CODbattles

← Legal

Privacy Policy

Version 2026-11-01 · updated 2026-11-01

This policy explains what personal data CODbattles collects, why, and what your rights are under the GDPR. We collect as little as possible.

1. Who is responsible

Data controller: Davide Roffo. Contact: privacy@codbattles.app.

2. What we store

  • Account: email address, username, language, and a password hash if you sign up with email.
  • Sign-in with Discord or Google: only the provider's account id and your email. No name, no profile picture, no access tokens.
  • Your avatar, if you choose one (optional, public on your profile): a picture you upload, stored as a 256-pixel square image without metadata, or one of CODbattles' preset avatars.
  • Your Activision ID (public) and its change history.
  • Clan memberships and match history.
  • What you upload: clan logos, match screenshots, evidence links and files.
  • Photos and short videos taken with CODbattles' own camera screen: scoreboard photos and Verified-badge photos or videos, plus a fingerprint of each image (a short hash) to detect reused images.
  • Activision ID claims and verification requests, with their outcome.
  • Notifications sent to you, your notification settings and, if you turn on push, the browser subscription (an address and keys from your browser, plus its name, e.g. "Chrome on Android").
  • A clan's Discord webhook address, if its leader or officers connect one (stored encrypted).
  • Moderation records: reports, warnings, strikes, suspensions, appeals, ringer flags.
  • If you signed up through a staff member's recruiting link: which staff member invited you (removed if you delete your account).
  • For moderators: the appointment, who made it, and the admin's confirmation that you are 18 or older (not your birth date).

3. What we don't store

Your real name, birth date, profile pictures from Google or Discord, OAuth access tokens, or a history of your IP addresses. IP addresses only appear in technical logs that are deleted after 14 days.

4. Why, and on what legal basis

  • Running the service you signed up for: accounts, clans, matches, notifications (contract, Art. 6(1)(b) GDPR).
  • Fair play: preventing cheating, impersonation and abuse, handling disputes and reports (legitimate interest, Art. 6(1)(f)).
  • Security: protecting accounts and the platform, keeping short technical logs (legitimate interest).
  • Launch waitlist: one email when CODbattles opens, only if you asked for it and confirmed your address (consent, Art. 6(1)(a) GDPR). You can withdraw at any time with the link in our emails.

5. Who processes data for us

  • Brevo (Sendinblue SAS, France, EU): sending emails (address verification, password resets, invites, notifications and, if you asked for it, the launch email). It receives only your address and the email itself.
  • Amazon Web Services (EU region): when switched on, automated AI checks (Amazon Bedrock) of live scoreboard photos and verification photos. Images are sent only for the check and are not used to train models.
  • Sentry (Functional Software, EU region): reports of technical errors so we can fix them. They contain no cookies, no request contents and no email addresses, only your account id.
  • Push services of your browser (e.g. Google, Mozilla, Apple), only if you turn on push notifications: they deliver the title and short text of the notification.
  • Discord, only for clans that connect a channel: we post match times, results and rankings of clans (tags and names, no personal data).
  • The servers running CODbattles are in Italy and operated by us.

We don't sell data and we don't use it for advertising.

6. How long we keep it

  • Uploaded avatar: deleted at once when you replace or remove it, when a moderator removes it, or when you delete your account.
  • Match screenshots: deleted 30 days after the result is final.
  • Verification photos and videos: deleted as soon as a decision is made (only the fingerprint is kept to detect reuse).
  • Read notifications: deleted after 90 days.
  • Your data export file: deleted after 7 days.
  • Launch waitlist: unconfirmed addresses after 7 days; the whole list 30 days after the launch email (or as soon as you unsubscribe).
  • Technical logs and error reports: 14 days for logs, 30 days for error reports.
  • Your account: until you delete it. Deletion happens 14 days after you ask (signing in again cancels it); then your personal data is erased and your matches stay in history as "Deleted user".
  • Moderation records and blocklisted Activision IDs are kept after deletion, to prevent banned players from coming back (legitimate interest).

7. Your rights

You can access, export, correct or delete your data, object to processing based on legitimate interest, and lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali). Write to privacy@codbattles.app; export and deletion are also available in your account settings.

8. Cookies

We only use one strictly necessary cookie to keep you signed in. No tracking or advertising cookies, so there is no cookie banner. If you open a staff member's recruiting link, your browser remembers its code (local storage, at most 7 days) until you sign in.

9. Minimum age

You must be at least 14 years old to create an account (the Italian age of digital consent).