Privacy Policy

Rosterstats is an independent, fan-made site. Its operator decides how the information described here is used (the “data controller”, in the words of laws such as the GDPR) and can be reached at support@rosterstats.com.

We ask Discord only for your basic profile (the “identify” permission). We store:

• Your Discord user ID, display name and profile picture link
• The sign-in tokens Discord gives the site, used only to keep you signed in
• For each sign-in session: when it started, and your IP address and browser type, to keep sessions secure

Discord doesn't share your email address with the site, and we don't ask for your servers, your friends or your messages.

When you use one of the Rosterstats commands in Discord, Discord sends the site the command along with your basic Discord profile and the server and channel you used it in, so the site can answer. The site answers and keeps none of it.

A Discord server can give a role to people who own a team on Rosterstats. If you claim such a role, Discord asks you to let Rosterstats update your connection. The site then looks for the Rosterstats account that signs in with that Discord account and tells Discord three things about it: its name, whether it owns a team and whether it's on one. Discord keeps that with your account and can show it to people in that server. The site uses Discord's permission once and doesn't store it. To take the connection away, remove Rosterstats under Authorized Apps in your Discord settings.

If you create an account with an email address and password instead, we store:

• Your email address, used only to sign you in, confirm the address, send password reset links and warn you if someone tries to sign up with it again
• Your password, only as a one-way hash that can't be turned back into the password
• The name you pick, which your team sees
• The same session details as above

When you pick a password, the site checks it against Have I Been Pwned's list of leaked passwords by sending only the first five characters of a scrambled version of it, never the password itself. We don't send newsletters or marketing email.

Team members with permission add information to their team, which the site stores:

• The team's name, description, logo, members, roles and join requests
• The players on the team's list: their in-game names and platform IDs (Steam or Epic/EOS IDs) and the team roles given to them
• Saved matches: uploaded stats files, match files and match logs, and imports from CRCON stats pages and Wardogs match report pages. They include in-game names, IDs and stats for everyone in those matches, opponents included, and the kill-by-kill timeline when one is added
• Saved board styles and squad layouts
• Share links the team has created

• Your team. Members whose role allows it can see the team's matches, stats and players. Every member can see who else is on the team, by display name and role.
• Other signed-in accounts. Any signed-in account can see a team's name, description and logo on the list of teams, so they can ask to join, unless the team leaves itself off the list. A team that's off the list still shows to an account that has already asked to join it. Anyone who opens a team's join link and signs in can see its name, description and logo too. If you ask to join a team, the people who handle its requests see your display name.
• Anyone with a share link. Someone on the team with permission can create a read-only link to one match or to the team's stats for one game. Anyone who has the link can view what it points to without signing in, until the team revokes it. Shared pages ask search engines not to list them.
• The site admin. The site admin approves new teams and can open any team's data to give support or deal with abuse.

Apart from share links, a team's data isn't public.

Stats files and CRCON stats pages list everyone who played a match by in-game name and platform ID, including people who have never used Rosterstats. Wardogs match report pages list them by in-game name, and the site keeps no ID from those pages. Teams add them to review their own matches. Each team sees only the matches it saved, and the site doesn't contact those players or build a profile of them across teams.

If your in-game name or ID appears in a team's data and you want it removed, email support@rosterstats.com with the name or ID. We'll check the request and remove the data, or explain why we can't.

When you import a match from a link to a CRCON stats page or a Wardogs match report page, the site's server requests that match's data from the page you linked, the same way your browser would. The link is saved with the match, so your team can find that page again; a share link doesn't show it. Files you upload (stats files, match files and match logs) are read in your browser, and only the parts the site uses are saved.

The site uses only essential cookies: they keep you signed in and protect the sign-in steps. Your browser's local storage remembers preferences such as the team and game you picked and your board format. There are no advertising or analytics cookies.

• To run what you asked for: your account, your team and its boards and stats
• To keep the site secure: session details, a count of recent sign-in and sign-up attempts from each IP address, and the leaked-password check
• To answer you when you email us

We don't use it for advertising or profiling, and we don't sell it. If you're in the UK or the EU, the legal grounds are our agreement with you (the Terms of Service) for running your account and team, and our legitimate interests in keeping the site secure and in letting teams review the matches they played.

• Discord, for sign-in, and for the commands and roles described above. Your Discord profile picture is loaded from Discord's servers.
• Resend, which sends the confirmation and password reset emails for email accounts, so it receives the address and the message. It also sends the site admin a notice when a team is requested, with nothing about you or the team in it
• Have I Been Pwned, which checks new passwords against known leaks (it never receives the password)
• Vercel, which hosts the site and, like any web host, handles technical request data such as IP addresses to deliver pages
• Neon, which hosts the database

These services process data only to run the site. We don't pass your information to anyone else unless the law requires it.

The site and its database are hosted in the United States, and the services above may process data there or in other countries. If you use Rosterstats from elsewhere, your information is transferred to and stored in the United States.

• Your account details stay until you delete your account.
• A sign-in session stops working about 7 days after you last used the site. Its record is removed when you sign out, reset your password or delete your account.
• Email confirmation links work for 24 hours and password reset links for 1 hour.
• A team's data stays until the team removes it. Deleting a team removes its matches, players, roles, styles, layouts and share links with it.

Deleted data can remain in the database provider's restore history for a short time before it is gone.

Connections to the site are encrypted, passwords are stored only as one-way hashes, and team data is served only to signed-in members whose role allows it. No website can promise perfect security. If we learn of a breach that affects your information, we'll tell the people affected as the law requires.

A team's owner or managers can remove players, matches and members from the site at any time. You can delete your own account from the account menu in the top bar (your name, then “Delete account”). This removes your profile, sessions, sign-in details (Discord tokens or password), email address and team memberships right away. Matches, board styles and layouts you saved stay with your team. If you own a team, transfer or delete it first.

You can also ask us for a copy of the information we hold about you, or to correct it, delete it or stop using it. Laws such as the GDPR and some US state laws give many people these rights. We'll honor a request wherever you live, and aim to answer within 30 days. Email support@rosterstats.com. If you're in the UK or the EU you can also complain to your data protection authority.

Rosterstats isn't meant for children under 13, and we don't knowingly collect their information. If you believe a child has signed up, email us and we'll remove the account.

If what the site stores or how it's used changes, this page will be updated and the date above will change.

Questions about this policy or your data: support@rosterstats.com