Privacy policy

1. What we hold, and why

Your account: the email address you signed up with, the name you gave, and a one-way hash of your password. We need these to let you in, to reach you about your teams, and to prove it is you resetting a password.

If you sign in with Discord: your Discord user id and username, and the email address Discord has verified for you. We use them to let you in with Discord and to tell you when Discord is added to or removed from your account. We never receive your Discord password, and we keep no Discord access token.

Your profile: your display name, a profile photo and a photo for each team you are on, a short bio, your social links, your date of birth, and the country and language you choose. The date of birth is used only to work out an age — the rule that the service is for people aged 13 and older — and is never shown to teams; a team that you apply to sees your age bracket, your country and your language, never the date itself.

Your display language: the language you choose for Spawnfront from the account menu or the log-in pages. It is a preference only you set, kept on your account so that Spawnfront shows itself to you, and writes you its emails and notifications, in that language on every device you log in on. It is never shown to teams, is separate from the language on your profile, and is deleted with your account. Your browser also remembers the choice in a functional preference cookie, locale, for a year.

Your game accounts: the identity you enter for each game — a Marvel Rivals UID and name, an Overwatch BattleTag, a Riot ID with its server or region for League of Legends and Valorant, a Counter-Strike 2, Deadlock or Rocket League handle — with your roles, a rank you report yourself and the heroes, champions or agents you play. To confirm a Counter-Strike 2 or Deadlock account you sign in at Steam, which tells us your SteamID64; we never show it. To confirm an Overwatch account you can connect Battle.net, which tells us your BattleTag and your Blizzard account number; we keep the number only so that one Battle.net account belongs to one Spawnfront account, never show it, and keep no Battle.net token.

Your teams: the team's name, region, platform, language, timezone, its members and their roles, its schedule, and everything the team writes for its site. A published site is public by definition; a draft is visible only to that team's admins and to our support staff. The late or out marks and short notes members leave on the schedule are seen only by that team's members.

People a team lists without an account: a team can put a player on its roster who has no account here — their name, player name, photo, links and game statistics. The team's admin confirms they have that player's permission when they add them. If a team has listed you and you want to be removed, see Your rights below.

Spawnfront Companion: if you install the app and link it to your account, it reports the matches you play — your own results, and for each match the other players' in-game ids and sides, never their names, so we can tell which teams played. For Rocket League those ids are platform account ids — Epic, Steam, PlayStation, Xbox or Nintendo — yours and the other players', which we never show; the app reads Rocket League's match stats only after you turn on Record Rocket League, which changes one setting in one of the game's own settings files and undoes it when you turn it off. The link is a device token we store only as a one-way digest. The app also shows your own stats, teams, applications and schedule, read from Spawnfront with that token, and checks our download storage for updates, sending a random number for this install and nothing about you.

Push notifications: if you turn on push notifications in a browser, we keep that browser's push subscription — an address at the browser maker's push service and two keys — with your account, encrypted. We use it only to send your own notices to that browser. It is deleted when you turn push off or log out in that browser, when your sessions are signed out, when the push service tells us it is gone, and when you close your account.

AI assistants: Claude, ChatGPT or another AI app that supports MCP connectors are apps you choose and approve on Spawnfront. For each one you connect we keep the connection — the app's name and web address, the areas you allowed, when you connected it and when it was last used — and its access tokens only as one-way digests. We also keep a list of what it changed for you — the action, a short summary, the team and the time — for 180 days, visible to you and to our support staff. If you turn on the mark, what the app creates on a team (an open position, an open scrim, a news draft) shows that team the app's name.

Scrimmage results: a team captain can upload a screenshot of a match's scoreboard, which names every player in it. The image is stored privately, shown only to the admins of the two teams, and deleted three days after the result is settled. An Overwatch Workshop log is kept the same way: the file is deleted three days after the result is settled, and its players with it.

Your own matches from screenshots: you can add a ranked match to your card from a screenshot of the game's post-match screen, which names every player in the match. The image is stored privately, seen only by you, and deleted when you confirm your line, or a day after you sent it if you don't; if you send it with /stats add in Discord, Discord also holds the attachment under its own policy. We keep only your own line — your kills, deaths and assists, the game's own numbers, and in Overwatch the heroes you played — and the match's result, map, queue, length and date. The other players' names are deleted with the image; their numbers are kept only inside a one-way fingerprint of the match, with a fingerprint of the image, so the same match is not added twice. Your card shows these matches labeled self-reported. We never read damage or healing from a Marvel Rivals or Overwatch screenshot. Removing a match takes it off your card; its record is deleted when you remove that game from your profile or close your account.

Shop orders: when you buy from a team's shop, the order is placed and paid at Fourthwall. We hold a reference to it — the order id, its status, its total and its dates — together with a one-way digest of the email you used, so we can show you your own orders. We do not hold your address, the items or your email itself, and card details never reach Spawnfront.

Gifts: when someone buys you months of a site as a gift, they give us your email address so we can send it to you on the day they chose. We keep it encrypted until that email is sent and then delete it. The buyer's own email is kept only as a one-way digest; the name and note the buyer writes are shown to you with the gift.

Sponsorships: when you sponsor a team's site, you give us the name and the note you want the team to read, and your email for the receipt. The note, and your name when you ask to be thanked or listed, are shown to that team's owner and admins; your name appears on the team's site, as plain text under Supporters, only if you ask to be thanked by name and the team approves it. Your email is kept only as a one-way digest — unless you ask to be listed as a business sponsor, when we keep it encrypted so the team's owner and admins can see it to add you, and delete it once they add you or dismiss the request, or after 90 days at most.

