Privacy Policy

What we collect#

• Account identity. Your Clerk user id, email, and (if you signed in with Google) your Google account name and avatar. We do not see your Google password.
• Replay data and original files. Each .SC2Replay file in a replay folder you add is read by the SC2 Tools agent on your PC. The agent uploads structured data such as map, matchup, build orders, APM, MMR, opponent identity, and the original replay file. Originals are kept in a private cloud archive so you can download your own replays from the dashboard.
• Connected streaming accounts. If you connect YouTube, Twitch, or Kick, we receive the provider account or channel ID, displayed name, approved permissions, and authorization tokens. Enabled features read notification events and stream metadata. If you separately connect stream controls, we process the titles, descriptions, broadcast settings, and stream identifiers needed for the controls you use.
• Instant Analysis (in your browser). Instant Analysis reads the replays or replay folder you choose and parses them on your device, inside your browser. The analyzer is served from our own site, not a third-party service. On the /try page your report is built and kept in your browser, and nothing is uploaded unless you choose to save the games to an account. When you save or import games while signed in, or Folder Sync uploads new games, we receive the same parsed game data the agent sends. When our replay archive is enabled, a signed-in import also uploads the original replay files to it, like the agent does; the import shows this as a checkbox, checked by default, that you can clear before you start. Folder Sync never uploads original files. If you opted in to usage analytics, Instant Analysis reports only counts, timings, error types, and how files were added (for example, drag and drop), never file names, player names, or replay contents.
• Personal builds and notes. Anything you type into the build editor.
• Device fingerprints. When you pair an agent we store a hashed device token, the agent version, and the OS string.
• Account setup and support. Signed-in installer hand-offs, pairing, saved game counts and an observed visit during the second week after signup help us diagnose setup problems. These first-party account milestones are separate from optional Google Analytics. Administrator actions are retained for up to 400 days with allowlisted result counters; account deletion anonymizes their account identifiers. Background-job history contains no user identifiers and is capped at 5,000 records.
• Operational telemetry. Standard request logs (IP, user-agent, timestamp), retained for 30 days for security and debugging. If Sentry crash reporting is enabled (opt-in via settings), unhandled exceptions are forwarded to Sentry with PII scrubbed.
• Live community counts. To show how many visitors are currently active, the site sends a brief presence check while you are using a visible page. A short-lived first-party cookie groups visits from the same browser; signed-in accounts are counted once across devices using a keyed hash of the account ID. Presence records contain hashed identifiers and activity timestamps, with no page history, email, or location. Records stop counting after three minutes and are automatically removed shortly afterward. Only aggregate counts are public. Agent activity comes from recent check-ins, and download counts come from recorded installer requests.
• Usage analytics (opt-in). Only if you click "Accept" on the cookie banner, we load Google Analytics 4 to understand which pages and features get used. It records pseudonymous data such as pages viewed, approximate location (country/region, from a truncated IP), device type, and referring site. We enable IP anonymization and disable advertising signals. Google Analytics does not load until you opt in, and you can withdraw consent at any time by clicking "Reject" on the banner (clear the banner choice in your browser storage to see it again).

What we do NOT collect#

• Unrelated files on your computer.
• Voice or video.
• Payment information (we don't take payments).

Where the data lives#

Structured replay data lives in MongoDB Atlas. Original replay files and larger replay-detail payloads live in a private Cloudflare R2 bucket. Render hosts the API, and Vercel hosts the website. Data is sent over TLS; access to replay downloads requires your signed-in account and a short-lived private download link.

Replay files remain stored until you delete the matching history or your account. Temporary download links expire after a short period and do not make the bucket public. Incomplete temporary uploads are not exposed in your library and are covered by a one-day automatic expiration rule.

Backups#

Current database backup retention window is unavailable. Copies expire under the configured backup schedule. Contact support for the current window.

