Privacy Policy

This Privacy Policy describes how we collect, use, and handle your information when you use the Scoreboards bot ("the Bot") and our website at scoreboards.dev ("the Website"). By using the Bot or the Website, you agree to the practices described in this policy.

1. Information We Collect

When you use our Bot or Website, we may collect the following information:

• Discord usernames, display names, avatars, user IDs, and server (guild) IDs
• Leaderboard data including scores, rankings, game statistics, and player names that you provide through the Bot
• Images you upload: proof screenshots attached to scores and matches, and images submitted to Rating leaderboards, along with associated metadata (submission name, upload time, your Discord user ID)
• Rating and voting data, including which submissions you rate, the star ratings you assign and when, and — only on leaderboards whose admins have turned anonymous votes off — the display name you had when you voted
• Discord OAuth2 authentication data (access tokens) when you log in to the Website via Discord
• When the Bot is added to a server, Discord tells us which user added it. We keep that user ID together with the server ID, to welcome whoever added the Bot and to understand which of our links lead to installs. For the same purpose we keep, for 7 days, the user IDs of members who were shown an "Add Scoreboards to your server" button in a reply only they could see
• If the server you play in uses the currency system: your currency balance in that server; an earnings ledger holding one entry per finalized result, each recording the amount, the reason it was paid, a pointer to the specific match or score submission it came from, the full arithmetic that produced the amount, and the Discord user ID of whoever caused the entry (a reviewer, a validator or an administrator); if the server pays currency for levels reached on a Levels leaderboard, an entry for each level you reach, with the leaderboard and the level; if the server halves balances when one of its currency seasons ends, an entry for the amount taken off your balance, with the season it belongs to; if you prestige, your prestige level and the total you have burned for it; if you bid in an auction, each bid — which auction, the amount and when; and your purchase history — what you bought, when, and what it cost
• If a server you are in has a Levels leaderboard: your total XP on it, how many of your messages earned XP, how many minutes in its voice channels earned XP, when you last earned XP and, once a night, your rank on that leaderboard, for its rank-history chart. Nothing is stored per message. To keep these totals, the Bot receives a notice from Discord for every message posted in a channel it can see, in every server it is in — who posted it, their roles in that server, the channel and the time; the Bot never reads or stores the text of a message, which Discord includes only in a few cases, such as a message that mentions the Bot — and for every change in who is in a voice channel and whether they are muted or deafened. Message notices are discarded the moment they arrive in a server without a Levels leaderboard; in a server with one, they are used to update the totals above and then discarded. For voice, the Bot keeps in memory only the current list of who is in a voice channel and whether they are muted or deafened, and drops each person from it when they leave; that list is never stored, and it is counted toward the totals above only in a server with a Levels leaderboard
• Server membership and role information necessary to display your leaderboards
• How each server uses the Bot, recorded per server and never per person: which commands and buttons are used and when, the name of the channel the Bot posted its welcome message in, which permissions it lacked when it joined, which error messages it showed or problems it ran into, and a daily count per server of the languages Discord reports for the people using it
• Daily totals per server, with nothing about any one person: new players, queue and command use, and Levels XP, messages, voice minutes and active members
• When you visit the Website: the statistics about page views and "Add to Discord" clicks described in section 3
• If a server subscribes to a paid plan through Discord's app store, the subscription details Discord sends us for that server: the entitlement (its ID, the server ID, which plan was bought, when it starts and ends, and whether it was refunded) and the subscription's status (active, cancelled but still running until the end of the paid period, or ended) with the date the current period ends. Discord also tells us which user made the purchase; we drop that and never store it. We never receive or store payment details — Discord handles the payment

2. How We Use Your Information

We use the collected information to:

• Provide and operate the Bot and Website services
• Maintain, display, and manage leaderboards
• Authenticate you when logging in via Discord
• Count chat and voice activity on Levels leaderboards in servers that have one, and post the level-up messages and hand out the roles those servers have set up
• Operate the currency system in servers that use it — paying out finalized results and, where a server has set it up, levels reached on a Levels leaderboard, applying the daily limit and anti-farming rules, reversing a payout when a result is cancelled or edited, and completing purchases
• Unlock the features of a server's paid plan, for as long as Discord reports the subscription as active
• Improve our services based on usage patterns

The game on our home page. You can play without an account. If you choose to enter a name after a run, we store that name and your score on a public leaderboard, where anyone can see them. That leaderboard is kept out of search engines. A name that reaches the top 10 is reviewed by us before it appears on the home page. We do not store your IP address for this: it is held briefly in memory to limit repeated attempts. To have an entry removed, contact us.

