Privacy Policy

• Account information — email address and hashed password when registering with email, or your Discord profile (username, avatar) when signing in via Discord OAuth.
• Player profile — display name, Epic Games username, Steam ID, Discord username, and optional bio that you voluntarily provide.
• Team information — team name, logo, roster composition, and season registration details.
• Match & replay data — game results, scores, and per-player statistics parsed from Rocket League replay files you upload.
• Usage data — server logs including IP addresses and request timestamps, used for security, rate limiting, and debugging. IP addresses are not stored long-term.

• To operate the league: match scheduling, standings calculation, and dispute resolution.
• To send transactional emails — verification links, match notifications, and dispute updates.
• To verify player eligibility and enforce our one-account-per-person policy.
• To detect and prevent abuse, fraud, and violations of our rules.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

When you link a third-party account we receive only the public identifier or display name needed for that integration. We do not receive passwords or payment information.

• Discord — username and avatar, received via Discord OAuth for sign-in and account linking.
• Epic Games — your Epic display name, received via Epic Account Services OAuth to verify your Rocket League identity.
• Steam — your SteamID64, received via Steam OpenID if you optionally link your Steam account.

You may unlink any third-party account at any time from your profile settings.

We share data only with the infrastructure and service providers necessary to run the platform. Each provider processes your data solely to deliver their service to us:

• Railway — cloud hosting that runs our application and PostgreSQL database in the United States.
• Cloudflare R2 — object storage for uploaded media files (e.g., team logos), hosted in the United States.
• Resend — transactional email delivery. Your email address is transmitted to Resend solely to deliver messages you have requested or that are required for platform operation (e.g., email address verification).
• Ballchasing.com — Rocket League replay parsing. When you or your team manager upload a replay file, it is forwarded to Ballchasing's API for statistical analysis. Their privacy policy governs how they handle replay data on their end.
• Epic Games — OAuth provider for Epic Games account linking. When you connect your Epic account, your Epic display name is transmitted to Epic's servers to complete the OAuth flow. Epic's privacy policy applies to data they receive during authorization.
• Discord — OAuth provider for sign-in and account linking. Discord's privacy policy applies to data they receive during the OAuth authorization flow.

We do not share your data with advertising networks, data brokers, or any third parties beyond the service providers listed above.

Account and profile data is retained for as long as your account is active. Replay stats and match history are retained indefinitely as part of the permanent public league record. If you request account deletion, we will remove your personal information within 30 days, except where retention is required by law or for legitimate record-keeping (e.g., historical match results that reference your participation).

Your data is stored in a PostgreSQL database hosted in the United States. Media files are stored in Cloudflare R2 object storage. We use industry-standard security practices including password hashing (bcrypt) and encrypted connections (HTTPS/TLS). No system is completely secure — in the event of a data breach we will notify affected users promptly.

• Account deletion — delete your account at any time from profile settings. Personal data is removed within 30 days.
• Correction — update inaccurate information at any time via your profile settings.
• Email opt-out — opt out of non-essential email notifications in profile settings.
• Data export — request a copy of your personal data by contacting us.
• Unlink accounts — disconnect any linked third-party account from your profile settings.

We use HTTP-only session cookies solely to keep you logged in across page loads. We do not use advertising cookies, tracking pixels, or any third-party analytics.

We may update this policy as the platform evolves. Significant changes will be announced on the platform. Continued use after changes constitutes acceptance of the updated policy.

Questions about this policy or your data? Reach us at admin@c3esports.com or through the official Discord server.