Privacy policy

Who is responsible

BrawlHub GG is a Brawl Stars fan website made by Miguel López Soriano ("we"), tax ID 18470711D, address Calle Villacisneros 7, 44003 Teruel (España) (more details in the legal notice). For any privacy matter, write to [email protected] or from the contact page and choose the "My account" reason.

In short

• You don't need an account or to give us any data to use the website.
• If you log in with Discord, we keep the minimum for your account: your Discord ID and names, and what you do on the website. Never your Discord picture; your email only if you turn on news emails.
• The Brawl Stars player data we show is public: it comes from Supercell's official API.
• We count visits with our own anonymous analytics, without cookies. There are no third-party analytics or advertising cookies, and we don't sell data to anyone.
• You can delete your account and your history from "My account" whenever you want.

Public Brawl Stars data

We show player and club profiles (tag, name, icon, trophies, brawlers, battle log, club, etc.) that Supercell publishes in its official API for anyone. For search and statistics we keep a directory with the basic data of the players and clubs that appear in leaderboards, battles and viewed profiles.

We do this based on legitimate interest: offering statistics about a game from data that is already public. If it's your account and you don't want to appear, write to us and we'll remove it from the directory and our own statistics.

Your BrawlHub GG account

Your account is created when you log in with Discord (we ask for the "identify" permission; the "email" one only if you turn on news emails). We keep your Discord ID, your username and display name, the avatar you choose on the website (a brawler and a color), the date you joined and your last visit, and your open sessions: an encrypted digest of the token and, so you can recognise and close them from "My account", the browser and operating system of each one (what your browser sends), the country it was used from (not the IP address, which we don't store) and when it was opened and last used. We don't keep your Discord picture, nor your email unless you turn on news emails, and the permission Discord gives us is used once and discarded.

We also keep what you do with your account: the Brawl Stars accounts you link (to verify them we ask you to set an icon for a few minutes), their tracking and privacy settings, your favorites, your catalog marks and the expired QR code reports you send.

The legal basis is providing the service you ask for when you create the account (Article 6(1)(b) GDPR). Without Discord's "identify" permission the account can't be created; the rest of the website can be used without one.

Account and club tracking

If you turn on tracking for a linked account (or its club, if you're president or vice-president), we check it regularly and keep its history: battles, daily profile snapshots, progress and events. This is game data that is also public. New data is only collected while tracking is on; what is already saved is kept until you delete it, and it can be hidden from others in "My account". Club tracking also keeps the public activity of its members within the club (joins, leaves, roles and trophies). The legal basis is providing the service you ask for.

Discord bot and server

If you use our Discord bot or join our server from the website, we process your Discord ID, the servers where the bot is and their settings, the alerts that admins set up in each server (with the bot or the website panel) and the personal alerts you sign up for, such as new QR codes or the maps you pick by direct message. To join the server from the website, Discord gives us a permission that is used at that moment and not kept. The legal basis is providing the service you ask for; the data is kept while the bot stays in the server or the alert stays on.

If you have an account on the website, the bot can show your main Brawl Stars account to anyone who uses /profile or /compare mentioning your Discord username: only which account it is, which is already public in the game (anything you set as private doesn’t show). It’s on by default and you can turn it off anytime in “My account” → “Find me by my Discord @”; you can still see your own profile.

Battle card creator

If you upload your own image to the battle card creator, you crop and place it in your browser: nothing reaches us while you build the card. Only when you press "Download" is it sent to our server, together with the card settings, to compose the image or video we send back. It is used only for that: it is never published or shared with anyone, and we delete it, together with the generated card, as soon as we send it to you. To prevent abuse we limit how many downloads can be made per hour, using a fingerprint of your IP address that does not store the IP and expires within an hour.

Contact form

If you write to us, we receive your email, your name if you give it and your message in our mailbox, so we can reply (legitimate interest in answering you). To stop spam we use Cloudflare Turnstile and count submissions per IP for one hour, keeping only a hash of the IP, never the IP itself (legitimate interest in keeping the website secure).

