PRIVACY POLICY

• We collect what we need to run the platform: your email, your chosen display name, your Discord profile if you choose to link it, your gameplay and rank stats, your chat messages, and crash diagnostics. Your password is salted and hashed; we never store it in readable form.
• We don't sell your data, and we don't run third-party ad trackers. Our website analytics (Plausible) is cookieless and anonymous.
• You can delete your account yourself at any time. There is a 30-day grace period, then your data is permanently removed.
• Servers live in the Netherlands (EU), so GDPR applies. Your rights are listed in section 10.
• This is a small project. One person reads support requests, so replies are best-effort and come from a real human rather than a team. The fastest way to reach us is on Discord.

Unrealwatch is an independent project run by a single developer based in the Netherlands. There is no registered legal entity at this time. When this policy says “we,” “us,” or “Unrealwatch,” it means that one person, acting as the data controller under Article 4(7) GDPR.

The platform is made up of this marketing site at unrealwatch.nl, the desktop launcher, the Unreal Engine 5.8 game client, the backend that powers them, the Discord integration, and the game servers. All of it is operated under this policy.

Contact details are in section 15.

Account

When you register, we store your email address (used as the unique identifier for your account), your chosen display name (2-24 characters), the four-digit tag suffix we generate for you, when the account was created, when you last signed in, and any moderation flags on the account. Your password is salted and hashed; we never store it in readable form, and it never appears in our logs.

Discord (optional)

Linking your Discord account is optional. If you link it, we store your Discord user ID, username and display name, avatar, banner, accent colour, and the credentials needed to keep the link working. The permissions we request are narrow: enough to read your basic profile and support the in-app social features, and nothing more. We do not request access to your email on Discord.

Access to the stored Discord credentials is tightly restricted, and the permissions they grant are limited. They cannot post messages on your behalf, change your servers, or read your private Discord data beyond what those narrow permissions allow. You can revoke our access at any time by unlinking from your account settings, or by removing the authorisation from within Discord itself.

We re-host your Discord avatar and banner on our own infrastructure so that viewing a profile doesn't quietly send a request off to a third party. That cached imagery is refreshed periodically for as long as the link exists. Unlinking Discord wipes the stored profile and credentials.

Gameplay

While you play we record the matches you take part in, your kill, death, and assist counts, damage dealt, healing done, the heroes you pick, ability usage, your SR (skill rating) history per match, win and loss outcomes, and total playtime. Match data stays linked to your profile and is used to work out your competitive rank, the leaderboards, and your career statistics.

Chat

We keep the chat messages you send through the platform (global, party, team, and direct messages), along with who sent them, which channel they went to, and when. Chat is stored on our servers so your history is there for you between sessions and so moderators can review reports.

Direct messages are automatically purged after 28 days. Global, party, and team chat are kept for as long as your account exists. Messages preserved by a moderator may be kept longer for safety reasons. The full retention list is in section 9.

Crash and game-client diagnostics

If the game client crashes, the launcher can send us a crash report. It contains your build version, a rough profile of your hardware (such as CPU, GPU, memory, and disk), a portion of the engine crash log (file paths and private strings are stripped on your machine before anything is sent), the network address you were connected from at the time, your account ID, and gameplay context such as the hero, match, and last ability used. Crash uploads are best-effort and can be stopped by uninstalling the launcher.

Crash reports are kept for as long as we need them to investigate and fix problems. When you delete your account, we cut the direct link to your account ID. In the interest of being honest with you, some technical details (such as the rough device profile and the network address recorded at the time of the crash) may remain in older reports after deletion.

Technical data

For each signed-in session we keep some basic technical data: your user ID, the network address you signed in from, and your browser or client identifier. We use this to spot a new sign-in from a different device (so we can sign the older session out by default) and to flag suspicious activity. Our web server also keeps standard access logs (address, path, status, and client identifier) under the host's normal log-rotation policy.

• To run the platform: signing you in, matchmaking, queueing, party invites, ranked play, leaderboards, and showing profiles.
• To prevent abuse: rate limiting, enforcing bans and mutes, blocking known-bad sources, throttling password resets, and catching fraud.
• To improve the game: investigating crashes, balancing heroes, and understanding where the client and servers struggle.
• To talk to you: email verification, password resets, confirmations when you change your account, and security notices.
• We do not run targeted advertising, and we do not build behavioural profiles for marketing.

Our legal bases under GDPR Article 6 are: performing the agreement you entered into when you registered (Art. 6(1)(b)), our legitimate interests in running a fair and secure platform (Art. 6(1)(f)), and your consent where it applies (Art. 6(1)(a)), for example when you choose to link Discord.