• Service database backups. MongoDB Atlas keeps whole-database snapshots under our configured backup schedule. They are encrypted and used to recover the service after failures. They are not a way to restore one account on request.
• Snapshots you take. A snapshot you take in Settings → Backups & data is a copy of your own account data, stored in private Cloudflare R2 storage. We retain up to 5 manual snapshots, 2 weekly automatic snapshots, and 3 snapshots taken before destructive data actions. Older copies in each category expire as new ones are taken. All private snapshots are removed when you delete your account. Snapshots do not contain original replay files or replay-detail payloads.
• Your export. The JSON export is the copy you keep yourself. We do not keep a copy of the file you download.

Original replay files and replay-detail payloads in Cloudflare R2 are not part of the database backups. When you delete data or your account, it is removed from the live database and from R2 straight away. Copies already inside database backups are not edited; they are deleted when those backups expire.

Connected accounts and stream controls#

Account connections are optional. Notification connections keep their existing permissions; stream controls require separate approval. YouTube stream controls read your channel and reusable stream names and IDs, prepare horizontal and vertical broadcasts, bind them to your selected streams, and update their titles, descriptions, and settings. Twitch and Kick controls update and verify stream titles. The YouTube permission has a broad provider description, but these controls do not delete your videos or past broadcasts.

For the normal SC2Tools account connection, access and refresh tokens are encrypted in the server's account vault in MongoDB Atlas. The desktop agent uses its paired SC2Tools account to request controls; these provider tokens and the server's application secrets are not sent to the agent or OBS. We do not receive your provider password or livestream audio or video through these controls. OBS passwords and stream keys remain in OBS or your local configuration. The advanced local OAuth setup uses your own application credentials instead; credentials saved by that Windows agent are protected with Windows per-user encryption and remain on your computer.

To avoid creating duplicate YouTube broadcasts after a timeout or restart, we store creation request IDs, requested titles, descriptions and settings, channel and broadcast identifiers, selected stream IDs, operation outcomes, and quota records. Daily quota counters expire automatically. Creation and request-ID records remain until you delete your SC2Tools account and its data; they are not included in account export or restore because restoring them could repeat an operation.

Disconnecting an account in Settings removes its saved server authorization and stops future controls through that connection. We also attempt to revoke authorization with the provider; if that provider is unavailable, you can remove access in its account settings. Disconnecting keeps the creation records described above and does not delete or undo anything already published on YouTube, Twitch, or Kick. Local credentials from the advanced setup must be removed from that agent separately. Deleting your SC2Tools account through Settings → Backups & data removes its server connections and creation records. Deleting only replay history does not remove them.

Data stored in your browser#

Instant Analysis keeps some data in your browser's IndexedDB storage on your device. We cannot read it, and it is sent to us only when you save your /try games to an account:

• Games analyzed on /try. The parsed game data (at most the 100 most recently analyzed games), so you can come back to your report or save the games after signing up. Each game expires 7 days after it was analyzed and is deleted the next time you open /try in that browser. Saving the games to your account also deletes them from the browser.
• Folder Sync ledger. If you use Folder Sync or import a whole folder, a list of the replay files it has handled: each file's path within the folder you picked, its size and modified date, whether it was uploaded, skipped, or failed, and the game it matched. For a replay where it couldn't tell which player is you, it also keeps the players' StarCraft II account IDs, so the file is checked again once your profile knows one of them. Later scans and imports use it to skip files that are already done.
• Folder permission. The browser's read-only handle to the folder you picked for Folder Sync, the time of the last scan, which account set it up and, once the daily browser upload limit is reached, when it may sync again. Folder Sync only ever syncs into that account: if someone else signs in on the same browser, nothing is synced until they choose to use the folder for their own account, which first forgets the previous account's ledger. Your browser may ask you to allow access again on a later visit.

To remove this data, use Clear local data on the /try page (for the analyzed games), or on the Folder Sync card Stop syncing (Chrome and Edge) or Forget import history (other browsers) for the folder permission and the ledger, or clear this site's data in your browser settings to remove all of it. This does not delete games you already saved to your account. To delete those, use Settings → Backups & data.