3. Cookies, Local Storage & Analytics

Necessary storage. To keep you logged in, the Website stores authentication tokens and session data in your browser's local storage and session storage. This is strictly necessary for the service to work, is first-party, is not used for tracking, and is cleared when you log out. Because it is essential, it does not require consent.

Analytics cookies. With your consent, we use Google Analytics 4 to understand how the Website is used so we can improve it. This sets first-party cookies named _ga and _ga_JL3FNSVZQ1, which can persist for up to about two years. We enable IP anonymization and use Google Consent Mode, so no analytics cookies are set until you opt in. The legal basis for this processing is your consent.

Which website sent you. When you press an "Add to Discord" button on the Website, the link tells us which website you arrived from: only its domain name, for example "google.com", as your browser reported it when the page loaded (or the source a linking site put in the address), or that there was none. On an embedded leaderboard it is the website the leaderboard is placed on. We keep it with the click and, if you then add the Bot, with that server's install record described in section 1, to learn which websites bring people to Scoreboards. Nothing is stored on your device for this, and the click and install records hold nothing else — no IP address, no cookie, no device or browser details. It is visible only to us.

Website statistics. If you accept analytics in the cookie settings, we also count how the Website is used. Nothing is sent for this before you accept, or if your browser sends Global Privacy Control. For each page view and each press of an "Add to Discord" button we record which page it was, as a type of page such as "home page" or "leaderboard page" and never a specific leaderboard, player or server; the previous page on our site; the domain name of the website that sent you; your country; the language the page was shown in; and whether it was shown at phone or desktop size. This sets no cookie and stores no IP address and no user or server ID. Your country comes from our network provider, Cloudflare, which works it out from your IP address as your request passes through. Your IP address and browser details are also used in the moment to limit how many requests one address can send and to leave out robots; the address is held in memory for up to a minute and neither is stored.

To tell how many people visit in a day, each of these records also carries a short code made from your IP address and browser details together with a random key. The key exists only in our server's memory, is never written down, and is replaced with a new one every day. The old key is gone after that, so a code cannot be turned back into an address, and the same visitor gets a different code the next day. We therefore cannot recognise you from one day to the next.

These individual records, code included, are deleted within 48 hours, once they have been added up. After that we keep only daily totals per page, move between pages, source, country, language and device type, which cannot be traced back to anyone. We do this to learn how people find and use the Website, so we can improve it. The legal basis is your consent, which you can withdraw at any time in the cookie settings. An embedded leaderboard records none of this, and neither do our staff-only pages. It is visible only to us.

We do not use advertising or marketing cookies, and we do not sell your data.

Links the Bot posts in Discord carry a short tag saying which button they came from and what kind of leaderboard it was on. When such a link opens the website, we add one to a daily count for that button and leaderboard type, and remove the tag from the address. The count holds nothing else — no cookie, user, server or IP address — so it does not need your consent.

You can change or withdraw your choice about analytics at any time. Google Analytics and our website statistics stay off until you opt in. Turning them off stops both and deletes Google's cookies. Open cookie settings.

4. Public Leaderboard Display

Leaderboards created via the Bot may be displayed on the Website through a unique URL and are publicly accessible by default. Public leaderboards can include Discord usernames, scores, and related game or leaderboard data that you and your server members provide. Anyone with the URL can view the leaderboard and its contents.

Search engines and link previews. Established public leaderboards — those belonging to a registered account and containing at least five entries — can be indexed by search engines such as Google, which means their contents, including the Discord usernames shown on them, may appear in public search results. Sharing a leaderboard link on Discord or social media also generates a preview card showing the leaderboard's name, its number of competitors, and the name at the top. Private and disabled leaderboards are excluded from both, as are leaderboards created without an account.

