Privacy policy
Controller
Hosting
Server: OVH, France. The site is delivered through Cloudflare (USA), which processes your IP address to do so; transfers rely on the EU-US Data Privacy Framework. There are no access logs; IP addresses are held in memory only briefly to limit requests.
Data stored
- Browser id: random, stored as a hash, with the tierlists the browser belongs to. Deleted after a day without a membership.
- Tierlists: name, member names, images (metadata removed), texts, votes, invites. Deleted one day after the last activity or after the period set by the owner (up to 14 days); tierlists kept by the administration until deleted.
- Accounts: username, display name, settings, password hash, signed-in devices. Until the account is deleted.
- Templates: public until unpublished or deleted.
Cookies and local storage
Strictly necessary only (ePrivacy Directive Art. 5(3)):
- tm_client: browser id, 400 days.
- tm_session: sign-in, 30 days.
- tm_admin: administration sign-in, 12 hours.
- Local storage: last used name, settings, keys of tierlists you created.
Legal bases
Providing the service (Art. 6(1)(b) GDPR), security (Art. 6(1)(f) GDPR).
Your rights
Access, rectification, erasure, restriction, data portability, objection (Art. 15–21 GDPR) and complaint to a supervisory authority (Art. 77 GDPR).