We share only what is genuinely needed for the platform to work:

• Discord. If you link your Discord account, we exchange the necessary credentials with Discord and may relay messages (the chat bridge, ban announcements, and deploy notices) to channels we control on our own Discord server.
• Email delivery. Verification, password-reset, email-change, and account-deletion emails are sent through our own self-hosted mail server.
• Plausible Analytics. Aggregate, cookieless page-view metrics for unrealwatch.nl. Plausible does not use cookies, does not fingerprint visitors, and does not collect personal data, per its published policy. It is loaded only on the public marketing site.
• Error monitoring. When error reporting is switched on, backend error reports (which can incidentally include a user ID or network address in their context) are sent to a self-hosted error-monitoring tool for debugging. Only actual errors are captured.
• GitHub. The launcher installer and game updates are served through a proxy that ultimately fetches them from GitHub Releases. Our web server logs the requesting address, path, and status.

We do not sell personal data, and we do not share it with advertising networks, data brokers, or behavioural-analytics services.

The marketing site (unrealwatch.nl) does not set cookies, and Plausible is cookieless.

After you sign in, we store some data in your browser to remember your session and a cached snapshot of your profile, so pages load quickly. The launcher keeps the equivalent in its own local storage (your session, the last-seen build, dismissed update prompts, and window position). You can clear this from your browser's site-data settings or by signing out.

The admin panel used by staff sets a session cookie. It runs on the local network only, is not exposed on the public internet, and is not used by players.

Account data

Until you delete your account (see section 10).

Direct messages

Automatically purged after 28 days.

Global / party / team chat

Kept while your account exists.

Crash reports

Kept for as long as we need them to investigate problems. The link to your account is cut on deletion, though some technical details may remain in older reports (see the diagnostics note in section 5).

Moderation records

We keep a record of moderation actions so we can enforce the rules fairly and handle appeals. Our legal basis is our legitimate interest in platform safety (Art. 6(1)(f) GDPR).

Match and SR history

Kept while your account exists. Used for career stats and to prevent rank-reset abuse.

Account-action tokens (password reset, email change)

Short-lived. Marked as used once consumed, then kept briefly for audit.

Session data

Lives only for the lifetime of your session.

Rate-limit and lockout counters

Short-lived (seconds to a day).

Web server logs

Rotated under the host's standard log-rotation policy.

If you need a specific piece of data removed sooner than the timelines above, contact us and we will honour what GDPR requires.

You hold the rights granted by the GDPR. The most common ones are built straight into the product:

• Access (Art. 15).There isn't a self-service export button yet. Contact us and we will put together a copy of your personal data and send it to you within 30 days.
• Rectification (Art. 16). Edit your email, password, and display name from account settings. Display-name changes have a 30-day cooldown.
• Erasure (Art. 17).Use “Delete account” in account settings. You have a 30-day grace period to change your mind, after which deletion is permanent and most of your data is removed with it.
• Restriction (Art. 18) and objection (Art. 21). Contact us, and in most cases we can pause processing.
• Portability (Art. 20). You can ask for a copy of the personal data you gave us that we process automatically under our agreement, such as your match history and career stats, in a structured, machine-readable format. Use the same channel as an access request.
• Withdraw consent. Unlink Discord from account settings, or delete your account to withdraw all consent.
• Complain to a supervisory authority. You may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Automated decisions: your competitive rank is worked out automatically from your match results. This doesn't produce legal effects or similarly significant consequences in the sense of Art. 22 GDPR, so that article doesn't apply, but you can always contact us to ask how a result was calculated.

Passwords are salted and hashed, never stored in readable form. Your session uses short-lived sign-in credentials that refresh in the background. We limit how often authentication endpoints can be hit (by address and by email) and progressively lock accounts after repeated failed attempts. We also maintain a blocklist for known-bad sources.

No system is unbreakable. If we ever become aware of a data breach that affects you, we will notify you and the relevant supervisory authority within the timelines required by Articles 33 and 34 GDPR.

Our servers run in the Netherlands. Some of the third parties we rely on (notably Discord and GitHub) operate globally, so your data crosses borders when you interact with them. We rely on the safeguards each provider publishes, such as EU-aligned standard contractual clauses and the EU to US Data Privacy Framework where it applies.

Unrealwatch is not aimed at children. By creating an account you confirm that you are at least 16 years old, or older if that is the minimum age of digital consent where you live. We do not currently run an age-verification gate; we rely on your declaration. If we learn that we have processed the personal data of someone below the applicable age, we will delete the account and its data and, where required, notify a parent or guardian.

We may update this policy as the platform grows. Material changes (ones that meaningfully affect your rights or the categories of data we process) will be announced on our Discord server and sent to the email registered to your account at least 30 days before they take effect. The “Last updated” date at the top of this page will change at the same time.

If you don't accept a material change, you may delete your account during the 30-day notice window without penalty; we will treat that as ending the agreement under the prior terms. Continuing to use the platform after a change takes effect means you accept it.

The primary way to reach us is on Discord at discord.gg/eJHyRf3yr5. For privacy questions, open a ticket in the support channel or message the operator directly.

We aim to respond to GDPR requests within 30 days. Complex requests can take longer, in which case we will tell you why and give you an updated timeline.