Privacy Notice
1. Who we are
skatebattles ("we", "us") operates this website (skatebattles.github.io), a free, non-commercial community leaderboard for the video game skate.
This site is a fan project. It is not affiliated with, endorsed by, or connected to Electronic Arts Inc. All trademarks, game titles, and related assets are the property of their respective owners.
2. What we collect
We deliberately collect as little as possible. When you create an account, we store:
- Your username. This is the only identifier you give us. It is public: it appears on leaderboards and in run history.
- A hash of your password. Passwords are hashed by our authentication provider (Supabase). We never see or store your password in plain text.
- A hash of your recovery code. The one-time recovery code shown at signup is stored only as a cryptographic hash. We cannot read or retrieve the code itself.
- Your submissions. Scores, the leaderboard they belong to, timestamps, the video link you provide as proof of the run, and moderation status.
- Account metadata. Account creation time and your role on the site (user, admin, or superadmin).
We do not collect your email address. Accounts are username-only. Internally, our authentication system uses a synthetic identifier derived from your username; no real email address is requested, stored, or sent to.
We also do not collect your real name, date of birth, postal address, phone number, or payment details. The site is free and has no payments.
3. Technical data processed by our service providers
Like virtually every website, the services that run this site process some technical data (such as your IP address, browser type, and request logs) in order to deliver pages, prevent abuse, and keep the service secure. This happens at the infrastructure level with our providers:
- GitHub Pages (GitHub, Inc. / Microsoft) — hosts the website files and serves them to your browser. GitHub may log IP addresses of visitors for security purposes.
- Supabase (Supabase, Inc.) — provides our database, authentication, and server-side functions. Account and submission data described above is stored on Supabase infrastructure in the EU — Central EU (Frankfurt).
- Cloudflare Turnstile (Cloudflare, Inc.) — the CAPTCHA used at signup, login, and other sensitive actions. Turnstile processes technical signals from your browser to distinguish humans from bots.
- Google Fonts (Google LLC) — the site's fonts are loaded from Google's servers, which means your browser sends a request (including your IP address) to Google when the page loads.
We do not run analytics, advertising, tracking pixels, or fingerprinting of any kind, and we do not sell or share your data with anyone for marketing.
4. How we use your data
- To operate your account (sign-in, password recovery, account settings).
- To display the leaderboards: your username, scores, run dates, and the video links you submit are shown publicly.
- To moderate submissions (run approval, rejection, hiding) and keep the leaderboards fair.
- To prevent abuse (CAPTCHA verification, server-side permission checks).
Where the GDPR or similar laws apply, our legal bases are: performance of our agreement with you (running your account and the leaderboard you signed up for) and our legitimate interest in keeping a small community site secure and fair.
5. What is public
This is a public leaderboard. Anyone on the internet can see: your username, your approved (non-hidden) runs and scores, run dates, and the video links attached to your runs. Don't put anything in your username or video content that you wouldn't want to be public.
6. Cookies and local storage
We use no advertising or analytics cookies — which is why you don't see a cookie banner. The only thing stored in your browser is essential local storage used by our authentication provider to keep you signed in (your session token). It is strictly necessary for the sign-in feature to work, and it's created only when you sign in. Cloudflare Turnstile may also use strictly necessary technical storage to perform its bot check.
7. How long we keep data
Account data is kept for as long as your account exists. Submitted runs are retained to preserve leaderboard history, including runs that were rejected or hidden (hidden and rejected runs are not shown publicly). If you delete your account, the data described in the next section is permanently removed.
8. Account deletion
You can permanently delete your account yourself at any time from the account menu (cog icon → "Delete account"). Deletion requires your password and your recovery code, and it is irreversible. When you delete your account, we permanently remove:
- all runs you own (including their scores and stored video links),
- your player entry and your leaderboard placements,
- your profile, your recovery code hash, and your authentication account (including the password hash).
Two things are handled specially, and we want to be upfront about them:
- Runs you submitted on behalf of other players (admin submissions) belong to those players and are kept — but your identity is scrubbed from them: the record of who submitted them is permanently cleared.
- Videos are never hosted by us. Runs store only a link to a video hosted elsewhere (for example YouTube or Discord). Deleting your account (or deleting a run) removes the link from our database — it does not and cannot delete the video itself from the third-party platform. If you want the video gone, you must delete it on the platform where it is hosted (e.g. your YouTube channel or Discord server).
If you can no longer sign in (for example you lost both your password and your recovery code) and want your data erased, contact us and we will verify and handle your request manually.
9. Your rights
Depending on where you live (for example under the GDPR or UK GDPR), you may have the right to access the data we hold about you, correct it, delete it, restrict or object to its processing, receive a copy of it, and lodge a complaint with your local data protection authority. Most of this you can do yourself: your data is visible on the site, and deletion is self-service (section 8). For anything else, contact us.
10. Age requirement
You must be at least 16 years old to create an account. This service is not directed at children under 16, and we do not knowingly collect data from them. If you believe someone under 16 has created an account, contact us and we will delete it.
11. Security
Passwords and recovery codes are stored only as cryptographic hashes. All traffic to the site and to our backend is encrypted (HTTPS). Permission checks (who can edit, hide, or delete what) are enforced on the server, not just in your browser. No system is perfectly secure, but we collect so little that there is very little to lose.
12. Changes to this notice
If we change this notice, we will update the "Last updated" date at the top. Material changes (for example, collecting a new category of data) will be highlighted on the site.
13. Contact
skatebattles.privacy@gmail.com