Privacy Policy

The controller of your personal data is [COMPANY OR SOLE TRADER LEGAL NAME], [STREET ADDRESS, POSTAL CODE, CITY, COUNTRY]. For anything to do with your data, write to [PRIVACY@YOURDOMAIN.COM].

From Steam, when you sign in. Your Steam ID, your Steam persona name and your Steam avatar URL. We use Steam’s OpenID sign-in, so we never see your Steam password.

That you give us. An optional display name, handle and uploaded avatar; anything you type into the service (team name, roster entries, schedule items, written strategies, availability); and any files you upload, such as demo files, videos and images.

That the service generates. Which plays and demos you have favourited or marked watched; your team membership and role; your referral code; timestamps such as when your account was created and when you last signed in.

Technical data. A session identifier stored in a cookie, and standard server and security logs (IP address, user agent, the request made, the time) kept by our hosting provider.

Payment data. Handled by our payment provider. We receive a subscription status and a customer reference; we never receive or store your full card number.

We do not run advertising trackers, and we do not sell or rent your personal data to anyone.

• To run the service you asked for — creating your account, showing you the content, saving your favourites, running your team’s hub, processing uploads. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• To take payment and keep records — billing, invoices, tax and accounting records. Legal basis: contract, and compliance with a legal obligation (Art. 6(1)(b) and (c)).
• To keep the service secure and working — detecting abuse, preventing account sharing and fraud, diagnosing faults. Legal basis: our legitimate interest in a service that works and is not abused (Art. 6(1)(f)).
• To contact you about your account — service notices, billing problems, changes to these documents. Legal basis: contract and legitimate interest.

We use a small number of providers who process data on our instructions. Each is bound by a data processing agreement.

• Valve Corporation (Steam) — identity verification at sign-in, and your public persona name and avatar.
• Cloudflare — hosting, content delivery, security filtering, and object storage for uploaded media.
• Our database host — the PostgreSQL database holding your account, team and library data.
• Upstash — the store that holds active session records.
• Our payment provider — subscription billing and payment processing.

Some of these operate outside the European Economic Area. Where they do, transfers are covered by the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism. We also disclose data where we are legally required to, or to establish or defend legal claims.

• Account and profile data: for as long as your account exists.
• Session records: they expire automatically 30 days after sign-in, and immediately when you log out.
• Team content you contributed: remains with the team while the team exists, so the team does not lose its own strategies when someone leaves.
• Uploaded 2D replays: removed automatically after the retention window shown on the replay itself.
• Billing and tax records: for as long as tax law requires us to keep them, typically several years.
• Server and security logs: short-term, on our hosting provider's own rolling schedule.

When you delete your account, we remove your personal data from the live service. Backups are overwritten on their own cycle rather than edited individually.

If you are in the EU, EEA or UK, you have the right to:

• Ask what personal data we hold about you and get a copy of it.
• Have inaccurate data corrected.
• Have your data deleted, where we have no overriding reason or legal duty to keep it.
• Ask us to restrict how we use it, or object to use based on legitimate interest.
• Receive the data you gave us in a portable, machine-readable form.
• Withdraw consent, where we rely on consent — this does not affect what we did before you withdrew it.

Write to [PRIVACY@YOURDOMAIN.COM] and we will answer within one month. You can also delete your account yourself from your profile. If you think we have handled your data badly, you may complain to your national data protection authority — ours is [NATIONAL DATA PROTECTION AUTHORITY].

We set one strictly necessary cookie to keep you signed in, and the site stores a few small preferences in your browser. The Cookie Policy lists them individually.

The service is not for children under 16. We do not knowingly collect data from them. If you believe a child has created an account, tell us at [PRIVACY@YOURDOMAIN.COM] and we will remove it.

Sign-in is delegated to Steam, so we never hold your password. Session cookies are cryptographically signed, marked HttpOnly, and expire. Traffic is encrypted in transit. No service can promise perfect security, but we take the measures appropriate to what we hold.

If we change this policy materially we will tell you by email or in the app before the change takes effect. The date at the top of this page always shows the current version.