Privacy policy
Last updated: 22 October 2026. The German version is the binding one.
1. Controller
Cillerian eSport
Registered association (Verein), ZVR number 1252299294
Ressnigweg 2, 9170 Ferlach, Austria
Email: admin@cillerian.org
Phone: +43 664 1803613
For privacy questions, write to admin@cillerian.org. As a small association we are not required to appoint a data protection officer.
2. What we process and why
Visiting the site
Our server logs the IP address, time, requested address, browser identifier and status code of each request. We need these logs to spot attacks and fix errors (legitimate interest, Art. 6(1)(f) GDPR). They are deleted after 14 days.
Account
For an account we store your username, display name, email address and a bcrypt hash of your password. You can add an avatar, a bio, links to Discord, YouTube, X and Steam, your games and your mains. The legal basis is providing the service you signed up for (Art. 6(1)(b) GDPR). We keep this data until you delete your account.
We email you a link to confirm your address. The link works for 48 hours.
If you turn on two-factor login, we store the secret key for your authenticator app and your backup codes, the latter only as hashes. Both are deleted when you turn it off.
Tournaments
When you enter a tournament we process your sign-up, answers to sign-up questions, check-in, results, placements and points. Brackets, results, entrant lists and the leaderboard are public and show your display name, because that is what a public tournament is (Art. 6(1)(b) GDPR). Only admins see your answers to sign-up questions, unless a question is marked public.
Results of finished tournaments stay as tournament history. If you delete your account, you appear there only as "Deleted player" (legitimate interest in complete results, Art. 6(1)(f) GDPR).
Match chat and screenshots
Only the players of a match and the admins see its chat and screenshots. They are for arranging the match and settling disputes (Art. 6(1)(b) and (f) GDPR). Screenshots stay with the match as evidence after you delete your account; write to us if you want one removed.
Teams, pick'em, notifications
We store team memberships, roles, join requests and invites, and your pick'em picks. We create on-site notifications about your matches, teams and tournaments.
Push notifications
Only if you turn them on in your settings do we store your browser's push address. Delivery runs through your browser's push service (for example Google, Mozilla or Apple); the content is encrypted. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw in your settings at any time.
Emails
We send emails to confirm your address and, when an admin chooses to, messages from the organisers about tournaments you entered. We don't send advertising.
Signing in with Steam, Google or Discord
When you sign in with Google or Discord we send you to that provider (Google Ireland Ltd.; Discord Inc., USA). We receive your account id, name and email address with whether it is verified, and store only the account id to recognise you. The legal basis is the sign-in you chose (Art. 6(1)(b) GDPR). You can unlink it in your settings at any time.
Steam sign-in
When you link your Steam account we send you to Steam (Valve Corporation, USA). We only receive your public Steam ID. Valve's privacy policy covers what Valve processes.
Discord
For some tournaments we post tournament events (start, disputes, the winner's display name) to a Discord server through a webhook (Discord Inc., USA), based on our legitimate interest in keeping the community informed (Art. 6(1)(f) GDPR).
3. Cookies
We only set cookies the site needs to work, which need no consent (§ 165(3) of the Austrian Telecommunications Act 2021). There are no analytics, tracking or advertising cookies, and no third-party content is embedded; fonts and images are served from our own server.
| Cookie | Purpose | Lifetime |
|---|---|---|
| sid | Keeps you logged in and protects forms (CSRF) | 30 days or until you log out |
| flash | Shows a confirmation after an action | 60 seconds |
| lang | Remembers your language | 1 year |
| steam_state | Protects linking your Steam account | 10 minutes |
| install-hint-closed | Remembers in browser storage (localStorage) that you closed the install-the-app hint | 30 days |
4. Recipients and processors
- Hetzner Online GmbH, Germany: server hosting.
- Google Ireland Ltd. (Google Workspace): sending our emails. Data may reach the USA, based on the EU-US Data Privacy Framework.
- Your browser's push service, if you turn on push notifications.
We don't sell data, and otherwise only share it when the law requires us to.
5. Minimum age
You can create an account yourself from the age of 14 (§ 4(4) of the Austrian Data Protection Act). Younger players need consent from a parent or guardian.
6. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection. Your settings let you change your details, download everything we store about you and delete your account. For anything else, write to admin@cillerian.org.
You can also complain to the Austrian Data Protection Authority: Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.
7. Security
Connections use TLS, passwords are stored only as bcrypt hashes, and screenshots are kept outside the public part of our server.
