1. What We Collect

• Account data: your username, optional display name, and your Discord ID, Discord username and Discord avatar (linked when you log in with Discord). We do not see or store your Discord password.
• No email: we do not collect or store email addresses.
• No passwords: accounts created through Discord have no password on our side. Legacy accounts with a password store only a bcrypt hash — never the password itself.
• Security data (staff only): if you enable two-factor authentication, we store the secret needed to verify your codes.
• Activity data: level records, submissions, comments, clan memberships, shop purchases and bcoin balance.
• Technical data: an essential login session cookie. Server error logs may contain request paths; they are not used for tracking.

2. What We Do NOT Collect

• We do not require or store your IP address at registration.
• We do not use analytics, tracking pixels or advertising cookies.
• We do not sell or share your data with advertisers or data brokers.

3. How Your Data Is Used

• To run the leaderboard: displaying records, submissions, rankings and clans.
• To keep accounts secure: Discord login, two-factor authentication for staff.
• To prevent cheating and abuse of the record system.
• Site activity (e.g. logins, admin actions) is recorded in internal logs visible only to administrators.

4. Cookies

This site uses only essential cookies:

• Session cookie: keeps you logged in (secure, HttpOnly). It is deleted when you log out or close your browser.
• UI preference cookie: remembers whether you disabled thumbnails.

Third-party content: hCaptcha runs on some forms (their privacy policy applies to their checks); YouTube embeds/thumbnails load from YouTube's servers when videos are shown.

5. What Is Public

Your username, display name, profile page, records, submissions and clan membership are publicly visible — that is the point of a leaderboard. Your Discord ID, bcoin balance details, security settings and everything in admin logs are not public.

6. Data Retention & Deletion

You can delete your account yourself at any time from Profile → Settings → Delete Account. Deletion has a 7-day grace period during which you can cancel it; after that your account and personal data are permanently removed. Records tied to deleted accounts are removed with them. Automated backups may retain copies for up to 30 days.

7. Security

The site enforces encrypted connections (HTTPS), secure session cookies, CSRF protection and staff-only two-factor authentication. If you discover a security issue, please report it via our Discord server (see security.txt).

8. Contact

For privacy questions or data requests, contact a site admin via the Bottom List Discord server.