Privacy Policy

Effective from: Jul 9, 2026 · version privacy-1.2

This Privacy Policy explains what personal data we process when you use the TeamBase platform (the web at teambase.lol and the desktop app), for what purposes, on what legal basis, and what rights you have under Regulation (EU) 2016/679 (GDPR).

1. Who is the controller

The controller is Stanislav Ťulák, a natural person operating the TeamBase platform. Contact for privacy matters: support@teambase.lol. We handle data subject requests through this address and, on request, will provide the controller's further identification details.

2. What data we process

Registration data — email and username. Passwords are stored only as a secure hash, never in readable form.
Profile information (optional) — bio, platform, language, main game, region, avatar, banner, links.
Platform activity — teams and guilds, posts, polls, achievements, reputation, LifeGraph/Journey events, playtime and stats.
Communication content — text and attachments in guild/global/expert chats and direct messages (DMs), including metadata. Messages are not end-to-end encrypted.
Linked game accounts (optional) — when linking Steam, Riot or Battle.net we process game stats within the scopes you grant.
Proof of consent — at registration we store the consent time (UTC), the document version and the IP address.
Technical data — last login time, presence status, trusted device (token hash only), basic operational and security logs.

3. Consent at registration and its proof

When creating an account we ask for your explicit, active consent (an unchecked box) to the processing of personal data under this Policy and the Terms of Service. Without consent we will not create the account. We keep proof of consent: the time (UTC), the document version and the IP address.

If we materially change the documents, we will increase their version and may ask you to consent again at your next sign-in.

4. Purposes and legal bases

Purpose	Legal basis (GDPR)
Account management, authentication, device verification	Performance of a contract (Art. 6(1)(b))
Matchmaking, teams, guilds and community features	Performance of a contract (Art. 6(1)(b))
Game stats after linking accounts	Consent (Art. 6(1)(a))
Security, abuse prevention, moderation	Legitimate interest (Art. 6(1)(f))
Reporting illegal content to authorities	Legal obligation (Art. 6(1)(c))
Proving consent that was given	Legal obligation / legitimate interest

5. Cookies and local storage

We use only strictly necessary storage required for the service to work (login/session, language choice, basic settings), which does not require consent.

We currently do not use third-party analytics or marketing tracking cookies. If we introduce them, we will ask for separate opt-in consent and update this Policy.

6. Communication content and moderation

Message content is stored on our servers and is not end-to-end encrypted. We process it based on our legitimate interest in service safety and a legal obligation when reporting illegal content.

We do not proactively read adults' private conversations. We access content only when it is reported or flagged by automated safety systems; each access is performed by an authorized team member, requires a reason and is audited. Guild moderators can access only their own guild's content.

7. Processors and international transfers

We do not sell personal data. Our processors:

Supabase — database, authentication and storage.
Vercel — hosting and delivery of the web/app.
Resend — sending transactional emails (e.g. account verification, password reset); processes your email address.
LiveKit — voice chat (audio and identity transport during calls).
Cloudflare — abuse and bot protection (Turnstile CAPTCHA); processes your IP address and technical signals.

Some processors may process data outside the EU/EEA (notably the USA); such transfers are covered by appropriate GDPR safeguards (notably the EU Standard Contractual Clauses).

8. Third parties — game data and APIs

We display game metadata from RAWG (with attribution per the RAWG API terms). When you optionally link Steam we use the Steam Web API (Valve); TeamBase is not affiliated with or endorsed by Valve and use is subject to the Steam Subscriber Agreement and Steam Privacy Policy. Linking Riot Games and Battle.net is optional.

9. Retention

We keep data for the lifetime of the account. After account deletion or an erasure request we remove personal data within 30 days, unless a law requires longer retention. Moderation records and access logs are kept for up to 24 months. Deleted content may briefly persist in backups.

10. Your rights

Access to your data and a copy of it (export).
Rectification of inaccurate data.
Erasure ("right to be forgotten").
Restriction of processing and data portability.
Objection to processing based on legitimate interest.
Withdrawal of consent at any time (without affecting processing before withdrawal).

You can exercise most rights directly in the app (edit profile, export data, delete account) or by email at support@teambase.lol. You also have the right to lodge a complaint with a supervisory authority — in Slovakia the Office for Personal Data Protection of the Slovak Republic.

11. Security

We apply appropriate technical and organizational measures — encrypted transport (HTTPS), password hashing, access controls and data minimization. No system is 100% secure; in case of a data breach we act in accordance with the GDPR.

12. Age of users

The platform is intended for people aged 16 and over; younger users (under 16) only with the consent of a parent or legal guardian. An account of a child under 16 without such consent will be removed and the data deleted.

13. Changes to this policy

We may update this Policy. We will notify you of material changes by email or in the app and update the effective date and version. For significant changes we may request fresh consent.

14. Contact

Privacy questions: support@teambase.lol.