Privacy Policy

What we collect

From Discord: your Discord User ID, username, and avatar, plus the limited account access described below. We do not request your Discord email. Signing in to Heir does not join you to a Discord or enroll you in every League.

From gameplay: when you link an in-game identity (e.g. a PlayFab id) or play on a league’s connected game servers, we record match statistics — kills, deaths, scores, round events — attributed to that identity.

From league organizers: server configuration (regions, schedules, channels, roles) and, for stat tracking, game-server addresses with RCON credentials, stored encrypted.

For billing: payments run entirely through Stripe. We store your subscription’s status and plan; card numbers never touch our systems. Stripe’s handling is governed by Stripe’s privacy policy.

From site usage: when you visit an eligible public page and have not opted out, we collect a limited first-party aggregate page view and page type. A short-lived activity signal helps estimate active browser sessions. This estimate is not a count of exact people. A random identifier held in that browser tab’s session storage is rotated daily; analytics storage keeps a derived value rather than the raw identifier. It does not contain your Heir User ID, IP address, query string, referrer, or a fingerprint.

Images you upload: Heir Aura members can add images to their profile. We store the image, re-encode it, and remove embedded metadata such as location data before it is shown publicly. If you report an image, we store the report and your account as its author; the uploader is never told who reported. Heir staff review reported images. Removed images are kept privately for 30 days for appeals, and images hidden because an Aura membership ended are kept for 60 days, then deleted. See the Image Upload Policy.

Discord permissions and saved access

Everyday sign-in and reconnect ask for three Discord OAuth scopes. Discord documents these names in its OAuth2 guide:

• identify provides your Discord User ID, username, and avatar for sign-in and display.
• guilds provides basic information about the Discords on your account, including IDs, names, icons, ownership, and your permissions. Heir uses that list for a selected ownership or League setup check and does not retain the full list. Relevant Heir membership and setup records created from your actions can remain.
• guilds.members.read lets Heir fetch your own member record in a relevant Discord: whether you belong to that Discord and the roles you hold there. Heir uses it when you Join a Discord-connected League or finish a pending Join after returning from Discord.

Ordinary sign-in does not request scopes for joining Discords, reading messages, sending DMs, or reading email.

League installation and command access

Installing Heir for a League also requests bot, applications.commands. These add the bot and slash commands to the selected Discord. Heir checks current Heir Owner, Organizer, Captain, Member, Ref, and self-service authority when an action runs; Discord server permissions do not grant Heir product authority. The installed bot operates with its separately granted bot permissions.

Saved Discord access

Heir stores your Discord access token, refresh token, granted scopes, and expiry in encrypted account storage, and refreshes access when a permitted check needs it. Signing out ends the browser session but keeps this saved access. Disconnect saved Discord access in Settings clears the saved credential for your Heir User while keeping you signed in. It does not delete your account or League history, uninstall the bot, or revoke Heir’s authorization in Discord. To revoke Heir’s authorization at Discord, remove Heir under Discord User Settings → Authorized Apps. Signing in or reconnecting later can save new access again.

What we do with it

Run the product: standings, ratings, schedules, player profiles, and match reports — including public league pages on heir.gg showing competitive results under your Discord display name. We use the limited site-usage aggregate described above to understand page views and recent activity. We do not sell personal data, run third-party advertising, or share data for advertising. We exchange relevant data with Discord for the sign-in and integrations you request, and use service providers that host the Service and process payments (cloud infrastructure and Stripe).

Cookies

The session cookie keeps you signed in. The limited site-usage measurement described above uses session storage for a random, daily-rotated tab identifier; it does not use a tracking cookie, account identifier, or fingerprint. Collection is suppressed when your browser sends a Global Privacy Control or Do Not Track signal, including the corresponding HTTP privacy signals.

Retention and deletion

League Owners can archive their League from its management page. Archiving closes League operations and disconnects Discord, while retaining matches, stats, ratings, achievements and competitive history for player profiles. Existing League and profile visibility choices still apply. Cleanup may take time, and backup copies remain until their retention period ends. You can unlink an in-game identity with the bot’s /identity command. For anything else — including full removal of data attributed to you — email hello@heir.gg or ask in the Heir community Discord and we’ll handle it. Site page-view aggregates are retained for up to 365 days. Recent activity used for the session estimate expires after 15 minutes. A periodic cleanup removes rows after those cutoffs; a later successful sweep or a cleanup backlog can delay physical removal, so the cutoff is not an exact deletion time.

Security

Sign-in uses Discord OAuth (we never see passwords), game-server credentials are stored encrypted, and Heir checks League permissions before protected changes. Discord access is used for Discord-specific verification and actions.

Contact

Privacy questions or requests: hello@heir.gg, or the community Discord.

Changes

If our data handling changes materially, this page changes with it and we’ll say so in the community Discord. See also our Terms of Service.