Privacy Policy

The data controller responsible for your personal data is:

Supatimer
Operated by Luwall AB (org. nr 559359-5993)
Contact us via our Discord server.

We have not appointed a Data Protection Officer (DPO) as we do not carry out large-scale processing of special categories of data or systematic monitoring of individuals. You may contact us directly for any data protection matters via our Discord server.

When you use Supatimer, we collect and process the following personal data, obtained from Discord via their official API:

• Discord profile data: Your Discord user ID, username (global display name), server nickname, and avatar URL
• Server membership: Which Discord servers (guilds) you share with the bot, and your roles in those servers
• Availability selections: The days and time slots you select as available through the bot or web dashboard, including who set or changed the selection
• Absence records: Any absence periods you or a team manager sets
• Team configuration: Your assigned scrim roles, primary role, player status, and preferred server
• Team details: Your team's name, emoji and rank, and the range of opponent ranks it accepts, as set by its managers. These describe the team, not you
• Team contact person: When a manager types in a contact person for the team instead of choosing a member, we store the BattleTag and Discord username they entered. It is shown to your team and handed to teams you arrange scrims with, the way the team's scrim exchange info is
• Search records: When you look up another team by its Supatimer id, read the free times you share with one, or open the list of teams near your rank, we record that you did, from which team, when, and whether anything was found - to limit searches per hour
• Scrim requests: When your team asks another for a time, or sends a booking request from Find a time or the scrim finder, we store the two teams, the day and times proposed, who sent and who answered it, and which manager got the Discord message about it - so either team can answer, cancel or retry it, and to limit how many requests one person sends. When a manager cancels a booked scrim, we also store who cancelled it, when, and the reason they wrote, which is sent to the other team and shown in both teams' History. Each turn of a booking request - the request and every counter offer - is kept with who made it, and the other team's managers see the Discord username of the manager behind your team's latest turn, with a link to their Discord profile, so the two managers can message each other. The other team also sees your team's contact person for that day - their BattleTag and Discord username - so the two teams can reach each other. When a scrim is booked, the bot posts it in both teams' scrim channels on Discord: each team's post names the other team, its rank and that contact person's BattleTag and Discord username
• Scrim stats: When a team uploads an Overwatch scrim log, we store the log file and the statistics read from it: every player's in-game name, heroes, and numbers per map and round (eliminations, deaths, damage, healing, ultimates, kills), for both teams in the lobby. To show your team its own players, we remember which in-game name belongs to which member - matched by a linked BattleTag or chosen by one of your team's stats editors
• Linked Battle.net accounts: When you link a Battle.net account, we store its BattleTag and its Blizzard account id, so your team can see the link is verified and your in-game name can be matched in scrim stats. You can unlink it at any time on your Account page
• Rank screenshots: When you add screenshots of your rank for tournaments, we store each image with the game, the account and the season it is for, whether you placed that season, where you played it (PC, console or a mix), and when you added it. For a game that is not linked through Battle.net, we store the in-game name you type for it. When an Overwatch screenshot is checked (Section 5), we keep what was read from it with it - the season, rank and lifetime hours it shows - and the result of the check. When a tournament's admins accept or deny a screenshot, we keep their decision with it: which admin decided, when, the ranks it was made on, and any comment they wrote to you. We also record when you last opened Rank verification, to know when your screenshots may be deleted (Section 9). Your browser re-encodes each image before it is sent, which removes the file's hidden details (such as when and where it was taken)
• Tournament sign-ups: When a team manager signs a team up for a tournament season, we store the team, the ladder it plays in and the rank it signed up with, who sent the sign-up and when they accepted the season's rules, and for each player on the roster their Discord user ID, their Discord display name at that moment, their role and whether the season's admins approved them. When the admins turn a team down, we keep the note they wrote
• Stats shares: When a team shares a scrim's stats with the team it played, we store which team shared them, with which team, who shared them, and when. A share sent by Supatimer id waits for the other team's answer: we also store who answered it and when, and which of that team's managers got the Discord message about it
• Notes: When you write in Notes, we store your files - their names, the server each belongs to, and every bullet's text and style - with who last changed each bullet and when, which bullets you keep folded, and when the file was last opened. A file is shown only to you and to the people you share it with - by name, everyone on the roster of a team you pick, or everyone holding a Discord role you pick in that server - each as an editor or a reader, and only while they are signed in and in that server (and, for a role, while they hold it). We store who each file is shared with. A file's owner can hand it to a person it is shared with by name: that person then owns it, and the old owner stays on it as an editor. Anyone a file is shared with can download it, or one branch of it, as a Markdown or OPML file: the copy is made in their browser and saved on their own device, and from then on it is theirs to keep or share. Bullets and files you delete are kept for a while so you can restore them (Section 9)
• Authentication tokens: Discord OAuth access and refresh tokens, stored securely to maintain your web dashboard session
• Poll votes: Your votes on scheduling polls created within your team

