Privacy policy
Last updated
This policy covers lobbyfill.com, the tournament app at t.lobbyfill.com, the API at api.lobbyfill.com and the LobbyFill Discord bots. It explains what we store, why, for how long and what you can do about it.
Who is responsible
Pending legal review
The data controller’s name, address, registration number and privacy contact still have to be confirmed. They will be listed here before launch.
Cookies and local storage
We set one cookie, and only when you sign in: lf_session on .lobbyfill.com. It keeps you signed in across lobbyfill.com and t.lobbyfill.com. It is a functional cookie (HttpOnly, Secure, SameSite=Lax), holds a random token and expires 30 days after you last used the site. We only store a hash of the token.
When you close the cookie notice, your browser remembers that in local storage (lf_cookie_notice_dismissed). That value never leaves your device.
We don’t use analytics, advertising trackers or third-party cookies. Our fonts are served from our own servers. Ads on tournament pages are served by LobbyFill itself: we count impressions and clicks per day, and store IP addresses only as salted hashes to filter out duplicates and abuse.
What we store and why
Your Discord account
You sign in with Discord. We receive and store your Discord ID, username, display name and avatar, and the list of servers you’re in (Discord’s guilds scope). We use the server list to check tournament requirements (for example “join this server”) and to let you list servers you manage. If a cup requires a role in a server where our bot isn’t present, we also ask for your roles in that server.
Your email address is optional. The sign-in page has a switch “Also share my email”. When it’s on, we use your email only for check-in reminders, lobby details when a Discord DM can’t be delivered, and receipts. When it’s off, we don’t request or store it. You can turn it off later in your profile settings, which deletes the stored address.
Linked accounts
- Twitch (optional): your Twitch username and ID, and permission to check whether you follow a channel, so we can verify follow requirements.
- Epic Games (needed for Epic games such as Fortnite): your Epic account ID and display name, used as your in-game name when you register.
- TikTok and X (optional): the handle you enter. We can’t verify these, so they’re shown to organizers as not verified.
Access tokens for linked accounts are stored encrypted.
Tournaments, teams and servers
Registrations, check-ins, teams, results and leaderboard positions. Your display name, team name and results are public on participant lists and leaderboards. Organizers see the registration details they need to run their cup. If you list a Discord server or vote for one, we store the listing and your votes.
Payments
Featured servers, featured cups and ad packages are paid through Stripe. Stripe handles your card details; we never see them. We store the order, its status and the subscription state.
Contact forms
When you use the “Book an ad” or “Talk to us” form, we store your name, email, company or community and your message, plus a salted hash of your IP address for spam protection. We email the request to our team and a confirmation to you.
Discord bots
Our bots send you DMs about cups you registered for and process votes made with /vote. In the LobbyFill Discord server, the moderation bot keeps moderation cases, activity levels and support ticket transcripts.
Legal bases
- Contract: your account, registrations, check-ins, results and purchases.
- Consent: your email address and linked accounts. You can withdraw it at any time in your profile settings.
- Legitimate interest: security, rate limiting, spam protection, fair play and moderation, and aggregated ad statistics.
- Legal obligation: keeping payment records.
Who processes your data
- OVHcloud hosts our servers and database in the EU.
- Discord for sign-in, bots and DMs.
- Stripe for payments.
- Resend for email.
- Twitch and Epic Games, only when you link those accounts.
Some of these providers are based outside the EU and may process data there under their own transfer safeguards.
Pending legal review
Confirm the processing agreements and international transfer mechanisms for each provider, and the legal bases above.
How long we keep it
- Sessions: until you sign out, or 30 days after you last used LobbyFill.
- Your account: until you delete it. Deleting anonymises your account and ends all sessions; results stay on leaderboards without your name.
- Your email address: until you turn off email sharing or delete your account.
- Contact form requests: period pending legal review.
- Payment records: period pending legal review.
- Database backups: a rolling 14 days.
Your rights
You can ask for access to your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Most of this is self-service in your profile settings on t.lobbyfill.com:
- Export your data: downloads everything we hold about you as a JSON file.
- Delete your account: anonymises your account and signs you out everywhere.
- Turn email sharing off, and disconnect Twitch, Epic Games, TikTok or X.
For anything else, contact us using the details under “Who is responsible”. You can also lodge a complaint with a data protection authority.
Changes
If we change how we handle personal data, we update this page and the date at the top.