Last updated 5 October 2026

This policy explains what FLRanked collects, why, and what you can do about it. We are the controller of this data for the purposes of the UK and EU General Data Protection Regulation.

What we collect

Account — email address, username, password (stored only as a hash we cannot reverse), and the date you joined.
Profile — anything you choose to add: profile picture, bio, linked Discord handle.
Gameplay — your beats, their scores, battle results, rating and match history.
Technical — IP address, approximate country derived from it, and the time you were last active.

We do not use advertising trackers, we do not run third-party analytics that profile you across sites, and we do not sell personal data to anyone.

Why we use it, and our legal basis

To run your account and battles — performance of our contract with you.
To keep the platform fair and secure — rate limiting, abuse prevention, and restricting access from network addresses used for ban evasion. Our legitimate interest in a functioning service.
To show public profiles and leaderboards — performance of our contract; your username, picture, rating and results are visible to others by design.
To send service messages — such as email confirmation. Performance of our contract.

Your audio

Submitted beats are stored so they can be scored, shown to the opponent in that battle, and played back in your own history. A finished run may be offered as an opponent to another player — they hear the beat and see its score, nothing more. Your audio is never sold, licensed on, used in advertising, or used to train machine-learning models.

Cookies

We set only what the site needs to work: a session cookie that keeps you signed in, and a cookie set by Cloudflare Turnstile to tell humans from bots on the sign-in and sign-up forms. There are no advertising or profiling cookies, so there is no consent banner to click through.

Who processes it

Supabase — database, authentication and file storage.
Vercel — hosting and content delivery.
Cloudflare — bot protection on the authentication forms.
Discord — only if you link your account, and only your Discord user ID.

Some of these operate outside the EEA. Transfers rely on the European Commission's Standard Contractual Clauses.

How long we keep it

Account and profile data: until you delete your account.
Beats and battle results: until you delete them or your account.
IP addresses and moderation records: up to 12 months, or longer for an active ban where that is necessary to enforce it.
Backups: overwritten on our normal cycle, within 30 days.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to processing based on legitimate interests. You can also ask for your data in a portable format. We respond within one month. If you are unhappy with how we handle a request, you can complain to your national data protection authority — in Hungary, the NAIH.

Deleting your account removes your profile, submissions and results. A moderation record may be kept where it is needed to enforce an active ban.

Children

FLRanked is not for under-13s. If we learn that an account belongs to a child under 13, we delete it.

Security

Traffic is encrypted in transit. Passwords are hashed. Access to the production database is limited to administrators. Submitted audio is stored in a private bucket and served through short-lived signed links. No system is perfectly secure, but if a breach affects your rights we will notify you and the regulator as the law requires.

Changes

If this policy changes materially we will announce it on the site before the change takes effect.

Contact

To exercise any right above, or to ask a question: our Discord server, or the email on the site.