Privacy Policy

Overview

This privacy policy has been compiled to better serve those who are concerned with how their 'Personally identifiable information' (PII) is being used online. PII, as used in US privacy law and information security, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Please read our privacy policy carefully to get a clear understanding of how we collect, use, protect or otherwise handle your Personally Identifiable Information in accordance with our website.

What we collect

What personal information do we collect?

When you register, we ask for a username, an email address and a password. You can add more to your profile later, such as your location and the games and characters you play.

When you use the site, we record your matches and results, the chat messages, direct messages and forum posts you send, and the times and IP addresses of your logins and some of your activity.

If you have not set a location, we estimate your approximate region (country, state and nearest city) from your IP address and use it only to match you with nearby opponents. The estimate is not shown on your profile or to other players, who see only a rough distance in matchmaking. Setting a location on your profile replaces it.

If you subscribe or donate, Stripe or PayPal handles the payment. We keep a record of the payment, including the payer email address. Your card details go to Stripe or PayPal and never reach our servers.

When do we collect information?

We collect information when you register, fill in your profile, play matches, chat, post, submit a support ticket or make a payment.

Signing in with Discord or Google

If you sign up, log in or link your account with Discord or Google, that service shares the following with us, with your permission:

• Your account ID on that service
• Your email address, and whether that service has verified it
• Your display name (and your Discord username)
• Your profile picture URL

We use this information only to sign you in, to create or link your SmashLadder account, and to show in Account Settings which account is linked. If the email address is verified, we may use it to link your sign-in to an existing SmashLadder account with the same verified email. We store the account ID, email address, display name and profile picture URL with the link. We do not store Discord or Google access tokens, we do not request access to anything else in your Discord or Google account, and we do not sell or share this information.

You can unlink Discord or Google from Account Settings at any time; unlinking deletes the stored information for that link. Deleting your account deletes it too.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

How do we use your information?

We use the information we collect to:

• Run your account and sign you in
• Match you with opponents and keep rankings and match history
• Moderate the site, settle disputes and detect alternate accounts used to evade bans
• Process subscriptions and donations
• Send you emails about your account

How do we protect visitor information?

Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential.

The site is served over HTTPS, so what you send us is encrypted in transit. Passwords are stored as one-way hashes, not as text.

All payments are processed by Stripe or PayPal. Card details are not stored or processed on our servers.

Deleting your account

You can delete your account from Account Settings → Delete Account. You must confirm with your password, or, if your account has no password because you sign in with Discord or Google, with a code we email to you.

Your account is closed immediately and permanently deleted 14 days later. If you log in before then, your account is restored.

When your account is deleted, we delete:

• Your profile details and email address
• Linked accounts (Discord, Twitch, etc.)
• Your friends, ignores and notes
• Your preferences
• Your login sessions
• Chat messages and direct messages you sent
• Your notification subscriptions

We keep the following, attributed to "Deleted user" instead of your username:

• Match history and results, so other players' records stay accurate
• Forum posts
• Tournament results

We also keep:

• Moderation records (warnings and bans), attached to the anonymized account
• A one-way cryptographic hash of your email address. It is used only to detect when an account with a moderation history registers again.
• If your account has a moderation history, your login session records (times and IP addresses) and the IP addresses recorded with your activity (for example on forum posts and in our activity logs). They are used to detect ban evasion. For other accounts, these records and IP addresses are deleted.
• Payment and subscription records, including the payer email address, for accounting and legal obligations

Active Stripe subscriptions are cancelled automatically when you delete your account. PayPal subscriptions are not; you must cancel them in PayPal.

After your account is deleted, its email address and username can be used to sign up for a new account.

Do we use 'cookies'?

Yes. Cookies are small files that a site or its service provider stores in your browser, if you allow it, so that it can recognize your browser later.

We use cookies to:

• Keep you logged in and connect you to matchmaking and chat
• Remember your preferences, such as your language and time zone

Google and Twitch also set cookies on our pages. See "Third parties on our site" below.