If you choose Load my history or Keep on this device in Daily Pulse, this browser also keeps a copy of your game history in its IndexedDB storage, so Daily Pulse, Season Recap and Arcade can show it first on your next visit before checking your account for changes. It is kept only for accounts with up to 20,000 games, as one row per game: the date, result, map and length; your race, MMR, build, macro score and Battle.net character ID; and each opponent's name, race, MMR, strategy, Battle.net character ID and SC2Pulse IDs. It is a copy of games already in your account, and it is not sent back to us.

It is removed when you sign out or another account signs in on this browser, and when you choose Clear under Games on this device in Settings → Backups & data. Deleting your game history or restoring a snapshot removes it in the browser where you do it; other browsers replace theirs the next time they load your history, or remove it when they sign out. Deleting your account removes it from each browser once that browser sees you are signed out.

Sharing#

We do not sell or rent your data. Services that operate SC2 Tools process it as described above (Clerk for auth, MongoDB Atlas for database hosting, Cloudflare R2 for private replay-file storage, Render for API hosting, Vercel for the website, Sentry for opt-in crash reporting, and Google Analytics for opt-in usage analytics). If you connect stream controls, we also send the metadata and control requests you choose to the connected provider. Stream titles, descriptions, and broadcasts may appear on that service according to the visibility and streaming settings you choose.

Community publishing#

Publishing a build is optional and user-controlled. Community builds show your profile or chosen community name by default; you can explicitly choose Post anonymously for an individual build. We publish its title, description, build metadata, and signature, but not source replays, opponent identities, or personal notes. You can remove the listing from Community at any time.

Aggregated opponent data#

Public aggregated opponent statistics are a separate feature. We strip contributor names and apply k-anonymity: we never publish an aggregate row that fewer than 5 unique users have contributed to. Pulse IDs are public information from Blizzard's ladder.

Your rights#

You can export your structured account data as JSON, download original replay files from replay history, or delete your replay history or account from Settings → Backups & data. The deletion dialog shows a live inventory before you confirm.

• Account deletion removes your profile, preferences, games and analysis, original replay and playback files, notes, custom and published builds, devices, overlay links, Stream Studio and viewer records, sounds, connected streaming credentials, notifications, private snapshots and coaching relationships.
• Your review requests and their threads are deleted. Comments you wrote on other people's requests remain with the author shown as [deleted user]. Service activity records lose their account identifiers; private support message text and replies are removed.
• We delete your sign-in identity after the live data purge. Provider failures leave a minimal retry record until deletion succeeds. Completed deletion keeps only a keyed guard for 30 days to reject old sessions and late identity events.

Current database backup retention window is unavailable. Copies expire under the configured backup schedule. Contact support for the current window.

Copies already inside database backups are not edited individually. To ask about access, correction or deletion rights, contact us at github.com/ReSpOnSeSC2/sc2tools/issues.

Cookies#

You can change your choice any time from Cookie settings here or in the site footer.

The site uses cookies for session login (Clerk), CSRF protection, and a short-lived first-party presence token for the public users online count. The presence cookie expires after three minutes without an activity check. Your banner choice is stored in your browser's local storage, not a cookie.

If — and only if — you opt in via the banner, Google Analytics sets its own first-party analytics cookies (e.g. _ga) to measure usage. These are never set before you accept, and we do NOT use advertising or cross-site tracking cookies.

Children#

SC2 Tools is not directed at children under 13. If you believe a child has signed up, open a ticket at github.com/ReSpOnSeSC2/sc2tools/issues and we will delete the account.

Changes to this policy#

When we make material changes, we update the "last updated" date and provide additional notice when required by applicable law or when a change materially affects how we use personal data.

Contact#

github.com/ReSpOnSeSC2/sc2tools/issues