Privacy Policy

Last updated: 12 September 2026

1. Who we are

AirsoftStats ("we", "us") is operated by Vlad Pustea, based in England, United Kingdom. We are the data controller for the personal data described in this policy under the UK GDPR and, for users in the EEA, the EU GDPR. You can reach us at privacy@airsoftstats.com.

2. What we collect and why

• Account data — username, email address and a salted hash of your password (we never store the password itself). Used to create and secure your account and to send account emails (verification, password reset). Legal basis: performance of a contract (Art. 6(1)(b)).
• Profile data — optional bio, avatar photo and privacy setting. Shown on your public profile according to the visibility you choose. Legal basis: contract.
• Match and loadout data — the matches, kills/deaths, locations, notes, kits and kit photos you log. This is the core purpose of the service. Legal basis: contract.
• Consent record — the time you accepted this policy at signup. Legal basis: legal obligation (Art. 7(1)).
• Technical data — IP address, user agent and request logs are processed transiently by our hosting provider to deliver the site, prevent abuse (rate limiting) and diagnose errors. Legal basis: legitimate interest (Art. 6(1)(f)) in keeping the service secure.

We do not use advertising, tracking cookies or third-party analytics. The only browser storage we use is a login token in localStorage, which is strictly necessary to keep you signed in.

3. Who we share it with

We use the following processors, each bound by a data-processing agreement, to run the service:

• Cloudflare, Inc. — hosting of the website and API, the D1 database holding your account, profile, match and kit data, storage of uploaded photos (R2), request logs and DDoS/rate-limit protection.
• Resend, Inc. — delivery of verification and password-reset emails.

Some of these providers process data outside the UK and EEA (notably in the United States). Transfers rely on the UK Extension to the EU–US Data Privacy Framework and/or the UK International Data Transfer Agreement / Standard Contractual Clauses. We do not sell personal data.

4. Public profiles

By default your username, bio, avatar, career stats, featured kits and public matches are visible to anyone at /u/your-username. You can restrict this to "stats only" or make your profile fully private at any time in Settings. Individual matches can also be marked private. Your email address is never shown publicly.

5. How long we keep it

• Account, profile, match and kit data: until you delete your account.
• Email verification / password-reset tokens: deleted within 7 days of expiry or use.
• Uploaded photos: deleted together with your account.
• Hosting request logs: retained by Cloudflare for a short rolling window (currently up to 7 days).

6. Your rights

Under the GDPR you have the right to:

• Access and portability — download a machine-readable copy of all your data with "Download my data" in Settings.
• Rectification — edit your profile, kits and matches at any time.
• Erasure — permanently delete your account and all associated data with "Delete account" in Settings. Deletion is immediate and irreversible.
• Restriction and objection — set your profile to private to stop public processing, or contact us to object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting prior processing.
• Complain — you may lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EEA, your local data protection authority.

To exercise any right that is not self-service, email privacy@airsoftstats.com. We respond within one month.

7. Security

All traffic is encrypted with TLS. Passwords are stored as salted PBKDF2-SHA256 hashes. Login and account endpoints are rate-limited, sessions can be revoked from Settings, and uploaded images are validated server-side. Access to production systems is restricted to the operator.

8. Children

The service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

9. Changes

We will post any changes to this policy on this page and update the date above. Material changes will be announced on the site before they take effect.