Images submitted to Rating leaderboards are publicly viewable alongside your Discord username and any description you add. Leaderboard admins can enable blind voting, which withholds submitter names from public view until they reveal the results. Individual star ratings you give are used to calculate public averages. Each vote is also listed in the leaderboard's activity on the Website — which entry was rated, when, and the rating given (the rating is left out on blind-voting leaderboards). By default these votes are anonymous: they are shown without your name. Leaderboard admins can turn anonymous votes off, in which case votes cast from then on are shown publicly with your display name; to show it, we store the display name you have at the moment you vote together with that vote. Votes cast while a leaderboard was anonymous — including every vote cast before votes were listed in the activity — stay anonymous and are never given a name afterwards. Where you vote on the Website, and in the Rate entries flow in Discord, you are told whether the leaderboard shows names; a vote cast from an entry's own message in Discord is confirmed with the same notice. Separately, the admins of a leaderboard can always view a vote log showing which submissions you rated and the scores you gave, for example to check the fairness of an event.

Levels leaderboards. A member appears on a server's Levels leaderboard as soon as they earn XP there; nobody signs up for it. The leaderboard shows your XP and level, and on the Website also your message count and your time in voice channels, and like any other leaderboard it is public unless the server makes it private. Your public player page on the Website also lists the live Levels leaderboards you appear on in every server, with your level, XP, message count and time in voice channels on each, leaving out any leaderboard the person viewing the page is not allowed to see. When you reach a new level, the Bot may post a message in the server that mentions you, as the server's administrators have set it up. A server's administrators can keep a member from earning XP by giving them a role that earns none.

Currency balances. In a server that uses the currency system, your balance is shown to you on that server's shop page, which reads your own wallet and no one else's. No command or page lists other members' balances. Balances are per server and are never shown outside the server that issued them. If you buy and equip a shop emoji, a name colour, a ring around your rank or a style for your leaderboard row, it is displayed publicly alongside your name on that server's leaderboards (on its website pages and on leaderboards it posts as a picture in Discord), and so is your prestige level if you have one — reaching a prestige level is also announced in the server's log channel when one is configured. An auction on the shop page shows the amount of its highest bid but never who placed it; the winner is announced in the log channel when the auction closes. Your own earnings ledger is shown only to you, and an administrator granting or removing currency is posted to the server's log channel when one is configured, so that such actions are visible rather than silent. When a server ends a currency season, the post in its log channel gives only totals — how much was taken off across how many wallets — never anyone's balance.

Embedding on other websites. A public leaderboard can also be placed on any other website as an embedded view, which shows the same standings and usernames the leaderboard's own page shows. Only public leaderboards render this way — private, hidden and disabled leaderboards display a notice and no data. An embedded leaderboard loads no analytics and sets no cookies on the site hosting it, and we receive nothing about the people who view it beyond the ordinary server request needed to serve the page.

We do record how often each leaderboard is loaded as an embed, and the domain name of the website it was loaded on (for example "example.com"). This tells us which sites use the feature. We do not record the individual page, and we do not record anything about the people who view it — no IP address, no cookie, no account, no device or browser details. This information is visible only to us, not to the leaderboard's owner or to a server's administrators.

API access for server administrators. A server's administrators can create an API key in the dashboard that lets their own tools read and update that server's leaderboards. A key reaches only the leaderboards of the server it was created for, but all of them, private ones included, and returns what those leaderboards hold: the standings, the names shown on them, and the Discord user IDs of the players. What the administrators' tools then do with that data is up to them, as it is with anything else they can see in their own server. Administrators can revoke a key at any time, and so can we.

If you do not want a leaderboard to be publicly visible, you can mark it as private using the Bot's settings in Discord. Private leaderboards will not be displayed or accessible on the Website, and cannot be embedded elsewhere.

5. Image Storage and Processing

Images you upload for Rating leaderboards are automatically resized (max 1920px) and converted to WebP format to optimize storage and loading times. Processed images are stored on Cloudflare R2, a cloud object storage service provided by Cloudflare, Inc. During upload via Discord, images may be temporarily accessed via Discord's CDN before being transferred to our storage.

