Privacy Policy

Effective date: 12 August 2026 Last updated: 12 August 2026

Squad Tactics for Rematch™ ("the app") is a private, invite-only tool for coaches of Rematch teams. It is operated by Superfranky ("we", "us"), and you can reach us at sup3rfr4nky@gmail.com.

This policy explains what the app stores, why, and who else can see it.

In short

• Access is invite-only. You need an invite code to create an account.
• We store what you type in: your teams, players, formations, lineups, and notes.
• There is no analytics, tracking, advertising, or third-party telemetry of any kind. The only cookie is the one that keeps you signed in.
• The app never sells or shares your data for marketing.
• Share links go to anyone holding both the link and your team's captain PIN. That is their purpose, and it is the main way data leaves the app.
• Most of the personal data here is about other people, your players. §2 matters most.

1. Data about you, the coach

When you sign in with Discord, Discord tells us and we store:

We request only Discord's default sign-in scopes. We cannot read your messages, servers, or friends, and we never post as you.

We do not collect your IP address, device fingerprint, location, or browsing behaviour into any analytics system, because the app has none.

2. Data you enter about other people

This is the most important section. The app is built for you to record information about your players, who are not users of the app and have not agreed to anything with us.

For each player you may store: a gamertag, gaming platform, jersey number, preferred positions, links to their Rematch Tracker and u.gg profiles, chemistry tags, and free-text notes and instructions you write about them.

The terms ask coaches to identify players by their in-game handle rather than their real name. We cannot enforce that, since no rule tells the two apart, so what is actually stored depends on what your coach typed.

Two consequences:

• You decide what goes in. We do not verify it, and we would rather you did not put anything in a note you would be uncomfortable with that player reading. Assume they may see it, since many of these fields are shown on shared plans by design.
• You are responsible for that data. Under the Terms of Service you confirm you have a proper basis for recording information about your players, and you handle their requests about it. We will help you find, export, or delete it.

Profile links are stored as text only. The app never contacts Rematch Tracker or u.gg, and nothing is fetched from them. Their site icons are served from our own servers, so simply viewing your roster does not tell those sites anything.

3. Share links (the part that leaves the app)

Creating a share link publishes a read-only page at /share/<token> that anyone with both the link and your team's captain PIN can open without signing in. It shows:

• both battle plan sections, On Defense and In Possession, with their lineups, formations, and the team's name, tag, competition and region
• each player's display name, chemistry tags, and the instructions written for their position in each phase
• any team notes you marked as shown on the plan
• your Discord display name and avatar, as the author of those instructions

Two things gate it. The token is 16 bytes of cryptographically random data, so the URL cannot be guessed. The captain PIN is a 4-to-8 digit code you set per team; without it, the page shows only a PIN prompt and reveals nothing about the plan. Not the team name, not the opponent.

Be realistic about what a short PIN buys. It stops a forwarded link from being a working link, which is its job. It is not account-grade security: a determined attacker who has your token could try to guess a 4-digit PIN, and our rate limiting is best-effort. Treat a shared plan as something that could still leak, and do not put anything in it you would not accept becoming public.

We store the PIN only as a salted scrypt hash. Nobody can read it back, including us and including you on the settings page. Changing the PIN immediately locks out everyone who had already entered the old one.

Share links do not expire on their own. They stay live until you revoke them, until the plan or team is deleted, or until you remove your team's PIN, which takes every one of that team's plans offline. Revoking is immediate.

4. Cookies

Two, both strictly necessary and neither used for tracking:

• the authentication cookie, set by the authentication library, holding your signed-in session
• an unlock cookie set on a share page after the right captain PIN is entered, so a player does not retype it on every reload. It holds no personal data, only a signed value tied to that one link. It is scoped to that one plan's URL, and expires after 12 hours.

There are no analytics, advertising, or preference cookies, so there is no consent banner to click.

5. Who else processes your data

These providers process data on our behalf under their own terms. We do not use any other processor, and we do not transfer data to anyone for their own purposes.

Avatars are loaded directly from Discord's CDN, so a person viewing a shared plan makes a request to Discord. We send that request without a referrer, so Discord is not told which plan was being viewed.

6. Keeping and deleting data

We keep data for as long as your account exists, because the app is a working record you come back to between matches. There is no automatic expiry.

What you can delete yourself, from inside the app:

• individual players, chemistry tags, formations, lineups, and share links
• a whole team, which also removes its players, lineups, instructions, share links, and scouting sheets

Deletions take effect immediately and are not recoverable. Backups held by our hosting providers may retain copies for a short period afterwards.

Deleting your entire account is not yet self-serve. Email us and we will delete your account and everything under it. We will confirm when it is done.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, delete, or restrict the use of your personal data, and to complain to a data protection authority.

In practice:

• Access and export: the app has CSV export for rosters and lineups. Ask us if you want everything.
• Correction: edit it in the app.
• Deletion: see §6.

For data about your players, ask your coach. They entered it and they control it. If a player contacts us directly we will pass the request on to their coach and help action it.

8. Security

• A new account needs an invite code. It is checked before your account is created, so someone who does not have it leaves no record behind at all. Wrong codes are rate limited, though that limit is best-effort.
• Every query is scoped to the signed-in owner inside the query itself. Another coach's data returns "not found" rather than "forbidden", so the app never confirms that someone else's team exists.
• Traffic is HTTPS-only and the app sends HSTS, X-Frame-Options, X-Content-Type-Options, and a referrer policy.
• Links you paste are restricted to http and https before they are ever rendered as clickable.

No system is perfectly secure. If you find a vulnerability, please email us rather than disclosing it publicly.

9. Children

The app is not directed at children and you should not sign in if you are under 16 (or the age of digital consent where you live).

Esports rosters often include minors. If you record data about a player under that age, you are responsible for having their guardian's permission, and we would encourage you to keep such notes to the minimum the team actually needs.

10. Changes

If we change this policy we will update the date at the top. If a change materially affects how your data is used, we will tell you directly. With so few users, that is a message, not a banner.

11. Contact

sup3rfr4nky@gmail.com