You can choose to have your browser warn you each time a cookie is being sent, or you can turn off all cookies, in your browser's settings. Each browser is a little different, so look at your browser's Help menu to learn how to change your cookie settings.

If users disable cookies in their browser:

If you disable cookies, you can still browse the site, but you cannot log in, so matchmaking, chat and your account will not work.

Third Party Disclosure

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information unless we provide you with advance notice. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business, or servicing you, so long as those parties agree to keep this information confidential. We may also release your information when we believe release is appropriate to comply with the law, enforce our site policies, or protect ours or others' rights, property, or safety.

However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.

Third party links

Occasionally, at our discretion, we may include or offer third party products or services on our website. These third party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites.

Third parties on our site

Google AdSense

We show Google AdSense ads to visitors who are not subscribed. Subscribers do not see ads. Google, as a third party vendor, uses cookies to serve these ads, and can use them to show you ads based on your visits to our site and other sites on the Internet.

Google Analytics

We use Google Analytics to count page views. It sets its own cookies.

Twitch

Some pages embed live Twitch streams. The embedded Twitch player can set Twitch's cookies.

Service providers

Stripe and PayPal process payments. Mailgun delivers the emails we send. Discord, Google and Twitch receive your request when you sign in with them or link them to your account.

MaxMind GeoLite

We estimate regions from IP addresses with a copy of MaxMind's GeoLite database kept on our own servers, so your IP address is not sent to MaxMind. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.

Opting out

You can set how Google advertises to you on the Google Ad Settings page, and opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on. Subscribing also removes ads.

California Online Privacy Protection Act

CalOPPA is the first state law in the nation to require commercial websites and online services to post a privacy policy. The law's reach stretches well beyond California to require a person or company in the United States (and conceivably the world) that operates websites collecting personally identifiable information from California consumers to post a conspicuous privacy policy on its website stating exactly the information being collected and those individuals with whom it is being shared, and to comply with this policy. - See more at: http://consumercal.org/california-online-privacy-protection-act-caloppa/#sthash.0FdRbT51.dpuf

According to CalOPPA we agree to the following:

• Users can visit our site anonymously.
• A link to this policy, with the word 'Privacy' in it, is on the sign-up page.

Users will be notified of any privacy policy changes:

• On our Privacy Policy Page

Users are able to change their personal information:

• By logging in to their account
• By chatting with us or sending us a ticket

Users are able to delete their account:

• From Account Settings → Delete Account (see "Deleting your account" above)

How does our site handle do not track signals?

We don't honor Do Not Track (DNT) signals. Google AdSense, Google Analytics and embedded Twitch streams load whether or not your browser sends one.

Does our site allow third party behavioral tracking?

Yes. Google can use its AdSense and Analytics cookies to track you across sites, as described in "Third parties on our site" above. Subscribers do not see AdSense ads.

COPPA (Children Online Privacy Protection Act)

When it comes to the collection of personal information from children under 13, the Children's Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, the nation's consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children's privacy and safety online.

We do not specifically market to children under 13. Users must be 13 or older to have an account, and accounts found to belong to younger users are banned.

Fair Information Practices

The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.

In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur:

We will notify users with an in-site notification within 7 business days.

We also agree to the individual redress principle, which requires that individuals have a right to pursue legally enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or a government agency to investigate and/or prosecute non-compliance by data processors.

CAN SPAM Act

The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.

We collect your email address in order to:

• Verify your email address
• Send you sign-in codes and account recovery emails
• Tell you about changes to your account, such as a scheduled deletion or a reply to your ban discussion

We do not send newsletters or marketing email, and we do not sell or share your email address.

If at any time you would like to stop receiving emails from us, send us a support ticket and we will promptly remove you from all correspondence. Some emails, such as sign-in codes, are needed to use your account.

Contact us

If there are any questions regarding this privacy policy, you can contact us by submitting a support ticket.