Privacy Policy

1. Data Controller

2. Who This Policy Applies To

The Platform is intended for users aged 13 or older. Users under the age of majority must have permission from a parent or legal guardian.

XCORE.GG does not actively verify user age and does not knowingly target minors.

3. Categories of Personal Data

3.1 Account & Identification Data

• Email address (magic-link authentication)
• OAuth provider user ID and display name

Email addresses provided for magic-link authentication are obfuscated during transmission. The email address of the created account is stored encrypted with AES-GCM-256.

3.2 Profile & Social Data (Optional)

• Username / display name
• Avatar or profile image
• Connected gaming accounts
• Games played and related metadata
• Game highlights and uploaded images
• Genres, platforms, and device preferences
• Connections, connection requests, and reactions

3.3 OAuth & Imported Third-Party Data

• Google: user ID, email
• Google Play Game Services: user ID, username, avatar, friends, games, achievements
• Steam: user ID, username, avatar, friends, games, achievements
• Xbox (Microsoft): user ID, username, avatar, friends, games, achievements
• PlayStation (PSN): data import only (no authentication)
• Discord: user ID, username, avatar

Upon revocation of Steam access, Steam-derived data may be removed or no longer updated.

XCORE.GG's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

XCORE.GG does not control and is not responsible for the availability, accuracy, or continued access to data provided by Discord services.

Discord is a trademark of Discord Inc. This application is not affiliated with or endorsed by Discord Inc.

4. Public Information

User profiles and content are public by default. Private or sensitive data (such as email addresses or authentication identifiers) is never made public.

Future controls may allow users to hide selected profile elements.

5. Purposes and Legal Bases

• Account creation & platform use: performance of a contract
• Profile display & social features: user consent
• OAuth connections & data import: user consent
• Emails (magic link): performance of a contract
• Analytics & cookies: user consent
• Security & logging: legitimate interest

6. Cookies & Analytics

The Platform uses essential technical cookies required for authentication and session handling.

Analytics are implemented using Google Analytics 4 (GA4) via gtag.js, with anonymization and consent controls.

Users can manage cookie preferences through the cookie consent banner.

Analytics / Performance Monitoring

The Platform uses Vercel Speed Insights, a performance monitoring service provided by Vercel Inc., to measure website performance and Core Web Vitals.

Vercel Speed Insights collects technical performance data (such as page load times, rendering metrics, and error information) to help improve the reliability and speed of the Platform.

This data is processed without the use of cookies and without tracking users across websites.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in maintaining and improving platform performance).

7. Emails & Communications

By providing your email address, you consent to receive transactional and service-related emails (e.g., authentication links, notifications). You may withdraw consent at any time through in-app settings.

Currently, XCORE.GG only sends transactional emails (magic-link authentication), which are sent only after the user specifically provides their email address and requests authentication.

Marketing or product emails, if introduced, will require explicit opt-in and will always include an unsubscribe option.

We monitor email delivery and respect bounce and complaint feedback. If your address generates multiple bounces or complaints, we may suspend or modify email delivery.

7.1 Email delivery and abuse prevention

We process technical information related to email delivery, such as delivery failures (bounces) and abuse or spam complaints, in order to maintain the reliability of our communications, prevent misuse of our services, and comply with the requirements of our email service providers.

Email addresses that repeatedly fail delivery or generate abuse complaints may be automatically suppressed from further communications.

8. Logging & Monitoring

Technical logs (session identifiers, timestamps, errors) are collected solely for security and debugging purposes.

• No IP or device fingerprint tracking
• Logs retained for 30 days
• Error monitoring via Sentry

9. Data Sharing & Processors

Personal data may be processed by the following providers:

• Hosting & infrastructure: Vercel, Scalingo (EU)
• Database: Scalingo (EU)
• Email delivery: MailGun (EU configuration)
• Analytics: Google Analytics (EU configuration)
• Media storage: Amazon S3 (EU)

No data is transferred outside the European Union.

10. Data Retention

• Account data: retained until deletion is requested
• Account deletion: immediate
• Logs: 30 days
• Backups: 30 days

11. User Rights (GDPR)

Users have the right to:

• Access their data
• Rectification
• Erasure
• Restriction of processing
• Objection

Requests can be made via email or future in-app tools and will be handled within 30 days.

12. Automated Processing

The Platform may introduce recommendations, matching, rankings, or leaderboards. These features do not produce legal or similarly significant effects.

13. Security Measures

• Encryption in transit and at rest
• Strict access controls
• Role separation
• Incident response and breach notification procedures

14. Changes to This Policy

Changes to this Privacy Policy will be communicated via in-app notice and published on xcore.gg.

15. Contact