Privacy Policy

1. What we collect

Your account. Username, email address and a hash of your password (never the password itself). If you sign in with Discord, your Discord id, Discord username and the email Discord gives us. We send that address one confirmation link when you sign up (none if Discord already confirmed it), and nothing else unless this policy says so.

Billing. Your Stripe customer id, subscription ids, plan status and renewal dates, and a ledger of every payment. Your card details go straight to Stripe; we never receive the number.

MW2 online. The player name and callsign you choose, which other players see; the public key of each game install you link, when you linked it, and the time of each pass request a linked install makes (about once an hour while the game runs). The game client also sends anonymous reports to us: the build, operating system, CPU and GPU model, window size, controller name, which map, mode and role it was on, how long matches lasted and why they ended, errors, warnings, crashes and the log lines before them, and per-minute performance numbers. Reports carry the player name the game shows for you (the one you typed in the game, or your account's), so reports made under the same name can be read together; apart from that name, each run uses a random session id and a fresh network key. Before anything is sent, the client removes home folder paths, the games folder, your operating-system user name and IPv4 addresses. The collector sees no IP address. Turn it off with send_reports=false in the game's settings.cfg. If you sponsor a server, the name, description and banner image you set, which every player can see, and which server you sponsor.

Technical. Our web server and the game services keep short-lived operational logs that can include your IP address, the pages or endpoints you request, and errors. They are used only to keep things running and to investigate abuse.

Cookies. Only the cookies the site needs: your login session, a short-lived cookie that carries a game's link request across sign-in or payment, and a short-lived cookie during Discord sign-in. No tracking or advertising cookies.

2. What we use it for

• Running the services: your account, your subscriptions and passes.
• Billing and receipts, and keeping the financial records the law requires.
• Support, and telling you about billing and changes to the terms.
• Security, preventing abuse and enforcing the terms.
• Finding and fixing bugs in the game client and the servers.

We don't use your data for advertising, don't profile you and don't sell or rent it.

3. Who else sees it

• Stripe processes payments and holds your card. Stripe's own privacy policy applies to what you give it on its checkout page.
• Amazon Web Services hosts the site and the database (us-east-2, in the United States).
• Cloudflare serves the site's DNS.
• Discord, if you choose to sign in with it.
• The game's multiplayer traffic is encrypted end to end and carried by relay servers run by n0 (the iroh network) when "Hide my IP" is on, so other players see a relay's address, not yours. The relays see your IP address as any carrier does.
• The MW2 online servers, the game's update service and the telemetry collector run on hardware we operate.
• We disclose data when the law requires it, or to protect the services or other players from abuse.

Other players see what the games show them: your username or callsign, what you say in voice and text chat, and the name and card of any room you host.

4. How long we keep it

• Account and game-link data: while your account exists. When you close it, or ask us to delete it, we delete this within 30 days.
• The credit and payment ledger: as long as tax and accounting law requires, usually seven years, with the account id but no other personal details once the account is gone.
• Operational logs: a short time, usually under 30 days.
• Anonymous game reports: while they are useful for fixing the game. They contain nothing that identifies you.

5. Your rights

Email brian@startingsoftware.com from your account's address and we will show you the data we hold about you, correct it, give you a copy, or delete it. We answer within 30 days. If you live in the European Union, the United Kingdom, California or another place with a privacy law, you have these rights by law, plus the right to complain to your data-protection authority. We never sell personal information, and we do not share it for cross-context behavioural advertising.

6. Security

Passwords are hashed, every connection to the site and between the game and its servers is encrypted, and card numbers never touch our systems. Game servers hold no long-lived cloud credentials. No system is perfectly secure; if a breach affects your data, we tell you as the law requires.

7. Children

The services are not for children under 13, and we do not knowingly collect their data. If you think a child has given us data, email us and we will delete it.

8. Where the data lives

In the United States. If you use the services from elsewhere, your data is transferred there and protected as this policy describes.

9. Changes and contact

We may update this policy; the date at the top says when, and we email account holders about changes that matter. Questions: brian@startingsoftware.com.