News emails

If you are at least 14 and turn them on in "My account", we email you the news from the sections you choose (Brawl Stars news, BrawlHub GG updates), in the language you choose. We use the verified email of your Discord account, which Discord gives us with your permission (the "email" permission), and we keep proof of your consent: the date, the IP you gave it from and the version of the text you accepted.

The legal basis is your consent. You can withdraw it at any time from "My account" or with the "Unsubscribe" link in every email. The emails are sent with Postmark; we don’t track whether you open them or which links you click. If an email bounces or is marked as spam, we stop emailing you. Replies to those emails reach our contact inbox.

Launch notice

If you left your email on the "Coming soon" page to be notified, we only use it for that notice and delete it after sending it.

Cookies and local storage

We only use what is needed for the website to work, which is why we don't ask for consent:

• bh_s: your session, if you log in (30 days from your last visit and, at most, 180 days).
• bh_in: tells the page that a session is open (same as bh_s).
• bh_os: protects the Discord login (10 minutes).
• Cloudflare (for example, __cf_bm or cf_clearance): security and bot protection.
• bh_local_country: the country you choose in the local leaderboards (1 year).
• Browser local storage: preferences such as filters, language or the last tab you opened. It never leaves your browser.
• Visit statistics: we count page views with Umami, hosted on our own server, anonymously and without cookies or anything stored in your browser.
• Google Translate: only if you press "Translate" on a QR code note, Google Translate is loaded; it receives that text and your IP address and processes them under Google's privacy policy. We delete the cookie it leaves (googtrans) when you are done.

Who we share data with

We don't sell or give away data. It is processed, on our behalf and only for what we ask, by the providers that run the website:

• Cloudflare (United States): content delivery, security and Turnstile.
• InterServer (United States): the server that hosts the website.
• IONOS (European Union) and Postmark (United States): sending and receiving email.
• Also, Discord (United States), which you log in with and where the bot runs, processes your data as an independent controller, under its own privacy policy.
• Supercell is only the source of the public game data: we don't send it any of your data.

Transfers outside the European Union

Some providers are in the United States. Transfers are made with the safeguards provided by the GDPR: the EU-US Data Privacy Framework when the provider is certified, or the European Commission's standard contractual clauses.

How long we keep data

• Account and what you save in it: while the account exists. If you delete it, it is erased after 28 days (you can cancel by logging in before then) together with the history of the profiles you choose.
• Tracking history: while the account stays linked, even if tracking is paused. When you unlink it you can ask for it to be deleted, and it is deleted after 28 days.
• Sessions: 30 days without use and, at most, 180 days after they are opened, or until you log them out.
• Player and club directory: while the profile exists in the game, or until you ask us to remove it.
• Contact messages: as long as needed to handle them and at most one year.
• Launch notice emails: until the notice is sent.
• Email address for news emails: while you have them turned on or until you delete your account. If you unsubscribe, we keep your address and proof of consent only so we don’t email you again and can show you asked for it.
• Technical server logs (IP, requested page): a few weeks, for security.

Your rights

You can access, correct and delete your data, object to or restrict its use, and ask for a copy. Much of it can be done directly in "My account" (delete the account, unlink profiles, tracking privacy); for anything else, write to us from the contact page. Where the legal basis is your consent, you can withdraw it at any time. We don't make automated decisions or build profiles with legal effects on you (the website's statistics and estimates are not that). If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority in your country.

Children

To create an account you must be at least 14 years old or have permission from your parent or guardian (and meet Discord's minimum age). News emails are only for people aged 14 or over. If you are a parent or guardian and believe your child has given us data without permission, write to us and we'll delete it.

Changes

If we change anything important in this policy (for example, if we add ads), we'll update it here and, where required, ask for your permission first.