Privacy Policy

1. Data we collect

Account data: email address, username, display name, password (stored only as a hash by our authentication provider), sign-in method and, if you connect it, your Discord account identifier, plus the dates you joined and last signed in.

Access and activity: beta access status, invitation redemptions, test-session bookings, launcher downloads (version and time), game-ticket requests (build and time) and announcements you marked as read.

Applications: the name, email, Discord handle, role and introduction you send when you apply.

Technical data: IP address and browser information in server logs, rate-limit counters stored as one-way hashes, and error reports. Staff actions in the control room are recorded with the staff member's IP address.

Preferences: your reminder and profile-visibility settings.

2. Why we use it

To create and secure your account, confirm your email, provide the launcher and game sessions, and manage the closed beta (performance of a contract).

To prevent abuse, fraud and cheating, keep the Services secure and enforce our terms (legitimate interest and legal obligations).

To send service emails such as confirmations, password resets, application decisions and session reminders. You can turn session reminders off in your dashboard.

To understand aggregate site usage with privacy-friendly, cookieless analytics (legitimate interest).

3. Cookies

We use only cookies needed for the site to work: your sign-in session (shared across striez.net subdomains) and short-lived security cookies. We do not use advertising or cross-site tracking cookies.

4. Who processes data for us

Supabase (authentication and database), Vercel (hosting and aggregate analytics), Cloudflare (launcher and game file delivery) and Resend (transactional email). They process data only on our instructions. Data is stored mainly in the United States, and some providers also use servers in other countries. Transfers of EU or UK personal data rely on the safeguards the GDPR requires, such as standard contractual clauses.

We do not sell or share your personal data for targeted advertising, as those terms are defined in the CCPA. We disclose it to authorities only when the law requires it.

5. How long we keep it

Account, access and activity data are kept while your account exists and deleted when you delete it. Rate-limit counters expire within an hour. Server logs are kept for a limited period by our hosting provider.

If an account that was suspended or banned is deleted, we keep a one-way hash of its email address so the same address cannot be used to sign up again.

6. Your rights

Depending on where you live, you can ask to know what personal data we hold about you, get a copy, correct it, have it deleted and opt out of any sale or sharing. We will not discriminate against you for using these rights. Visitors from the EU or UK can also restrict or object to processing and complain to their local supervisory authority.

In your dashboard under Security & privacy you can download your data as a file and delete your account yourself. For any other request, contact us; we answer within 45 days, as US state privacy laws require, and verify your identity through your account first.

7. Security

Data is encrypted in transit, access is controlled with row-level permissions, and staff accounts must use two-factor authentication. We encourage you to turn on two-factor authentication too.

8. Children

The Services are for adults. We do not knowingly collect data from anyone under 18; if you believe a minor has created an account, contact us and we will delete it.

9. Changes and contact

We will post updates to this policy here and announce significant changes on the site.

Data protection contact: privacy@striez.net.