Política de privacidad
Template privacy policy for a self-hosted instance, written against what this code actually stores.
1In short
- You can use the whole site without an account and without giving anything away.
- An account needs a username and a password. No email address is collected — there is no field for one anywhere in the database.
- The password is never stored; only a salted scrypt hash of it is.
- There is no analytics, no advertising and no third-party tracker in this codebase.
- Nothing is shared with other instances of this software. Each one is an entirely separate site with its own database.
2What is stored when you create an account
Everything below lives in this instance’s own SQLite file. Nothing else is recorded about you.
Your chosen name, 3 to 20 characters of letters, digits and underscores. It is unique regardless of capitalisation, and it is shown publicly next to anything you post on the boards.
A 16-byte random salt generated for your account, and a 64-byte scrypt hash of your password computed with it. The password itself is never written down anywhere, and the hash cannot practically be reversed.
The site language you last saved in your account settings.
When the account was created, and when it was last used to sign in.
A random 32-byte token, the account it belongs to, and its expiry, 90 days after sign-in. Signing out deletes the row; an expired row is deleted the next time it is looked up.
Up to 25 players and the same number of clubs: the tag, the display label, an optional note and when it was added.
The most recent players and clubs you opened while signed in — tag, label and timestamp — trimmed automatically to the newest 25 of each kind. You can clear it yourself from the account page.
Your username as the author, the title and body you wrote, any player tag you attached, the filters on a recruitment post, and the timestamps.
3Why there is no email address, and what that costs you
Registration deliberately asks for nothing that identifies you off this site. The trade-off is that account recovery is impossible: with no email address on file there is no reset link and no way to prove an account is yours. A forgotten password is a lost account.
It also means the operator cannot email you — not for security notices, not for anything else. Announcements are published on the site.
4Cookies and browser storage
Set when you sign in, so the server knows who you are. HTTP-only, so page scripts cannot read it, SameSite=Lax, marked secure in production, and valid for 90 days. Deleted when you sign out. Without it you are simply anonymous — the site works.
Set in your browser when you pick a language, so that visiting the site without a language in the URL sends you to the one you chose. It holds a language code and nothing else, lasts a year, and is readable by page scripts. If it is absent, the language is negotiated from your browser’s Accept-Language header instead.
Dark or light. Stored in your browser only and applied before the first paint so the page does not flash. It never reaches the server.
That is the complete list. There are no advertising cookies, no analytics cookies and no cross-site identifiers: every item above is either required to keep you signed in or a preference you set yourself, which is why this site ships without a consent banner. [operator: confirm that conclusion holds in your jurisdiction, and add a banner if it does not]
5Deleting your account
The account page has a delete button. Deleting the account removes the users row, and the database cascade removes every session, every bookmark and your whole viewing history with it.
Board posts and board replies are not deleted. The link to your account is cleared, but the post text and the author name recorded on the post stay visible, so that conversations do not collapse when one participant leaves.
If you want your posts gone, delete them from the boards before deleting your account, or ask the operator at [contact address].
6Game data this site indexes
Separately from anything about site visitors, this instance keeps an index of public Brawl Stars game data retrieved from Supercell’s developer API: player and club profiles and their raw API payloads, name history and club history reconstructed from successive polls, hourly progression snapshots, equipped skins, and archived battle logs.
That data is about game accounts, not about the person reading this page, and it is indexed because someone looked the account up here or because the account appeared on an official leaderboard — not because its owner has any relationship with this site. It is retained whether or not anyone here has an account, and an account that the API reports as deleted is dropped from the index.
Opening a player or club page while signed in records that visit in your own viewing history, and it also refreshes that account’s entry in the shared index. The index itself does not record who looked at what.
[operator: if your jurisdiction treats game account data as personal data, say so here and describe how a player can ask you to remove their account from this index]
7What this site does not do
- No analytics service, no telemetry, no session recording, no heatmaps.
- No advertising, no ad network, no tracking pixel, no advertising identifiers.
- No third-party JavaScript of any kind — every script on the page is part of the app.
- No profiling, no automated decisions about you, and nothing sold or shared for money.
- No email address, phone number, real name, payment detail or precise location is collected.
8Third parties involved
Game data is fetched by this server, not by your browser. Supercell sees this instance’s server making requests; it does not see you.
Map and event metadata is fetched by the server. Brawler art, profile icons, club badges and map images are loaded directly by your browser from the Brawlify CDN, which means that CDN receives your IP address and browser user-agent the way any third-party image host would.
Whoever hosts this instance can see ordinary web-server request logs. The application itself does not write visitor IP addresses to its database; it logs sync activity and the last API error only.
[operator: name your host and say what its logs retain, and for how long]
9Retention
- Account data, bookmarks and board posts: until you delete them, subject to section 5.
- Sessions: 90 days, or until you sign out.
- Viewing history: the newest 25 players and 25 clubs, older entries dropped automatically.
- Archived battles: pruned after 90 days.
- Daily battle aggregates: pruned after 120 days.
- Player progression snapshots: pruned after a year.
- Indexed player and club records: kept while they exist in the game.
10Your rights and how to exercise them
Depending on where you live you may have rights to access, correct, export or erase data held about you. In practice, most of what this site holds about an account holder is visible and editable from the account page, and deleting the account removes it.
[operator: state which framework applies to you, how someone contacts you about a request, how quickly you will respond, and which supervisory authority a complaint goes to]
11Unofficial fan content
Este contenido no es oficial y no está avalado por Supercell. Para más información, consulta la Política de contenido para fans de Supercell. Política de contenido para fans
Brawl Stars is a trademark of Supercell Oy. Data about game accounts shown here originates from Supercell’s public API; this privacy policy covers only what this instance does with it, and not Supercell’s own handling of player data.
12Changes and contact
This policy changes when the software changes. The version on this page is the current one, and material changes should be announced on the Anuncios page.
Questions go to [contact address]. This policy is effective from [effective date], and the operator of this instance is [operator name and legal form].
The technical claims on this page can be checked against the source; the Tecnología page describes the same pipeline from the engineering side.