privacy policy, not ours. Discord also has its own master switch for activity status in its settings, which overrides whatever you choose here.

If you log in with osu!

Login uses osu!'s official OAuth flow, so we never see your osu! password. After you approve, we store your public osu! profile basics in our database: your osu! user id, username, avatar URL and country. A session cookie keeps you signed in; it identifies your session and nothing else.

Profiles, friends and messages

Everyone who has logged in has a Cascade profile. It shows public osu! information that osu! itself shows on your osu! profile (banner, statistics, badges and beatmaps), fetched from osu!'s API and cached for a few minutes. We keep a short summary of it (country and how many maps you have in each osu! category) so search results can show it.

• Friends and blocks: who you are friends with, friend requests you send or receive (a declined request is kept for a week so it can't be sent again straight away), and who you block.
• Private messages: the text of messages you send, when you sent, edited or deleted them, and when you last read each conversation. Only you and the other person can read them. Deleting a message removes its text from our database.
• Presence: while Cascade is open we record when you were last active and the title of the map you have open, so friends can see you are online. The "Hide my status" setting stops this.
• Mapping time: while you edit a map, Cascade counts active editing, playtesting and listening time, and simple counts such as notes placed and exports. It is stored per day, per map and per difficulty, together with the map's title and artist. Cascade only measures time in its own editor. You can clear it in Settings, Social.
• Reports: if you report someone, the report and your account are visible to Cascade's admins only.

You decide who sees your online status, what you are working on, your mapping statistics and time, and your Cascade projects (everyone, friends or only you), and who can message you or send friend requests. These choices are enforced by our database for every request, not only by what the app shows.

Cloud saves and community features

If you use these features while logged in, we store what you submit:

• Cloud projects: your charts and their assets (audio and background images), linked to your account, plus the accounts of collaborators you invite.
• Account settings: editor, playtest, shortcut, display, language and audio preferences used to keep your devices in sync.
• Account skins: up to two skin files that you explicitly upload. Other devices receive their names and file sizes; the files download only when you request them.
• Comments you leave on shared projects.
• Presets/patterns you publish for others.
• Feedback you send through the feedback form.
• Ratings: your answer to an occasional 1-10 question and anything you add to it, with the app version and whether you used the web or desktop app.

You can also answer a rating question without logging in. That answer is stored with no account and nothing else that identifies you. When and how often Cascade asks is decided on your device, which only remembers which questions it showed and how you answered the invitation; none of that is sent to us.

Deleting a project, comment or preset in the app removes it from our database. Uploaded maps are private to you and your invited collaborators unless a sharing feature explicitly says otherwise.

Where the data lives

Cascade runs on three infrastructure providers, which process data on our behalf: Supabase (database), Cloudflare (login/session service, file storage and desktop installer hosting) and Vercel (site hosting). Like any web host, they may keep short-lived technical logs (including IP addresses) to run and secure their services.

Deleting your data

• Projects, account skins, comments and presets: delete them directly in the app.
• Messages you sent and your mapping statistics: delete messages in the conversation, and clear your statistics in Settings, Social.
• Your account and everything tied to it: email contact@sheepex.net from any address, naming your osu! username, and we will remove it. This also removes your friends list, requests, blocks, presence, mapping statistics and the messages you sent; reports you filed stay, without your account attached.
• Local data: clear this site's data in your browser, or uninstall the Windows app and delete its data folder.

Changes and contact

If this policy changes in a way that matters, the date above changes with it. Questions or requests: contact@sheepex.net.