During Discord OAuth sign-in, your email address is transmitted by Discord as part of the authentication handshake. This email is not stored or retained by Supatimer and is processed only transiently during the sign-in process.

We do not collect message content, direct messages, voice data, IP addresses, or any information from channels where the bot is not actively used.

When a server administrator installs the Supatimer bot in a Discord server, we receive basic membership data about all members of that server from the Discord API. This means we may process your data even if you have not directly interacted with Supatimer.

Categories of data obtained indirectly:

• Discord user ID
• Username (global display name) and server nickname
• Avatar URL
• Server roles
• Guild membership (which servers you share with the bot)

Source: This data is obtained from Discord's official API when the bot joins a server or when guild member lists are refreshed.

Purpose and legal basis: This data is processed under legitimate interest (Art. 6(1)(f)) to enable the scheduling service to function - for example, to display team rosters and allow managers to set availability on behalf of team members. We only process the minimum data necessary and do not use it for any secondary purposes.

If you are a member of a Discord server that uses Supatimer but have not interacted with the bot yourself, all rights described in Section 12 of this policy apply to you. You may contact us to request access to, correction of, or deletion of your data.

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)) - Processing your Discord profile data and availability selections is necessary to provide the scheduling service you request when you interact with the bot or sign in to the dashboard.
• Legitimate interest (Art. 6(1)(f)) - We process server membership and role data to ensure the service operates correctly (e.g. verifying you have access to a team). Our legitimate interest is providing a functional multi-team scheduling service. We have assessed that this does not override your rights, as we only process the minimum data needed and do not use it for any secondary purposes.

We do not rely on consent as a legal basis for processing. We do not use your data for marketing, advertising, or profiling.

Your data is used to provide and improve the scheduling service:

• Display availability calendars to your team
• Generate lineup suggestions based on availability
• Match your team with teams near its rank: a day your team marks Scrim or Maybe Scrim, or leaves unmarked, once its lineup is full, is shown to those teams with your team's name, its rank and the times both teams are free
• Show your team its scrim statistics - per map, per round and per player - from the scrim logs it uploads, or that the team it played shares with it
• Let the admins of a tournament you enter check your Overwatch rank before they approve you, from the rank screenshots you add
• Check each Overwatch rank screenshot before an admin sees it: Anthropic's Claude reads the image - only the image, never the season you said it is for or anything else about you - and our own code compares what it read with the season you picked, and the lifetime hours with those on your other screenshots. A screenshot the check cannot clear goes to a person; a rejected one tells you what to fix. The tournament's admins still decide whether to approve you
• Send automated calendar embeds and reminders in Discord
• Authenticate you on the web dashboard
• Understand how the service is used through anonymized usage analytics (page views, session recordings, and interaction data) to improve the user experience

We do not use your data for advertising, analytics profiling, or any purpose unrelated to the scheduling service. We do not use automated decision-making or profiling that produces legal effects concerning you. Lineup suggestions are advisory and always subject to manager review.

Your availability data is visible to other members of your team within Supatimer. This is the core functionality of the service.

If your team is Discoverable, teams near its rank, in any server, can see your team's name, its rank and the times on its open Scrim days when both teams can play - never who is in the lineup or who answered. A team manager can turn Discoverable off in Team settings, and a team can block another.

When your team sends a scrim request, the team it is sent to sees your team's name, its Supatimer id and its rank, and one of its managers gets a Discord direct message from the Supatimer bot about it - never who sent it.

A team's scrim stats are visible to the members its managers allow to see them. A team's stats editor can share one scrim's stats with the team it played: that team then gets its own copy of the statistics - every player's in-game name and numbers, from both teams - shown to its own members by its own settings. The log file itself is never shared. The copy belongs to the receiving team from then on (see Section 9). When the scrim was not booked through Supatimer, the stats editor finds that team by its Supatimer id, and nothing is copied until one of its managers accepts: a manager gets a Discord direct message from the Supatimer bot naming your team, the scrim's date and its maps, and an unanswered share ends after 14 days.

