PRIVACY POLICY

1. Who we are

ScrimX is an esports platform operated by Starcode Tech vl. Karlo Starčević, a sole proprietorship (obrt) registered in the Republic of Croatia. We are the data controller for everything described here.

• Contact: info@starcode.tech
• Website: scrimx.com
• Supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), azop.hr

This policy is written to the GDPR (EU 2016/679) and the Croatian Data Protection Act. If you are in California, section 9 covers the CCPA rights that apply to you.

2. What we collect

2.1 Your account

• Email address and a password, stored only as a bcrypt hash. We never hold your password.
• Nickname, and your first and last name.
• Date of birth. Required to register. See section 7.
• Country, if you pick one. It is shown publicly as a flag beside your name.
• Play region, which decides the matchmaking pool you are placed in.
• Profile picture and bio, if you add them.

2.2 Playing

• Linked game accounts: your Steam ID or Epic display name and account id, the avatar the platform returns, and whether it reports that you own the game.
• A record of every account you have ever linked, including ones you later unlinked. This is kept deliberately: it is what stops a banned player returning on a fresh account, and it is not erased by unlinking.
• Rank checks: the in-game rank we read for you, when we read it, and whether it cleared the entry requirement. Both successes and failures are recorded, because that record is what rations the daily check.
• Teams, rosters and invitations, and your history of joining and leaving.
• Matches: scrims and tournament matches, lineups, the scores reported, your rating and its history, and screenshots uploaded as evidence with a report or a dispute.
• Reliability: whether you accepted, showed up and reported on time, and any penalty that followed.

2.3 Money and prizes

• Payments are handled by Stripe. We never see or store your card number. We keep your Stripe customer, subscription and payment-method identifiers, your plan, and its status and dates.
• Coins: your balance and every transaction that changed it.
• A postal address, only if you win or redeem something physical and only after the order is approved: name, address, city, postcode, country and phone. An order that is turned down never causes an address to exist. It is readable only by staff with the fulfilment permission and appears in no other part of the platform.

2.4 Streaming

• The Twitch or Kick channel you add, and whether it is currently live. We read the live status from those platforms on a schedule; we do not watch, record or store your streams.

2.5 Automatically

• Your IP address, used to rate-limit sign-in and other expensive operations. It is not stored against your profile.
• Server logs of requests and errors. These identify you by account id, never by email address.
• An audit trail of staff actions and of moderation: who did what, to whom, and when. Bans, timeouts, reports made about you and reports you made are kept as records.
• Analytics, only if you consent. See the Cookie Policy.

3. Why we are allowed to (GDPR Art. 6)

• To give you the service you signed up for (Art. 6(1)(b)): your account, your teams, matchmaking, ranking, tournaments, subscriptions and prize fulfilment.
• Because the law requires it (Art. 6(1)(c)): verifying that you are old enough, and keeping invoices and payment records for Croatian tax purposes.
• Because we have a legitimate interest (Art. 6(1)(f)): keeping competition honest and the platform safe. This is what covers moderation records, the link history that survives an unlink, rate limiting and abuse prevention. You can object, and section 9 says how.
• Because you agreed (Art. 6(1)(a)): analytics and marketing email. You can withdraw at any time, and nothing about the service changes if you do.

4. What other people can see

Some of your profile is public, because a competitive platform has to show who is playing. Publicly visible: your nickname and display name, your profile picture, your bio, your country flag, your rank and leaderboard position, the teams you play for, cosmetics you have equipped, and any channel you linked.

Never public: your email address, your date of birth, your postal address, your payment details, your IP address, and anything in your moderation record. Teammates and opponents see the same public profile anyone else does.

5. Who we share it with

We do not sell your personal data and we never have. We share only what each of these needs to do its job:

• Railway - hosting, database and logs.
• Stripe - payments. Your card details go to Stripe directly and never through us. Their policy.
• Resend - sending the email we owe you: verification, password resets, billing notices.
• Steam and Epic Games - when you link an account, to confirm it is yours.
• A Rocket League statistics provider (via RapidAPI) - when a rank check runs, we send the platform account id you linked and nothing else about you.
• Twitch and Kick - to read whether a channel you added is live.
• Object storage - the images you upload.
• Google Analytics - only with your consent. Their policy.

We also disclose data where the law compels us to, and to the extent necessary to establish or defend a legal claim.