Domain purchases: when a team buys a domain through us, the registrant's name, address, phone number and email are passed to the registrar. We hold them encrypted only until the registration completes or fails, and then delete them.

Request logs: our hosting provider records each request — the IP address, the browser and device, the page and the time — and keeps those logs for up to 30 days; we use them to keep the service up and secure. Our own rate limits keep an IP address only as a pseudonymous digest, for less than a day. Log lines never carry passwords, tokens or the contents of an email.

Cookies: we use a few strictly necessary cookies (to keep you signed in and to carry a signup, a gift or an invitation through login) and a few preference cookies (to remember how the app looks and the language you chose). We use no advertising or analytics cookies. The Cookie policy at /cookies lists each one, what it is for and how long it lasts.

2. Who else processes it

We use a small number of companies to run the service. Each one sees only what it needs, and none of them may use your data for their own purposes.

Polar bills site subscriptions and gifts as our merchant of record and holds the payment details of whoever pays.

Fourthwall runs each team's shop: its catalog, its checkout, its payments and its fulfillment.

Supabase hosts the database and the media a team uploads.

Resend delivers our email — verification, password recovery, invitations, gifts and notices.

Vercel hosts and serves the applications and the team sites, and registers the domains teams buy through us.

DigitalOcean hosts two servers of our own: the one that reads scoreboard screenshots sent through Discord, and the one that reads Overwatch career pages.

Google Workspace holds our support mailbox — what you email us.

Discord, if you choose to sign in with it, confirms who you are and shares your Discord id, username and verified email with us. A team that links its Discord server has our bot post the schedule, positions and results it chose there.

If you turn on push notifications, each notice is delivered through the push service of your browser's maker — Apple, Google, Mozilla or Microsoft. The notice is encrypted for your device, so the push service carries it without being able to read it.

If you connect an AI assistant, the app receives what you allowed it to read through Spawnfront, and nothing you cannot see yourself: your profile and game accounts, and the data of your teams whose owner or an admin turned on Allow AI assistants — such as the roster, the schedule, open positions, applications, news drafts, scrims and tournaments — within the areas you chose. The app works for you, not for us: from then on, its own privacy policy applies to what it keeps.

Steam, if you confirm a Counter-Strike 2 or Deadlock account, signs you in on its own page and tells us your SteamID64.

Blizzard, if you connect Battle.net to confirm an Overwatch account, signs you in on its own page and tells us your BattleTag and Blizzard account number.

Marvel Rivals statistics on a team's roster come from Rivals Island (rivalsisland.com), read by the UID a player enters and their team verifies: once a day for a team with a site, once a week otherwise. Those are public game statistics; we send the UID and no account data.

Deadlock statistics on a team's roster come from deadlock-api.com, a community service that collects public Deadlock match data, read by the Steam account of a player who confirmed it with Steam and is on a team: once a day for a team with a site, once a week otherwise. We send the Steam account number and no other account data; we never sign in to Steam for you or ask you to add anyone as a Steam friend.

Overwatch statistics come from Blizzard's public career pages, read by our own copy of OverFast, for a BattleTag the player's team verified or that Battle.net sign-in proved: once a day for a team with a site, once a week otherwise, and once a week for a proven player on no team. We send the BattleTag and no account data.

Team sites can embed videos from YouTube and Twitch. Your browser loads those players from Google and Twitch, which may set their own cookies; the Cookie policy says more.

3. How long we keep it

You can delete your account yourself from your profile. That closes the account and deletes your personal information — your profile, your password, your memberships, your name and your email address.

A free team whose admins have not visited it for six months is removed, a month after a warning email to its owner. Removing a team removes its members, roster, positions and applications with it. An application nobody answers closes after 30 days.

Game statistics are kept as the latest reading only; each new one replaces the last. Companion reports are kept for the current and the previous season of each game.

An AI assistant's connection stops the moment you disconnect it. It also ends after 90 days unused, when you reset your password or our support staff sign you out everywhere, and when you close your account. The list of what an AI assistant changed is kept for 180 days, and is deleted with your account.

Order references stay after an account closes, without anything that names the buyer: they are the record that a team was paid, and a team's own books need them.

Records of staff actions — a site taken offline, an account closed — are kept as an audit trail and never edited or deleted.

Email to our support address is deleted after two years at most.

4. Children

Spawnfront is for people aged 13 and older. Signup asks for a date of birth first, and an answer under 13 stores nothing at all.

If we find that an account belongs to a child under 13 we close it and delete their personal information. To report a child's account, write to support@spawnfront.com with anything that identifies it — the email address it uses, or the team it belongs to.

5. Your rights

You can see and change your account and profile at any time from your profile page, and delete the whole account from the same place.

For a copy of what we hold, a correction we do not let you make yourself, or any question about this page, write to support@spawnfront.com. You also have the right to complain to your country's data protection authority.

If a team has listed you without an account and you want to be removed, or want your statistics hidden, write to support@spawnfront.com with the team's name; we remove the entry or turn its statistics off.

6. Changes to this policy

We update this page when what we collect or who processes it changes. The date at the top says which version is in force; when a change matters to you, we email the address on your account before it takes effect.

7. Contact

Write to support@spawnfront.com about anything on this page.