Privacy Policy

The data controller for personal data processed within SPAWNSY is the operator of the service available at spawnsy.com (the “Controller”).

For any matter related to the processing of personal data, contact the Controller at: [email protected].

Account data: email address, username, password hash (the password itself is never stored in plain text), optional avatar, sign-in session data. Purpose: creating and operating your account and enabling sign-in-gated features. Legal basis: GDPR Art. 6(1)(b) (necessary for performing the account-service contract).

Sign-in via Google, Steam, or Twitch: if you choose to sign in through an external provider, we process the account identifier issued by that provider and basic profile data (e.g. email address, display name) needed to link the external account to yours. Legal basis: GDPR Art. 6(1)(b).

FACEIT integration (FACEIT Chat API feature): for users of this feature, we process the FACEIT nickname they provide and the data retrieved through it from the FACEIT API, such as level, elo, and match results, in order to make that information available to stream viewers via the Twitch/Kick chat bot. Legal basis: GDPR Art. 6(1)(b) (performing the specific service feature the user requested).

Comments and user-submitted content: the comment text and its link to the author's account, needed to display it, moderate it, and protect against abuse (spam, unlawful content). Legal basis: GDPR Art. 6(1)(b) and (f) (the Controller's legitimate interest in maintaining order and content safety).

Technical and security data: IP address, browser and device information, and session data, processed to secure sign-in, detect abuse (e.g. unauthorized access attempts), and keep the service stable. Legal basis: GDPR Art. 6(1)(f).

Traffic analytics (Google Analytics): basic visit and content-view statistics via Google Analytics. Legal basis: GDPR Art. 6(1)(f), and, to the extent required by applicable cookie law, your consent.

Geographic view analytics (first-party): to estimate visitors' approximate country and distinguish unique article visits from repeat views on the same day, we process the visitor's IP address. The IP address itself is never stored in our database, we use it only momentarily, in server memory, to determine the country via a geolocation database and to generate a one-way, pseudonymized hash that is stored instead of the address itself. Legal basis: GDPR Art. 6(1)(f) (the Controller's legitimate interest in understanding basic visit statistics and their geographic distribution).

Newsletter: if you sign up for our weekly newsletter, we process the email address you provide, your chosen language, and a record proving your consent (the date and time of sign-up, plus the IP address and browser identifier used at that moment), kept as evidence that consent was given. Signing up requires a two-step confirmation: after submitting the form we send an email with a confirmation link, and only clicking it activates the actual newsletter delivery. Legal basis: GDPR Art. 6(1)(a) (your freely given consent) in connection with Art. 10 of the Polish Act on the provision of electronic services. You can withdraw your consent at any time by clicking the "unsubscribe" link in the footer of any newsletter email, without giving a reason and without affecting the lawfulness of processing carried out before the withdrawal. Email addresses left unconfirmed for 14 days after sign-up are automatically deleted.

Data may be shared only with providers whose services we rely on to run the site, and only to the extent needed for their function:

Google (Google sign-in and Google Analytics), Valve/Steam (Steam sign-in), Twitch (Twitch sign-in, used by the FACEIT Chat API feature), FACEIT (retrieving player stats for the FACEIT Chat API feature), Cloudflare (Turnstile, bot protection on the sign-in, registration, and newsletter sign-up forms), Resend (transactional email: confirmations, verification codes, password resets, newsletter).

These providers may process data on servers located outside the European Economic Area. Where that is the case, we only use providers offering an adequate level of data protection (e.g. under standard contractual clauses approved by the European Commission).

We do not sell user personal data or share it with third parties for marketing purposes.

Essential cookies: maintain your sign-in session (member account and, where applicable, the editorial panel). Without these, sign-in and account use are not possible.

Temporary external sign-in cookies: set only for the duration of a Google or Steam sign-in flow, removed automatically once it completes.

Functional cookies: remember interface preferences such as your chosen language (Polish/English) or color theme.

Analytics cookies: set by Google Analytics, used to measure traffic and aggregate usage patterns.

You can change your cookie settings at any time in your browser, including blocking or deleting cookies. Doing so may limit some site functionality.

Account data is kept for as long as the account exists. After deletion, data may be retained for an additional, justified period arising from the Controller's legal obligations or the need to establish, pursue, or defend legal claims.

Session data, technical data, and sign-in security data are kept only as long as needed for the purpose they were collected for, typically no longer than the validity of the relevant session or token.

Regarding your personal data, you have the right to: access it, correct it, request deletion, restrict processing, request portability, and object to processing based on the Controller's legitimate interest.

Where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before the withdrawal.

You also have the right to lodge a complaint with the supervisory authority responsible for data protection. In Poland, this is the President of the Personal Data Protection Office (PUODO).

To exercise any of these rights, contact us at [email protected].

User passwords are stored only in hashed form (never in plain text). The connection to the site is encrypted (HTTPS). Sign-in and registration forms are additionally protected against automated, bot-driven attempts.

This Privacy Policy may be updated from time to time, in particular following changes to the site's functionality or applicable law. The current version is always available at this address.