Privacy notice

1. Who is responsible

We have not appointed a data protection officer because the legal thresholds do not apply to a site of this size.

2. What we process, why, and on which legal basis

Playing battles without an account. When you open a battle, the site sets a random session cookie (gsa_anon) so that your votes count once, you get one daily matchup per day, and automated voting can be limited. We store a hash of the cookie value, timestamps, your votes and battle participation. Anonymous votes affect Popularity only, never the competitive ladder. Basis: our legitimate interest in offering battles without forcing sign-up and in keeping the rankings honest (Art. 6(1)(f) GDPR).

Accounts. If you register, we process your username, email address (for email sign-up), a password hash (never the password), your profile fields and settings, favourites, following/followers, progression and activity. If you sign in with Google or Discord we receive your provider user id, display name, whether the email is verified, and avatar URL; we do not keep the provider's access token. Basis: performance of the service you asked for (Art. 6(1)(b)).

Verification and reset emails. For email sign-up and password reset we send one email containing a one-time link that expires after 30 minutes. Basis: Art. 6(1)(b).

Votes and rankings. Every vote stores which battle, which side won, listening/decision evidence (for example how long each track played), whether the vote is rated, and an integrity decision. Rated votes move the competitive Elo ladder; integrity controls may exclude a vote from Elo without discarding its Popularity signal. Basis: Art. 6(1)(b) for account holders, Art. 6(1)(f) for anonymous subjects; the integrity part is our legitimate interest in rankings that cannot be bought or brigaded (Art. 6(1)(f)).

Security and rate limiting. To stop credential stuffing, automation and vote manipulation we keep short-lived counters keyed by a keyed hash (HMAC) of your IP address, IP + browser user agent, normalised email, user id or anonymous session id — depending on the action. Raw IP addresses are not stored in these counters. Basis: Art. 6(1)(f), network and information security.

Product measurement. We record a small set of allow-listed events (page view, battle started, vote accepted, sign-up started/completed, search completed, ranking opened, client error) with the page path, a timestamp, allow-listed properties and a keyed hash of IP + truncated user agent as the subject. No raw IP, user agent, email, user id or search term is stored in an event. Events never influence votes, Elo, pairing, progression or moderation. Basis: Art. 6(1)(f), understanding whether the battle loop works. During a closed test, invited testers' events may carry a fixed group tag; there are no individual codes.

YouTube playback. Tracks play through visible embedded YouTube players (privacy-enhanced youtube-nocookie.com mode). The player and YouTube's script are loaded only after you press “Play — loads YouTube” on a battle; your choice is stored in the cookie gsa_yt_consent and can be changed at any time via “YouTube settings” in the footer. Basis for the loading: your consent (Art. 6(1)(a) GDPR, §25(1) TDDDG). When the player loads, your browser sends network data (IP address, browser details, the page you are on) to Google/YouTube, and YouTube may set its own cookies once you press play. Privacy-enhanced mode limits personalisation; it does not mean nothing is transmitted. Google's own notice applies: policies.google.com/privacy.

Public profiles. Your username is public. Statistics, favourites, activity and following are shown only if you enable them in profile settings.

3. Cookies and browser storage

We use no advertising, no cross-site tracking and no third-party analytics scripts.

4. Who receives data

• Vercel Inc. (USA) hosts the site and receives requests, headers and API bodies as our processor. Server functions run in Frankfurt (fra1).
• Neon Inc. (USA) hosts our PostgreSQL database in AWS Frankfurt (eu-central-1) as our processor. Point-in-time recovery history is kept for 7 days, so deleted rows can be restored from history for up to 7 days after deletion.
• Resend Inc. (USA) sends verification and reset emails as our processor and sees sender, recipient, subject and body.
• Google Ireland Ltd — Google sign-in (if you use it) and YouTube playback; Google acts as its own controller.
• Discord Netherlands B.V. — Discord sign-in (if you use it); acts as its own controller.

Transfers to the USA rely on the EU-US Data Privacy Framework where the recipient is certified and on Standard Contractual Clauses otherwise. We do not sell data and do not share it with anyone else unless legally required.

5. How long we keep data

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and to withdraw any consent at any time with effect for the future.

• Export: signed in, use “Export my data” on your account page, which returns a complete JSON export of your account.
• Delete: signed in, use “Delete account” on your account page. This removes your profile, email, password hash, sign-in identities, sessions, tokens and rate-limit keys, and leaves an irreversible anonymised placeholder plus your votes and daily-participation rows for ranking audit. Your merged anonymous sessions are scrubbed of anything linking them to you.
• Anything else: email dennis@dennisbf.design from your account's address, or sign in first so we can verify it is you. We answer within one month.
• Anonymous use: the security counters and product events use keyed hashes we cannot reverse, and anonymous sessions carry no name or email. If you write to us without an account we will usually not be able to locate “your” data (Art. 11 GDPR); we will tell you so rather than guess.
• Objection: you may object to processing based on legitimate interest by email; we then stop unless we can show compelling grounds. To change your YouTube choice use “YouTube settings” in the footer.
• Complaint: you can complain to a data protection authority, in particular Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, or to the authority where you live.

7. Do you have to provide data?

No. Battles work without an account. An account needs a username and either an email address or a Google/Discord identity; without them we cannot create it. There is no automated decision-making with legal effect; vote-integrity rules only decide whether a single vote counts toward Elo, never anything about you as a person.

8. Children

The site is not directed at children. You must be at least 16 years old to create an account or to accept the YouTube player. We do not knowingly process data of children under 16; if you believe we have, email us and we will delete it.

9. Changes

We will change this notice when the site changes. The date at the top tells you when. Material changes are announced on the site.

Legal notice (Impressum)