Your rank screenshots are shown only to you, and to the admins of a tournament whose roster you are on - with what the check read from them and why one waits for a person, so they can accept or deny it. An admin's comment on your screenshot is shown to you, under the tournament's name. They are never shown on a public page.

While signing a team up for a tournament, its manager sees, for each player who can see the team's channel, whether they are in the Supatimer Discord server, whether they have linked a Battle.net account, how many of the rank screenshots a host looks for they have added, and whether their lifetime hours have been read from them - never the screenshots themselves. A roster's display names and roles are shown to the season's admins, and once the team is approved, on the season's page, which anyone with its link can open.

We do not sell, rent, or share your personal data with third parties for their own purposes. We do not disclose data to ad networks or data brokers.

The following service providers (data processors) process your data on our behalf to operate the service:

• Discord (Discord Inc., USA) - Bot interactions and OAuth authentication
• Supabase (Supabase Inc., USA) - Database hosting (PostgreSQL)
• Vercel (Vercel Inc., USA) - Web application hosting
• Cloudflare (Cloudflare Inc., USA) - Discord interaction proxy (Cloudflare Workers)
• PostHog (PostHog Inc., USA / EU) - Product analytics, session recordings, and heatmaps. Data is stored in the EU (Frankfurt). PostHog operates in cookieless mode on our site, meaning no cookies or persistent identifiers are set on your device. See our Cookie Policy for details.
• Anthropic (Anthropic PBC, USA) - Reads Overwatch rank screenshots for the screenshot check (Claude API). Only the image is sent; what it read is kept with the screenshot in our database
• Google (Google LLC, USA) - Reads the scrim post a team manager pastes or uploads to fill in a scrim (Gemini API). Only that post is sent
• Groq (Groq Inc., USA) - Answers the questions you ask the help assistant. Your question and the conversation so far are sent

These providers act as data processors under applicable data protection agreements. We do not share data with any other third parties except when required by law, or when you play a guide video (below).

Guide videos (YouTube). The videos on our guide page are hosted on YouTube, a service of Google. Nothing is loaded from YouTube until you press play on one. When you do, the video loads from youtube-nocookie.com, YouTube's privacy-enhanced mode, and Google receives your IP address and browser details and may store data on your device. Google processes this as an independent controller under its own privacy policy, and may do so in the United States. If you never press play, YouTube receives nothing from your visit.

Your personal data is transferred to the United States where our service providers (Discord, Supabase, Vercel, Cloudflare, Anthropic, Google and Groq) operate. These transfers are protected by the following safeguards:

• EU-U.S. Data Privacy Framework (DPF): Discord, Vercel, Cloudflare and Google are certified under the EU-U.S. Data Privacy Framework. The European Commission has adopted an adequacy decision for transfers to DPF-certified companies (July 2023).
• Standard Contractual Clauses (SCCs): Where DPF certification does not apply (including Supabase, Anthropic and Groq), transfers are governed by Standard Contractual Clauses approved by the European Commission, which provide appropriate contractual safeguards.

You may request further details about the specific safeguards applied to any transfer by contacting us.

Your data is stored in a PostgreSQL database hosted by Supabase with row-level security (RLS) policies that restrict access at the database level. All communication between services is encrypted via HTTPS/TLS. Data at rest is encrypted by our infrastructure providers.

We implement technical and organisational measures appropriate to the risk, including access controls, encrypted connections, and regular security reviews. However, no internet service can guarantee absolute security.

We retain your data only as long as necessary for the purposes described in this policy:

