Privacy Policy

1. Introduction

VALIS (“we,” “us,” or “our”) operates the website valis.gg and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By using the Service, you consent to the practices described in this policy.

2. Information We Collect

We collect information you provide directly to us, as well as information generated automatically when you use the Service.

Information you provide:

• Display name (which you agree to keep matched to your Xbox or PlayStation gamertag — see the Terms of Service)
• Email address
• Password (stored as a salted bcrypt hash — we cannot see your password)
• Communication preferences (newsletter opt-in/opt-out)
• User-generated content you post on the Service, including community forum posts, comments, and match chat messages

Information from third parties:

• Discord: If you link your Discord account, we receive your Discord user ID, username, and avatar URL from Discord’s OAuth2 API. We do not receive your Discord password or private messages.

Information collected automatically:

• IP address (used temporarily for rate limiting login and registration attempts — not stored permanently)
• Login timestamps (last login date/time)
• Last display-name-change timestamp (used to enforce the 14-day name change cooldown)
• Session tokens (stored as secure, httponly cookies)
• Match results, Crucible Rating (CR) history, and tournament placement records associated with the teams you participate on. These records are tied to your account through team affiliation rather than directly to your identity.
• Tournament roster snapshots: when staff awards Qualifier Points for a completed qualifier week, the system captures a record of which user IDs were on each signed-up team’s approved roster at that moment. This per-week snapshot is consolidated into a per-minor participation record when each minor concludes. These snapshots are used solely to enforce the team-participation eligibility gates for playoff and major seeding.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Authenticate your identity when you sign in
• Send transactional emails (account verification, password resets)
• Send marketing emails if you have opted in (news, updates, announcements)
• Display your display name and avatar on leaderboards and match history
• Prevent abuse, fraud, and unauthorized access through rate limiting
• Operate and improve the Service

4. Cookies

We use a single essential cookie to maintain your login session:

This cookie is strictly necessary for the Service to function and cannot be disabled. We do not use any analytics, advertising, or tracking cookies. We do not use any third-party cookie-based tracking services.

5. Data Sharing

We do not sell, rent, or trade your personal data to any third parties. We share your data only with the following service providers, solely for the purposes of operating the Service:

• Resend — email delivery service. Receives your email address when we send you emails. Subject to Resend’s Privacy Policy.
• Discord — authentication provider. Receives and provides OAuth2 data during sign-in. Subject to Discord’s Privacy Policy.
• DigitalOcean — hosting provider. Our servers are hosted on DigitalOcean infrastructure. Subject to DigitalOcean’s Privacy Policy.

We may also disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6. Data Storage and Security

Your data is stored on secured servers hosted by DigitalOcean. We implement the following security measures:

• Passwords are hashed using bcrypt with a cost factor of 12 (industry standard)
• All connections are encrypted via HTTPS/TLS
• Session cookies are set with Secure, HttpOnly, and SameSite flags
• CSRF protection is enforced on all state-changing requests
• Security headers (Content-Security-Policy, X-Frame-Options, etc.) are applied to all responses
• Rate limiting is applied to authentication endpoints to prevent brute-force attacks

While we take reasonable precautions to protect your data, no method of electronic storage or transmission over the internet is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account through the Account page, we will delete your personal data (display name, email, password hash, Discord link, session tokens, and verification tokens) immediately. Match history and team data associated with your participation may be retained in anonymized form for the integrity of league records.

Tournament roster snapshots follow a lifecycle aligned to the season:

• Per-week qualifier roster snapshots are retained until the minor tournament they belong to completes. At that point, the per-week rows are rolled up into the per-minor participation record and the per-week rows are deleted.
• Per-minor participation records are retained until the year-end major completes. When the major is marked completed, all per-minor participation rows for that season are purged.

Match chat messages are automatically and permanently purged when staff awards points for the relevant tournament stage (after each qualifier week, after a minor’s playoffs, and at the completion of a year-end major). Match chats are ephemeral by design and are not retained beyond these lifecycle triggers.

Expired session tokens and verification tokens are periodically cleaned from the database.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — You can view all data associated with your account on the Account page.
• Correction — You can update your display name and email address from the Account page.
• Deletion — You can delete your account and all associated personal data from the Account page at any time.
• Opt-out — You can unsubscribe from marketing emails at any time from your Account page or via the link in any marketing email.
• Data portability — You may request a copy of your data by contacting us.

To exercise any of these rights, use the self-service options on your Account page or contact us at competitive@valis.gg.

9. Children’s Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us.

10. International Users

If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located. By using the Service, you consent to the transfer of your information to the United States.

For users in the European Economic Area (EEA), United Kingdom, or other jurisdictions with data protection laws: we process your data based on your consent (provided when you create an account and agree to the Terms of Service) and our legitimate interest in operating the Service.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy. We encourage you to review this page periodically.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at competitive@valis.gg or through our Discord server.