Some of these process data outside the EEA. Where they do, the transfer rests on the European Commission's Standard Contractual Clauses or an adequacy decision, depending on the provider.

6. Images you upload

Avatars, team crests, tournament banners and match screenshots are served from a public address. The address contains a random identifier and is not listed or guessable, but anyone who has the link can open the file without signing in, which is how images work on every platform of this kind.

Treat a screenshot as public once you upload it. Do not upload anything you would not want seen, and redact anything in a screenshot that does not belong to the match.

7. Age, and your date of birth

ScrimX is for players aged 16 and over. 16 is the default age of digital consent under GDPR Article 8, and it is the age Croatia kept. Tournaments are open to players 18 and over, because they carry prizes.

We ask for your date of birth once, when you register. We store the date itself, we do not show it to any other player, and nothing we publish is derived from it beyond whether you clear those two thresholds. If you created an account before we started asking, we will ask before you next queue, enter a tournament or start a plan.

It is recorded once and you cannot change it yourself. That is deliberate: a date you could edit would be edited whenever it stood in the way. If you enter it wrongly, contact us and we will correct it.

If a date of birth tells us someone is under 16, we record it and suspend the account rather than deleting it, so we do not lose the reason the account was closed. If you believe a child has given us data, contact us and we will deal with it.

8. How long we keep it

• Your account and what is attached to it: while your account exists. When you ask us to delete it, we erase your personal data within 30 days, except where a line below says otherwise.
• Payment and invoice records: 11 years, which Croatian tax law requires and which your deletion request cannot shorten.
• Moderation and platform-identity records: kept after an account closes, because a ban that a new account erases is not a ban. These are reduced to the identifiers that make them work.
• Match results and leaderboard history: kept, with your name detached from them after deletion, so other players' records and past standings stay intact.
• Verification codes and password reset links: 15 minutes.
• Postal addresses: until the order has been delivered and any return window has closed.
• Server logs: for as long as our hosting provider retains them.
• Analytics: 14 months.

9. Your rights

Under the GDPR you can ask us to:

• Show you what we hold (Art. 15) and give you a copy.
• Correct it (Art. 16) if it is wrong.
• Delete it (Art. 17), subject to the retention above.
• Restrict what we do with it (Art. 18) while a dispute is resolved.
• Hand it over (Art. 20) in a machine-readable form.
• Object (Art. 21) to anything we do on the basis of legitimate interest.
• Withdraw consent (Art. 7(3)) for analytics or marketing, at any time.

Email info@starcode.tech from the address on your account and we will answer within 30 days. These requests are handled by a person, not a button in the app; if that changes we will say so here. You can also complain to AZOP, or to your own supervisory authority if you live elsewhere in the EEA.

California residents: you have the right to know what we collect and why, to have it deleted, and not to be treated differently for asking. We do not sell personal information, so there is nothing to opt out of. We answer within 45 days.

10. How we protect it

• Passwords are hashed with bcrypt at cost factor 12.
• Sign-in uses a short-lived access token (15 minutes) and a rotating refresh token (7 days), each session tracked separately so you can be signed in on several devices and revoke them.
• Everything travels over HTTPS.
• Every request is authenticated and authorized on the server. Being signed in is never enough on its own; we check that the specific thing you are asking for is yours.
• Staff access is governed by named permissions rather than a blanket admin flag, and privileged actions are written to an audit log.
• Sign-in, password reset and other expensive endpoints are rate-limited.
• Our logs identify you by account id. Passwords, tokens and email addresses are not written to them.

No system is perfectly secure and we will not pretend otherwise. If a breach puts your rights at risk we will tell the supervisory authority within 72 hours and tell you without undue delay.

11. Automated decisions

Some things happen without a person involved: your rating moves after a match, a missed match costs you reliability and can suspend you from the queue for a while, and a rank below the entry requirement keeps you out of a playlist. These follow published rules rather than a profile of you, and none of them has a legal effect in the sense of Article 22. A human reviews any ban, and you can appeal one by writing to us.

12. Changes

We will post any update here and change the date at the top. If a change matters to you - something new collected, or something used for a new purpose - we will tell you in the app or by email before it takes effect.

13. Contact

• Email: info@starcode.tech
• Business: Starcode Tech vl. Karlo Starčević, Republic of Croatia