Privacy Policy

The data controller is the operator of the Project Crossfire website. Contact details for general questions, payments, security and privacy requests are listed below.

• Account: username, e-mail, password hash, language, account status, registration date and basic profile settings.
• Security data: IP address, user-agent, session data, CSRF tokens, rate-limit records, auth-state and technical logs.
• Payments and shop: orders, PayPal transaction identifiers, purchase history, coin balance, active digital items and claims.
• Connected accounts: Steam ID, Discord ID, Twitch, YouTube, Kick or Minecraft username if you connect them voluntarily.
• Community content: forum posts, comments, likes, avatars, public profile data, team roles and moderation actions.
• Technical data: server status, cache records, error logs, cookie settings and information needed for stable website operation.

• Contract performance or pre-contractual steps: account, login, shop, digital items and core service features.
• Legitimate interest: security, spam prevention, community protection, fraud prevention, logging and protection of the operator’s rights.
• Legal obligation: keeping data needed for accounting, tax, payment or other legal duties.
• Consent or voluntary action: connecting external accounts, optional profile data and optional remember sign-in function.

• Operating user accounts, login, password recovery, e-mail verification and profile management.
• Protecting the website and preventing spam, account abuse, fraud, chargebacks and unauthorized access.
• Processing orders, coin top-ups, activation of digital items, handling claims and payment support.
• Operating community features, forum, comments, servers, profiles, team roles and moderation.
• Connecting the account with game and community platforms so profiles, roles and related perks can work.
• Complying with legal obligations, protecting the operator’s rights and handling security incidents.

Some features are provided by external providers. We share data only to the extent necessary for the website, payments, security, account linking and community features to work.

• Hosting and technical website infrastructure — server operation, database, logs, cache and backups.
• PayPal — payment gateway, payment processing, fraud prevention and transaction identification.
• Discord — community connection, roles, invites, external links and possible perk synchronization.
• Steam — voluntary game account connection and public profile identifiers.
• Twitch, YouTube and Kick — streamer profiles, online status, public metadata and external links.
• Game servers and RCON/API integrations — perk delivery, server status and technical game service management.
• E-mail infrastructure — e-mail verification, password reset and important system messages.

Some external platforms may process data outside the EU/EEA under their own terms and data protection mechanisms. This especially applies to payment and community platforms opened from the website or connected to the account.

• Account and profile data is kept for the lifetime of the account and afterwards only as needed for security, legal claims or legal duties.
• Security logs, rate limits and technical records are kept only as long as necessary to protect the website and handle incidents.
• Payment and order data is kept as long as necessary for order handling, claims, accounting, taxes and fraud prevention.
• Public community content may remain available after account deactivation if needed to preserve discussion continuity; requests are reviewed individually.
• After a deletion request, we delete or anonymize data that is no longer needed or legally required for legal, security or accounting reasons.

Send personal data requests to the privacy contact. We may reasonably verify that the request belongs to your account.

• Right of access to personal data.
• Right to correction of inaccurate or outdated data.
• Right to deletion if the data is no longer needed or there is no reason to keep it.
• Right to restriction of processing.
• Right to data portability where it applies to the processing type.
• Right to object to processing based on legitimate interest.
• Right to withdraw consent or disconnect voluntarily connected external accounts.
• Right to lodge a complaint with a data protection supervisory authority.

You can request account deletion, data export or disconnection of external services via the contact e-mail. Some payment and security records may be kept for the necessary legal or security period.