On the Website, the images attached to a leaderboard (proof screenshots on submissions and matches, and the pictures on Rating leaderboards) are shown only to signed-in members of the Discord server the leaderboard belongs to, or, for a personal leaderboard, to anyone signed in. Other visitors, and leaderboards embedded on other websites, show that an attachment exists but not the image. In Discord, the Bot's messages show the images to everyone who can see the channel they are posted in. Images are stored at addresses that are not listed anywhere public, but anyone who is given the address of an image can open it.

Images are retained as long as the associated leaderboard exists. An image is deleted when the submission or match it belongs to is deleted, when its leaderboard is deleted, when the Bot is removed from the server, or when you ask us to delete it. Deleting takes it off our public storage, normally within a few minutes, and its address stops working. A copy is then kept for 30 days in a private archive that only the operator of Scoreboards can access, so that we can handle abuse reports, disputes and deletions made by mistake. After 30 days the copy is permanently deleted. This also applies when you ask us to delete a specific image: it leaves public view right away, and the archived copy is gone 30 days later.

6. Data Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties. Our Website is hosted on Netlify, which may process requests as part of providing hosting services. We use Discord's API for authentication purposes. User-uploaded images are stored on Cloudflare R2; Cloudflare may process image data as part of providing storage and CDN services. Our database runs on servers we rent from Hetzner Online in Germany, and encrypted copies of its backups are kept on Cloudflare R2. Paid plans are sold and billed by Discord, which processes the payment under its own terms and privacy policy and tells us only the subscription details listed in section 1. Beyond these providers, leaderboard data leaves us only in the ways section 4 describes: public leaderboard pages and embeds, and the API keys a server's administrators create for their own tools.

7. Data Security

We implement appropriate security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. Authentication tokens are stored securely and expire automatically. Our database is encrypted at rest, and so are its backups.

8. Data Retention

We retain your information only for as long as necessary to provide our services. Leaderboard data is retained as long as the leaderboard exists. Uploaded images are retained as long as the associated leaderboard exists; once deleted, an image is kept in a private archive for 30 days before it is permanently deleted (see section 5). You can request deletion of your data, including specific images you uploaded, at any time.

The totals a Levels leaderboard keeps for each member — XP, message count, minutes in voice and when XP was last earned — are part of that leaderboard: they are deleted when the leaderboard is deleted, when a server administrator removes you from it, and with the rest of the server's data when the Bot is removed from the server. Like your entries on any other server's leaderboard, they are not erased by /delete_my_data, which reaches your personal workspace and your currency data; ask the server's administrators to remove you, or contact us as described in section 11. If you stay in the server and keep chatting, you start earning XP again unless an administrator gives you a role that earns none.

Currency data — your balance, your earnings ledger and your purchase history — belongs to the server, not to any single leaderboard, so the sentence above does not cover it: deleting a leaderboard does not delete it, and it is retained for as long as that server uses the currency system and the Bot remains in it. The ledger is append-only. A reversed payout is recorded as a second, opposite entry rather than by erasing the first, because the ledger is what explains every balance. The one exception is your own request to delete your data, described below: then your entries are removed together with the balance they add up to.

When the Bot is removed from a server, the data we hold for that server is deleted: its leaderboards and scores, submissions, matches, the member and role information the Bot keeps, the record of who added the Bot, and its currency data. The 7-day records of who was shown the install button expire on their own. Its images are moved to the private archive described in section 5 and permanently deleted after 30 days. Deleted data can remain in our encrypted backups for up to 30 days, after which it is gone for good.

Paid plans. A server's entitlement and subscription records are deleted when the Bot is removed from the server; if the Bot is added back, we fetch them from Discord again. Two small records are kept after removal as our billing record, and neither holds any data about the server's members: the server's current plan (its tier and where it came from), and any plan we granted the server ourselves, such as a free period — with the reason we wrote down and, for a grant one of our staff made by hand, which of our staff made it. When a subscription starts, changes, is cancelled or ends, we also keep a statistics entry with the server ID, the kind of change, the plans before and after, and when it happened — never a user ID. We also note which plan notices a server has been shown (which notice, where and when), so it is not shown the same one twice; that note is deleted with the server. We also note which plan notices a server manager has already been shown in Discord (their user ID and the notice), so nobody sees the same one twice; that note is deleted automatically after the launch period and on /delete_my_data.

