Privacy Policy

1. Introduction

Welcome to Esport Agenda. We respect your privacy and are committed to protecting your personal data. This policy explains what data we collect, how it is used, and your rights under the GDPR (EU Regulation 2016/679).

2. Data We Collect

Browsing the site does not require an account: no personal data is collected from anonymous visitors, apart from technical data processed for rate limiting (see below).

If you create an account (via Discord, Google, Twitch, Steam OAuth, or email/password), we store: your email address, display name, username, profile picture URL, and a list of your favorite teams and tournaments. Depending on the provider we also store the corresponding provider account ID (Discord user ID, Google sub, Twitch ID, SteamID) and OAuth tokens (access token, refresh token, token scope) required to maintain your session. If an existing email account is linked to a new OAuth login on the same email, they are automatically merged: this is disclosed at sign-in.

If you opt into Pick'em, bracket predictions, achievements or the leaderboard, we store your picks, points, ELO/rank, streaks and unlocked achievements. Your username, avatar and pick statistics are publicly visible on the leaderboard and on your public profile page (/profile/<username>). Individual picks remain private until the match is resolved.

If you subscribe to the newsletter, we store your email preferences (daily/weekly cadence, game and team filters, preferred language, unsubscribe token). Emails are sent via Resend.

If you enable push notifications, we store the Web Push endpoint URL and encryption keys (p256dh, auth) provided by your browser on our server so our cron can deliver reminder pushes.

Technical data: for security and abuse prevention, our middleware temporarily keeps your IP address in memory (maximum 60 seconds) to enforce per-IP rate limits on API routes. This processing is based on our legitimate interest (GDPR Art. 6(1)(f)).

3. Local Storage

We use your browser's Local Storage (not cookies) to save your preferences locally on your device. The following keys are used:

esport-agenda-storage: your theme, sidebar state, anti-spoiler mode, and favorite IDs
esport_agenda_lang: your chosen language
cookie_consent: your consent choice (functional, analytics, or all)
cookie_consent_date: the date you recorded that choice
esport_agenda_reminder_onboarded: whether you have seen the match reminder onboarding prompt

We also use IndexedDB (via the idb-keyval library) to store your local match reminders. Each reminder contains: the match ID, team names, game name, and scheduled time. Local reminder data stays on your device.

If you enable match reminders and grant browser notification permission, a Service Worker runs in the background to trigger local notifications at the scheduled time. If you additionally opt into server-side push notifications, the browser-generated Web Push endpoint and encryption keys are sent to our server so we can deliver pushes even when the tab is closed. You can revoke notifications at any time from your browser settings or from /reminders.

4. Cookies & Browser Storage

We use Local Storage (not cookies) to save your preferences locally. Functional entries are always active, required for the site to work, have no expiry, and are not shared with third parties. Our consent banner exposes three tiers: Functional only (essentials only), Analytics (also loads product analytics), and Accept all (adds Google Analytics/GTM). You can reopen and change this at any time via the Cookies & Privacy button in the footer. We also honour the Global Privacy Control (GPC) browser signal: if GPC is enabled we apply the functional-only tier automatically.

5. Third-Party Services & Subprocessors

The following third-party services may receive data in the course of operating this site:

Google LLC (Google Cloud Run): infrastructure hosting, single region europe-west1 (Belgium). DPA
Supabase Inc.: PostgreSQL database hosting in the EU. Stores authenticated user data (email, favorites, sessions, newsletter preferences, picks, bracket predictions, achievements, push subscription endpoints). Privacy Policy
PandaScore SAS: esports data API. Receives match filter parameters (game, team names, date range) — no user data. Privacy Policy
Discord Inc. (OAuth): provides email, Discord user ID, username, avatar URL at sign-in. Privacy Policy
Google LLC (OAuth): provides email, Google sub ID, name, avatar URL at sign-in. Privacy Policy
Twitch Interactive / Amazon (OAuth): provides email, Twitch user ID, display name, avatar URL at sign-in. Privacy Policy
Valve Corp. (Steam OpenID): authenticates your SteamID only; no email or profile data is transferred. Privacy Policy
Resend (Resend.com Inc.): transactional and newsletter email delivery. Receives your email address, display name, and the email payload when we send a briefing, recap, or account email. Privacy Policy
PostHog (EU cloud): product analytics, loaded only with your consent. Uses a same-origin reverse proxy on /ingest to improve reliability. Privacy Policy
Google LLC (Google Analytics / GTM): analytics tracking, loaded only when you consent to "Accept all" cookies. Privacy Policy
Twitch / YouTube / Kick: embedded stream players. When you watch a live stream, the respective platform may set cookies and collect usage data under its own privacy policy.

6. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights under the GDPR:

Right of access (Art. 15): request a copy of the personal data we hold about you
Right to erasure (Art. 17): request deletion of your personal data
Right to rectification (Art. 16): request correction of inaccurate data
Right to data portability (Art. 20): receive your data in a machine-readable format
Right to restrict processing (Art. 18): ask us to limit how we use your data
Right to object (Art. 21): object to processing based on legitimate interest

To exercise any of these rights, send an email to contact@esportagenda.com. We will respond within 30 days. You also have the right to lodge a complaint with the French data protection authority: CNIL (www.cnil.fr).

Public Profile & Leaderboard

If you participate in Pick'em, bracket predictions, achievements, or share cards, the following information is publicly visible to anyone (including search engines):

Username and avatar
Rank, ELO tier, total points, current and best streak
Achievement badges you have unlocked
Historical picks after the corresponding match has resolved

Individual picks before lock-in, your email address, OAuth provider IDs, push subscriptions, favorites and newsletter preferences are never public. You can leave the leaderboard and wipe pick history by deleting your account in Settings.

Newsletter & Transactional Emails

If you opt in, we send you daily/weekly match briefings and Pick'em recaps. Delivery is handled by Resend (EU data residency available). We store your email, frequency preferences, game/team filters, language and a unique unsubscribe token.

Every email contains a one-click unsubscribe link, and you can fully manage or disable the newsletter from /newsletter/subscribe. Transactional emails (account recovery, security) are sent on the legal basis of contract performance and cannot be unsubscribed while your account is active.

Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

Account data (email, username, avatar, OAuth IDs): retained until you delete your account
Favorites (teams / tournaments): until you remove them or delete your account
Session tokens: 30 days maximum
Picks, bracket predictions, achievements, ELO/rank: until you delete your account or the season ends and stats are aggregated
Newsletter preferences: until you unsubscribe or delete your account; unsubscribe tokens kept indefinitely to honour unsubscribe links in past emails
Push subscription endpoints: until revoked by the browser, unsubscribed by you, or the endpoint returns a permanent error
Match reminder data (IndexedDB, client-side): stored locally until you clear reminders or browser data
Analytics data: 24 months (PostHog EU retention policy)
Rate-limiting IP records: 60 seconds in memory, never persisted
Server logs: 30 days

Lawful Basis for Processing (GDPR Art. 6)

Consent (Art. 6(1)(a)): analytics (PostHog, Google Analytics), newsletter subscription, browser push notifications
Contract (Art. 6(1)(b)): account creation and management, favorites, Pick'em / bracket predictions, leaderboard display, transactional emails
Legitimate interest (Art. 6(1)(f)): IP-based rate limiting, CSRF protection, abuse prevention, aggregated service improvement

Cross-Border Data Transfers

Application and database are hosted in the European Union (Google Cloud europe-west1, Supabase EU). Some data may be transferred outside the EU through the following services, all relying on the EU-US Data Privacy Framework and/or Standard Contractual Clauses:

Google (OAuth, Analytics, GTM): EU-US DPF certified
Discord, Twitch (OAuth login): EU-US DPF certified. Only identity data is processed at login.
Steam / Valve (OpenID login): Standard Contractual Clauses. Only SteamID is stored.
Resend (email delivery): Standard Contractual Clauses, EU region available.
PostHog (analytics): EU cloud region.

Sub-Processors

Google Cloud: Application hosting (EU: Belgium, europe-west1)
Supabase: Database hosting (EU)
Resend: Transactional and newsletter email delivery
PostHog: Product analytics (EU, consent-based, proxied through /ingest)
Google Analytics / GTM: Analytics (consent-based, loaded only when user accepts "all" cookies)
PandaScore: Esports match data (no user data shared)

Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

Know what personal information we collect and how it is used
Request deletion of your personal information
Opt-out of the "sale" or "sharing" of your personal information
Not be discriminated against for exercising your privacy rights

We do not sell personal information and we do not share it for cross-context behavioural advertising. To disable all non-essential sharing, open the Cookies & Privacy panel in the footer and select Functional only, or enable Global Privacy Control (GPC) in your browser — we honour the GPC signal automatically.

Children's Privacy

Esport Agenda is not directed at children under 16. We do not knowingly collect personal data from children below the digital-consent age of their country. If you believe a minor has created an account, email contact@esportagenda.com and we will delete the account.

Exercising Your Rights

You can exercise your data rights directly:

Export your data: Settings → Export my data
Delete your account: Settings → Delete my account
Manage newsletter: /newsletter/subscribe or the unsubscribe link in any email
Change cookie preferences: Click Cookies & Privacy in the footer

For any other request, email us at contact@esportagenda.com. We respond within 30 days.

7. Contact Us

If you have any questions regarding privacy, please contact us at:
contact@esportagenda.com

Last updated: April 2026