• Active use: Data is retained while your team actively uses the service.
• After bot removal: If the bot is removed from a Discord server, associated guild data is retained for up to 24 months to allow for re-installation. After this period, data may be deleted. Guild owners may request immediate deletion by contacting us.
• Scrim logs and stats: An uploaded log file is deleted after 60 days (or the window your server's plan sets). The statistics read from it are kept while the team keeps that scrim: each team keeps its most recent scrims up to its history limit, and the oldest are deleted as new ones arrive. A team's managers can delete a scrim's stats at any time.
• Shared stats: A shared copy follows the receiving team's own history and deletions. The team that shared it cannot recall it, and deleting its own upload does not delete the copy. Deleting a team deletes its scrim stats and the copies it received.
• Notes: Deleted bullets and deleted files are kept for 30 days so they can be restored, then permanently deleted. If nobody has opened a Notes file for 286 days, the Supatimer bot tells its owner in a Discord direct message; if nobody opens it in the next 14 days, it is deleted the same way - kept 30 days so its owner can restore it, then permanently deleted.
• Rank screenshots: A screenshot is deleted 2 years after you added it. If you have not opened Rank verification for a year, the Supatimer bot tells you in a Discord direct message, and your screenshots are deleted 30 days later unless you open it before then. You can remove any screenshot or typed account at any time, and unlinking a Battle.net account deletes all of its screenshots. What the check read from a screenshot, and the tournament admins' decisions on it, are deleted with it. A record of each check sent to Claude - when, and what it cost, never the image or what was read - is kept for 13 months, so a deleted screenshot still counts toward the month's checks.
• Tournament sign-ups: A sign-up and its roster are kept with the tournament season, as its record. When a manager withdraws a sign-up, its roster is deleted and the sign-up is kept as withdrawn. Deleting the team deletes its sign-ups.
• Authentication tokens: Discord OAuth tokens expire automatically after 6 days if not refreshed.
• Upon deletion request: When you request erasure of your personal data, we will process your request within 30 days. Your Discord profile data (user ID, username, avatar), absence records, linked Battle.net accounts, rank screenshots, the game names you typed and your places on tournament rosters are permanently deleted, and so are your Notes files with their bullets, shares and folds; on Notes files other people own, your name is removed from the bullets you last changed. Availability selections and poll votes are anonymized (your Discord ID is removed) to preserve team continuity.

The web dashboard uses only strictly necessary cookies for authentication (Supabase session tokens). These cookies are required for the service to function and are exempt from consent requirements under the ePrivacy Directive (Article 5(3)) as they are essential to provide the service you have requested.

We use PostHog for product analytics (page views, session recordings, and interaction heatmaps) to understand how the service is used and to improve the user experience. PostHog operates in cookieless mode - it does not set any cookies or persistent identifiers on your device. Analytics data is stored in the EU (Frankfurt). No cross-session tracking is performed.

We do not use tracking cookies or advertising cookies, and no third-party cookies are set unless you press play on a guide video, which loads YouTube's player (Section 6). For full details, see our Cookie Policy.

Supatimer is not directed at children under 13 years of age (or the applicable minimum age of digital consent in your jurisdiction, such as 13 in Sweden per the Swedish Data Protection Act). We do not knowingly collect data from children. In accordance with Discord's Terms of Service, users must meet the minimum age requirement to use Discord and our service.

If you believe a child has provided us with personal data, please contact us so we can delete it promptly.

Under the General Data Protection Regulation (GDPR) and the Swedish Data Protection Act (Dataskyddslagen 2018:218), you have the following rights:

• Right of access (Art. 15) - Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) - Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) - Request deletion of your personal data. See Section 9 for details on what is deleted and what is anonymized.
• Right to restriction (Art. 18) - Request restriction of processing in certain circumstances.
• Right to data portability (Art. 20) - Receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21) - Object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right related to automated decision-making (Art. 22) - You have the right not to be subject to decisions based solely on automated processing that produce legal effects concerning you. Supatimer does not make such decisions.

Since we do not rely on consent as a legal basis for processing, the right to withdraw consent under Art. 7(3) does not apply. However, you retain all other rights listed above.

To exercise any of these rights, contact us through our Discord server. We will respond within 30 days as required by GDPR.

If you believe we are processing your personal data in violation of the GDPR, you have the right to lodge a complaint with the supervisory authority. For Sweden, this is:

Integritetsskyddsmyndigheten (IMY)
Swedish Authority for Privacy Protection
Box 8114, 104 20 Stockholm, Sweden
Phone: +46 (0)8 657 61 00
Email: imy@imy.se
Website: www.imy.se

If you reside in another EU/EEA country, you may also file a complaint with your local supervisory authority.

Providing your Discord profile data is required for the service to function. If you choose not to provide this data (by not interacting with the bot or not signing in), you will be unable to use Supatimer. There are no other consequences beyond inability to access the service.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will make reasonable efforts to notify users (for example, through a Discord announcement). Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your data, please reach out through our Discord server.