Legal

Privacy Policy

Draft - review before launch. This describes what the website software actually stores. Fill in the [bracketed] details, add your hosting provider, and have it checked for the laws that apply to you (for example GDPR) before launch.

Last updated: [date]

Who is responsible

[Operator's legal name, address and contact email].

What we store

Game data sent by the GoFight server: gamertag, Xbox user ID (XUID), rank, coins, souls, level, game statistics, when you were first and last seen, whether you are online, and a small picture of your skin (face and front view). This powers public profiles and leaderboards.
Website account (only if you log in): which player you linked, when you logged in, and a session cookie.
Purchases: what you bought, the amount, payment status from the payment provider, and delivery status. Card details are handled by the payment provider and never reach us.
Security logs: an audit log of staff actions and integration errors.

Your IP address is used briefly in memory for rate limiting and is not stored. When you start a checkout it is passed to the payment provider for fraud prevention.

Cookies

gf_session keeps you logged in (30 days).
gf_link exists for up to 10 minutes while you log in.

Your cart and recent searches are saved only in your own browser. We use no advertising or analytics trackers.

Who can see it

Profiles and leaderboards are public. Purchase history is only visible to you and to authorised staff.

How long we keep it

Game data is kept while the server runs. Purchase records are kept for [period required by your tax rules]. Expired login requests and sessions are deleted automatically.

Your rights

You can ask for a copy of your data, a correction, or deletion of your profile and account by contacting [contact email]. [Add any rights that apply in your country.]