Privacy Policy
In short: we keep the Discord and game data needed to run ranked matches, leaderboards, tournaments, giveaways and moderation. We don't sell your data, we don't show ads, we never see your Discord or Epic password, and you can ask us to delete your data at any time.
1. Who this covers
This policy explains how the Timed Boxfights Discord server, the Timed Boxfights Discord bot (the "Bot") and the website timedboxfights.com (the "Site") handle your information. Timed Boxfights is a fan-run community and is not affiliated with Epic Games or Discord. See also our Terms of Service.
2. What we collect
| What | Details | Where it comes from |
|---|---|---|
| Discord account | Your Discord user ID, and your username, display name and avatar as Discord shows them. Your server roles (for example verified, region, rank, Recruiter). | Discord, when you join the server, use the Bot, or log in to the Site |
| Verification | Whether and when you verified, and the country or region you picked. Epic account linking is done by the Yunite bot; we only receive whether you are verified, not your Epic password. | Our verification step and Yunite |
| Ranked play | Queue entries, the matches you play, teams, reported scores, confirmations and disputes, ratings, ranks, wins, losses and rating history, and evidence screenshots or links you submit. | You and the Bot |
| In-game stats | Screenshots you post in the stats channel and the numbers staff read from them (mode, rank points, wins, kills). | You |
| Tournaments and giveaways | Your sign-ups and entries, tickets, winners and prize claims. | You and the Bot |
| Invites | Which invite link you joined with and who invited whom, to count invites for the Recruiter role and giveaway tickets. | Discord invite data |
| Match chat | Messages in a match's chat (on the website or in the match's Discord channel, which are linked) and the bot's match updates. Only the players in that match can read it on the website; staff can see the match channel on Discord. | You and the Bot |
| Messages to staff | Messages and attachments you send to the Bot by direct message (modmail tickets), and staff applications you submit. | You |
| Moderation | Warnings, mutes and suspensions, the reason, and a short excerpt (up to 300 characters) of a message that broke a rule. The automatic moderator checks messages in our server as they are posted but does not keep other messages. | The Bot and staff |
| Website | A login cookie (see below). Your IP address is used briefly to limit abusive traffic and is not saved to our database. | Your browser |
| Site visits | Which pages of the Site you open, which links and buttons you click, the site you came from, and whether you use a phone, tablet or computer. Each visit is tied to a code made from your IP address, browser and a secret that changes every day, so we can count visitors without storing your IP address or recognizing you on another day. If you are logged in, your Discord ID is saved with it. | Your browser |
We don't collect your email address, your real name, your password, or any payment information. We don't read Discord messages outside our own server, and we can't see your direct messages with other people.
3. How we use it
- To run the queue, create match channels, record results and calculate ratings, ranks and leaderboards.
- To run tournaments and giveaways, check entry requirements, draw winners and deliver prizes.
- To keep the community safe: automatic moderation, staff reviews, disputes and suspensions.
- To answer you when you contact staff, and to review staff applications.
- To show public information on the Site and in Discord: your display name, avatar, rank, rating, results, leaderboard position, tournament brackets and giveaway wins.
We use this information because it is needed to provide the Service you asked to use, and for our legitimate interest in keeping competition fair and the community safe.
4. What is public
Leaderboards, recent results, tournament brackets and giveaway winners are visible on the Site and in our Discord server, with your Discord display name and avatar. Moderation records, modmail, staff applications, evidence and verification details are only visible to staff.
5. Website login and cookies
"Log in with Discord" uses Discord's official OAuth2 login with two permissions: identify (your Discord ID, username and avatar) and guilds.join (so the Bot can add you to our server). The access token from Discord is used once during login and is not stored.
The Site sets one cookie, tbx_session, which keeps you logged in for up to 30 days. It is signed so it can't be forged and isn't readable by scripts. During login, a short-lived cookie (tbx_state, 10 minutes) protects against forged logins. We don't use advertising cookies, analytics cookies or any third-party trackers.
Visit statistics. The Site counts page views and clicks itself (see "Site visits" above) so admins can see how the Site is used. No cookie is set for this and nothing is shared with anyone else. If your browser sends "Do Not Track" or "Global Privacy Control", the Site doesn't count your visits at all.
6. Who we share it with
We don't sell or rent your information. It is only handled by:
- Discord, which hosts our server and the Bot's messages (Discord Privacy Policy).
- Oracle Cloud (data center in Ashburn, Virginia, USA), which hosts our server and database.
- Yunite, which links your Epic account for verification (their own privacy policy applies).
- Google Fonts, which serves the Site's fonts; your browser connects to Google to load them.
- Let's Encrypt, which provides the Site's HTTPS certificate (no personal data is shared).
- Our staff, who see what they need to moderate, review matches and deliver prizes.
We may also share information if the law requires it, or to protect players from serious harm.
The Site shows how many people are playing our islands using Epic Games' public island statistics; this doesn't involve your personal data.
7. How long we keep it
- Your profile, match history, ratings and leaderboard data are kept while the Service runs, so records and seasons stay accurate.
- Moderation records, modmail tickets and staff applications are kept so staff can follow up on repeated problems.
- Match chats are kept with the match, so staff can check them if a result is disputed.
- The login cookie expires after 30 days, or when you log out.
- Site visit statistics are deleted after 180 days.
- Occasional database backups are kept privately by the server owner, and old backups are deleted when they're no longer needed.
When you ask us to delete your data, we delete or anonymize it, except for what we must keep to prevent abuse (for example a record that an account was suspended for cheating).
8. Your choices and rights
- See or delete your data: send a direct message to the Timed Boxfights bot on Discord (this opens a private ticket with staff), or ask in our Discord server at discord.gg/fcaRzffmmQ, and say what you'd like. We'll reply within 30 days.
- Remove website access: in Discord, go to User Settings → Authorized Apps and remove Timed Boxfights, or log out on the Site.
- Stop using the Service: leave the Discord server. The Bot stops collecting new information about you.
Depending on where you live (for example the EU, UK or California), you may have additional rights, such as access, correction, deletion, portability and objection. You can use them the same way, and you can also complain to your local data protection authority.
9. Children
The Service is not meant for children under 13, and we don't knowingly collect information from them. If you believe a child under 13 is using the Service, contact us and we'll remove their data.
10. Security
Our server only accepts key-based logins, the Site is HTTPS only, and the database isn't reachable from the internet. No system is perfectly secure, but we work to protect your information.
11. Changes to this policy
We may update this policy. We'll change the date at the top and announce important changes in our Discord server.
12. Contact
Questions about privacy? send a direct message to the Timed Boxfights bot on Discord (this opens a private ticket with staff), or ask in our Discord server at discord.gg/fcaRzffmmQ.