Privacy Policy

This Privacy Policy explains how Baguette Royale (the “Service”, “we”, “us”) collects, uses, and protects your personal data when you use our Fortnite tournament and 1v1 ELO matchmaking platform at baguetteroyale.net.

We comply with the EU General Data Protection Regulation (GDPR) and respect your right to control your personal information.

1. Data Controller

The data controller responsible for your personal data is the operator of Baguette Royale. For any privacy-related question or to exercise your rights, contact us at ach.2000.b@gmail.com.

2. Data We Collect

We collect only the data needed to operate the Service:

• From Discord (when you log in): your Discord user ID, username, avatar, and email address.
• From Epic Games (when you link your account): your Epic Account ID and Epic display name.
• From Yunite (for in-server verification): a check of your role membership in our Discord server. We do not store Yunite data ourselves.
• Generated by your use of the Service: your ELO rating, match history (opponents, results, timestamps), peak ELO, wins/losses, and queue activity.
• Session cookies: a secure session cookie set by NextAuth to keep you logged in. No tracking or advertising cookies are used.

3. Why We Process Your Data

• Account & authentication — to identify you and link your Discord, Epic, and in-server verification status (legal basis: contract).
• Matchmaking & ranked play — to pair you with opponents of similar skill and compute your ELO (legal basis: contract).
• Public leaderboard & profiles — to display your display name, avatar, and stats to other players (legal basis: contract).
• Anti-cheat & dispute resolution — to moderate matches and resolve reports (legal basis: legitimate interest in keeping the Service fair).

4. Third Parties We Use

We use a small number of service providers to operate the Service. They process your data only on our behalf:

• Vercel (United States) — hosting and serverless compute. Data in transit is encrypted via TLS.
• Supabase (EU region) — managed PostgreSQL database storing accounts, matches, and ELO.
• Discord — OAuth login and role verification via the Discord API.
• Epic Games — OAuth account linking via Epic Account Services.
• Yunite — Discord server verification bot.

We do not sell your personal data, and we do not share it with advertisers or data brokers.

5. Data Retention

• Account data is kept as long as your account exists.
• Match history and ELO records are kept indefinitely so the leaderboard remains consistent over time.
• When you delete your account, your personal identifiers are removed within 30 days. Anonymized match results may be retained for statistical integrity.

6. Your Rights Under GDPR

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and personal data
• Object to or restrict certain processing
• Receive a copy of your data in a portable format
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email us at ach.2000.b@gmail.com. We respond within 30 days.

7. Security

We protect your data with encryption in transit (HTTPS), secrets stored only in server-side environment variables, hashed session tokens, and access controls on our database. No system is perfectly secure — if you suspect unauthorized access to your account, contact us immediately.

8. Children

The Service is not intended for users under the age of 13 (or the minimum digital consent age in your country). We do not knowingly collect data from children.

9. Changes to This Policy

We may update this Privacy Policy as the Service evolves. The “Last updated” date at the top of this page reflects the most recent revision. Material changes will be announced in our Discord server.

10. Contact

Questions, requests, or privacy concerns: ach.2000.b@gmail.com