How servers use the Bot. To understand why servers stop using the Bot, we keep a record of how each server uses it — the commands and buttons used and when, the channel the welcome message went to, missing permissions, the errors the Bot showed or ran into, and a daily count of the languages Discord reports for the people using it. It contains nothing about members: no user IDs and no usernames. The only things in it that someone typed are answers a server admin chooses to give: what the Bot was added for and, if it is for a game, which game, both asked under the welcome message. These records are deleted after 30 days. When the Bot is removed from a server, that server's last 30 days of them are kept instead of deleted, together with a summary of its use — such as how long the Bot stayed, how many leaderboards of which types and how many entries it had, and what happened last — under the server's ID only.

Stats for a server's admins. The admins of a server, and the owner and admins of a personal workspace, see a Stats page in the dashboard. It shows totals for that server or workspace only: results, matches, rating votes, active players, currency earned and spent, tournaments, totals for its leaderboards, and how often its commands and buttons were used in the last 30 days. It names no one and lists no member, so no user IDs, usernames or anyone's own earnings appear on it, although in a very small server a total can reflect what one person did. For a server, we also store one row of totals per day: new players, queue and command use, and Levels XP, messages, voice minutes and active members. These rows add no member-level data. They are kept for up to 400 days and are deleted when the Bot is removed from the server. How often a leaderboard is loaded as an embed is not on this page, and stays visible only to us.

A/B tests. When we try two versions of something, we note which one a server or a personal workspace got and whether it went on to create a leaderboard, record a score, use the currency system or remove the Bot, under its ID only and with nothing about its members. These notes stay when the Bot is removed, because a test has to count the servers that left, and are deleted 180 days after the test ends. Only the totals for each version are kept after that.

Website statistics. The individual records described in section 3 are deleted within 48 hours. The daily totals made from them hold nothing about any one visitor and are kept for as long as we run the Website.

We also note how far a server got in the dashboard's economy setup — which of its steps were reached and when — under the server's ID only, with nothing about who did it. These notes are deleted after 90 days.

Feedback. When you send us feedback with /feedback, or describe in your own words what the Bot was added for (after choosing “Something else” under the welcome message), we keep what you wrote, the server it was sent from, whether it was sent by an admin of that server, and the language your Discord is set to. Your name and user ID are not kept with it. We read it only to improve the Bot; ask on our support server to have something you sent removed.

An admin who removes the Bot with /uninstall is asked why it did not work out. The answer is optional. When one is given, it is kept with that summary, again under the server's ID only and without the name or ID of whoever wrote it, and is read only to improve the Bot.

Deleting your own data. The Bot's self-service /delete_my_data command, used in a direct message with the Bot, removes the leaderboards and scores held under your own personal workspace and your currency data in every server that uses the currency system: your balances, your earnings ledger, your purchase history, your cosmetics, your prestige levels and your auction bids — a bid that is still leading a running auction is withdrawn. Images on your personal leaderboards go to the private archive described in section 5 and are permanently deleted after 30 days. It asks you to confirm first, and it removes the currency data all at once — never only part of it.

Two things it deliberately does not erase. Where your Discord ID appears on someone else's record — as the administrator who granted a member currency, created a shop item, listed an auction, ended a currency season or, when the currency was a beta, accepted its beta terms for a server, or as the winner of an auction that has closed — the record stays and your ID is removed from it, because deleting it would erase other members' data. And roles you bought outright in a server's shop stay yours; we delete the record of the purchase, not the role. Roles you were renting end when you delete your data, and the Bot removes them; the record of a rental is kept only until the role has actually been removed, because that record is what lets the Bot take it back. You can still contact us as described in section 11 to have any data removed by hand.

9. Age Requirements

Our services are intended for users who meet Discord's minimum age requirement (13 years or older, or the minimum age required in your country). We do not knowingly collect information from children under these age limits.

10. Your Rights

You have the right to:

• Request access to the personal information we hold about you
• Request correction or deletion of your personal information
• Request deletion of images you have uploaded
• Request that we restrict or stop processing your data
• Set your leaderboards to private to control public visibility, which also removes them from search engines and link previews

11. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, please contact us through our Discord support server.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by posting the updated policy on this page with a revised "Last updated" date.