This Privacy Policy explains how the operator of Play SC:BW ("Operator", "we", "us") handles personal data in connection with the website at playscbw.com and every related page, game client, relay, feature and service (the "Service"). Capitalised terms not defined here have the meaning given in the Terms of Service.
This Policy is a notice. It describes our practices; it is not a contract and does not create any right or obligation beyond those that applicable law provides. If you do not want your data handled as described here, do not use the Service.
1. Who is responsible
The controller of personal data processed through the Service is the Operator of Play SC:BW. For everything relating to privacy, contact [email protected]. We will ask you to prove control of the account or email address concerned before acting on a request.
2. Data we process
2.1 Data you give us.
- Account data: email address, password (stored only as a salted cryptographic hash), handle, country, language, and the sign-up method you used. If you sign in through a third-party provider such as Google, we receive the identifier, email address and basic profile information that provider shares with us.
- Profile and community data: anything you add to your profile, chat messages, reports you file about other users, and messages you send us.
- Agreement records: which version of our legal documents you accepted or acknowledged, when, and technical evidence of that act.
2.2 Data generated when you use the Service.
- Gameplay data: the games you create or join, opponents, races, maps, game commands, results, durations, disconnections, ratings, rankings, statistics, replays and match history.
- Technical and security data: IP address, approximate location derived from it (city and country), date and time of requests, sign-in history, active sessions, browser and device type, operating system, language, referring page, error and performance information, and signals used to detect bots, abuse, cheating and multiple accounts.
- Connection data: when you play online, your device connects to our relay, which necessarily processes your IP address and the game traffic you send.
2.3 Data stored on your device. The Service uses cookies, local storage and your browser's cache as described in the Cookie Policy. Game data that your device obtains is cached locally in your browser, on your device, under your control. It is not sent to us.
2.4 Data we do not want. Do not send us special categories of personal data (such as data about health, beliefs, or sexual orientation), government identifiers, or anyone else's personal data. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will delete it.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (where a legal basis is required) |
|---|---|
| Creating and running your account, matchmaking, running games, ratings, ladders, replays, match history and public profiles | Performance of our contract with you |
| Keeping the Service secure; preventing, detecting and investigating cheating, fraud, abuse, multiple accounts and breaches of our Terms; enforcing bans | Our legitimate interests in a safe and fair Service; legal obligation where applicable |
| Keeping records of what you agreed to | Our legitimate interests in establishing, exercising and defending legal claims |
| Service and transactional messages (verification, security, policy changes, receipts) | Performance of contract; legitimate interests |
| Understanding use of the Service, fixing faults, developing and improving features, including automated and AI Features, on the basis of gameplay data and aggregated or de-identified data | Our legitimate interests in operating and improving the Service |
| Optional communications such as newsletters, if we offer them | Your consent, which you can withdraw at any time |
| Complying with law and responding to lawful requests; protecting our rights, users and the public | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have concluded that they are not overridden by your interests, given the nature of the Service and the limited data involved. Providing account data is necessary to have an account; without it we cannot provide one.
4. What is public
Play SC:BW is a competitive community service, and gameplay records are public by design. Your handle, country, race, ratings, rankings, statistics, match results, match history, replays and profile may be visible to anyone on the internet, may be indexed by search engines, may appear in other users' streams and videos, and may be copied by third parties outside our control. Chat messages are visible to the other participants. Choose a handle that does not identify you if you do not wish to be identified. Your email address is never shown publicly.
5. Who receives personal data
We do not sell or rent personal data, we show no advertising, and we do not share personal data for advertising of any kind. We disclose it only to:
- Service providers that process it on our behalf, in these categories only: hosting and infrastructure; content delivery, network security and bot protection (a provider in this category may set its own strictly necessary cookies and necessarily processes your IP address); transactional email delivery; file and backup storage; sign-in providers that you choose to use; operational monitoring and alerting; and, if we offer AI Features, the technology providers that power them. We choose providers with data minimisation in mind and give them no more than they need.
- Other users and the public, for the data described in Section 4.
- Authorities, courts, rights holders and other third parties, where we believe in good faith that disclosure is required by law or legal process, or is reasonably necessary to enforce our Terms, to investigate or defend against claims, or to protect the rights, property or safety of the Operator, our users or others.
- Successors, in connection with any actual or proposed merger, acquisition, financing, reorganisation, or transfer of the Service or its assets to a new operator, in which case personal data may be among the assets transferred.
We may use and disclose aggregated or de-identified information that cannot reasonably identify you for any purpose.
6. Connections your device makes to third parties
Some functions cause your device to connect directly to services that we do not operate or control, for example public internet archives and hosts from which your device obtains game data, video and audio platforms used for optional media, font and script hosts, sign-in providers and streaming platforms. When your device makes such a connection, that third party receives your IP address and standard browser information directly from your device and processes it as an independent controller under its own privacy policy. We do not control, and are not responsible for, those third parties or what they do with that information. If you do not want your device to make those connections, do not use the relevant function.
7. International transfers
We and our service providers may process personal data in countries other than the one where you live, whose laws may offer a different level of protection. Where the law requires it, transfers are made under recognised safeguards such as an adequacy decision or standard contractual clauses. By using the Service you understand that your data will be transferred to and processed in those countries.
8. How long we keep data
We keep personal data for as long as your account exists and afterwards for as long as we have a legitimate need, in particular:
- account data: until the account is deleted, then for a limited period in backups and as needed for the purposes below;
- gameplay records, results, ratings, replays and match history: indefinitely, because they form part of the competitive record of other players and of the Service. After account deletion they are kept in a form not linked to your email address and may continue to show the handle you played under or a placeholder;
- security logs and abuse signals, including records of bans and the identifiers needed to enforce them: for as long as needed to keep the Service secure and to prevent banned users from returning;
- records of the legal documents you accepted: for as long as claims could be brought in connection with them, which may be indefinitely;
9. Security
We use technical and organisational measures appropriate to a community project of this kind, including encryption in transit, hashed passwords and access controls. No system is perfectly secure, and we do not guarantee the security of any data. You are responsible for using a strong, unique password and for keeping it secret. To the fullest extent permitted by law, we are not liable for unauthorised access that is outside our reasonable control.
10. Your choices and rights
You can review and change much of your account data, and delete your account, in your account settings.
Depending on where you live, the law may also give you the right to request access to, correction of, deletion of, restriction of or a portable copy of your personal data; to object to processing based on legitimate interests; to withdraw consent where processing is based on consent (without affecting earlier processing); not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects; and to lodge a complaint with your local data protection authority. Residents of certain US states, including California, may have rights to know, delete and correct, and the right not to be discriminated against for exercising them. We do not sell or "share" personal information as those terms are defined in California law, and we do not use sensitive personal information for purposes that would require a right to limit.
To exercise a right, write to [email protected] from the email address on your account. We may need to verify your identity, and we may decline or limit a request where the law allows, for example where data is needed to keep the Service secure, to enforce a ban, to preserve the integrity of other players' competitive records, or to establish, exercise or defend legal claims. Automated systems are used to detect cheating and abuse; decisions to restrict an account may be made or assisted by those systems.
Your browser may offer a "Do Not Track" signal. There is no common standard for it, and the Service does not respond to it. We do not engage in cross-site tracking for advertising.
11. Changes
We may update this Policy at any time by posting a new version here and changing the "Last updated" date. Changes take effect when posted. Where the law requires it, we will give additional notice or ask for consent.
12. Contact
Privacy questions and requests: [email protected].