sov.ggReport content

Privacy Policy

Last updated 1 November 2026

1. Who we are

sov.gg ("we", "us") decides how and why the personal data described here is used, which makes us its controller under the EU General Data Protection Regulation (GDPR). For anything about your privacy, write to support@sov.gg.

2. What this policy covers

It covers sov.gg: the home page, profile pages (such as sov.gg/yourname), the dashboard and editor, and the emails we send. A profile shows what its owner put on it. The owner is responsible for what they publish, about themselves and about anyone else (see our Terms). If a profile shows information about you that you want removed, report it.

3. What we collect, and why

When you visit any page

  • Server logs. Like every website, our servers record each request: your IP address, the page, the time, your browser and device type, and the page that linked to us. We use them to deliver pages, fix faults and fend off attacks. They're deleted after 14 days. Legal basis: our legitimate interest in a working, secure service (Art. 6(1)(f) GDPR).
  • Visit statistics. When a page opens, your browser tells our server which page it is and, on the first page of a visit, which site sent you there (only that site's name, such as google.com). Our server adds broad facts it can see: your type of device, browser and operating system, and, when the site runs behind Cloudflare, your country. To count visitors without following them, it makes a one-way code from your IP address and browser with a secret that changes every day and is then deleted; your IP address itself isn't stored. So we can tell how many people visited on a day, but nobody, including us, can recognise you on another day or link a visit to you. If your browser sends a Do Not Track or Global Privacy Control signal, your visits aren't counted. A profile's owner sees these statistics for their own page; staff see them for the whole site. Legal basis: our legitimate interest in knowing how sov.gg is used, so we can run and improve it (Art. 6(1)(f)).
  • Rate limits. To stop abuse, some features (post embeds, the report form, signing in) count requests per IP address in memory for about a minute. These counts aren't stored.

When you view a profile

  • The view counter. A profile counts each visitor once a day. Before a view counts, Cloudflare Turnstile checks in your browser that you're a person and not a bot (see section 5). Our counter then uses the same daily code (see Visit statistics) to count you once per profile per day, and your network's address to cap views from one network. It keeps that record until the end of the day (UTC) at most; after that, only the profile's daily and total counts remain. Counts are public: they show on profiles and on the leaderboard. Legal basis: our legitimate interest, and the profile owner's, in view counts that mean something (Art. 6(1)(f)).
  • Link clicks. When you open a link on a profile, your browser tells our server the link's address, so the profile's owner can see how often each link is opened. Only the link and the day are kept, as a count: no code, IP address or browser details, and nothing that could say who clicked. Robots are not counted, nor are visits with a Do Not Track or Global Privacy Control signal. Legal basis: our legitimate interest, and the profile owner's, in knowing which links are used (Art. 6(1)(f)).
  • Posts from X. When a profile shows a post from X (formerly Twitter), our server fetches the post's public text and images from X and passes them on. Your browser doesn't contact X, and X doesn't learn that you viewed the profile, unless you follow a link to X.
  • Music players from Spotify, Apple Music and SoundCloud. A profile can show one of these services' own players. Until you press its "Load … player" button you only see a placeholder from our servers: your browser doesn't contact the service, and it learns nothing about your visit. When you press it, your browser loads the player from that service (open.spotify.com, embed.music.apple.com or w.soundcloud.com). The service then receives your IP address and browser details, is told the request comes from sov.gg (but not from which profile), and may set its own cookies, all under its own privacy policy (see section 5). We get nothing back from the player. Legal basis: your consent, which you give by pressing the button (Art. 6(1)(a)). It covers only that player on that visit: the next visit shows the button again.
  • Music, video and images on profiles, and the fonts on every page, otherwise come from our own servers, including the music in a profile's own player.

When you have an account

  • Account details: your username, email address, password (stored only as a salted hash, by our sign-in service), and sign-in settings such as two-factor authentication. If you sign in with Discord or link it, Discord gives us your Discord user ID, username, avatar and avatar decoration. We never see your Discord password or messages.
  • Discord presence, only if you turn it on: if you add the Discord presence widget to your page, tick the box that agrees to it, and are in the sov.gg Discord server, our own Discord bot reads, in that server only, whether you're online, idle, on do not disturb or offline, your custom status (its text and emoji), your Discord avatar and avatar decoration, display name, server tag and Discord profile badges. Your page shows your status and avatar, and the other parts you pick, to everyone who opens it, live. The bot keeps only the latest state, in memory, only for accounts that turned this on, and forgets it when you turn it off. It never reads your messages, and your music and other activity are neither kept nor shown (the game you are playing is covered by the next item). For the editor's "join our server" prompt we ask Discord whether you're in the server, and don't keep the answer. Legal basis: your consent, which you give by ticking the box in the widget and withdraw by unticking it or removing the widget (Art. 6(1)(a)).
  • The game you are playing on Discord, only if you switch it on separately: if you also switch on "The game I'm playing" in the Discord presence widget, our bot keeps the name of the game Discord says you are playing right now (nothing else about it: no details, time, or party), in memory like the rest, and your page shows it to everyone who opens it. We never keep or show music, streaming or any other activity. Legal basis: your consent, given by switching it on and withdrawn by switching it off (Art. 6(1)(a)).
  • Roblox account and Steam profile widgets, only if you add one: if you add a Roblox account or Steam profile widget to your page and enter your own account ID or profile address, our server asks Roblox or Steam for the public details of that account: your display name and username, your avatar, and only what your switches on the widget show (for Roblox: about text, join date, Premium, linked profiles; for Steam: online status and the game you are playing, level, member-since year, recently played games). Your page shows them to everyone who opens it. Our server keeps what it received in memory for a short time (a few minutes for Steam status, up to 15 minutes for a Roblox profile, up to six hours for avatars; if the service is unreachable, the last copy we have may be shown for up to 30 minutes for Steam, six hours for a Roblox profile and three days for avatars) and not in our database. Private data is not shown: a private Steam profile shows only its name, avatar and a note that it is private. We contact these services only because you added the widget; we have no other dealings with them and never contact them for visitors. Removing the widget stops the requests. Legal basis: your consent, which you give by adding the widget and withdraw by removing it (Art. 6(1)(a)).
  • Numbers on your page, only if you switch them on: the "Numbers" setting can show how long you have been a member (the year you made your sov.gg account, or a year you choose; never the date) and a total of your followers across platforms, with a list by platform. The accounts, names and numbers you type for it are part of your profile and are public like the rest of it. For GitHub and Bluesky you can let our server read the number instead: it then asks GitHub's public API or Bluesky's public service for the follower count of the name you entered, and nothing else about the account. It keeps the answer in memory for up to a day (and not in our database), and never contacts these services for visitors. A number read this way is marked with a tick on your page; a number you typed has none, so visitors can tell them apart. Removing the setting stops the requests. Legal basis: your consent, which you give by switching it on and withdraw by switching it off (Art. 6(1)(a)).
  • Voice notes, only if you add one: if you record or upload a voice note for the Voice note widget, we store the recording on our own servers with its length, its size, the small waveform picture your browser drew from it, and when you made it. Before it is stored our server checks the file and removes the tags some apps write into sound files (a title, an artist, a place name). It then re-encodes the recording into a standard compact format (mono Opus, in a WebM file) and deletes the file you sent, so only the re-encoded copy is kept. The microphone is used only while you press Record, and only in your browser: nothing is sent until you choose to keep the recording. Anyone who opens your page can play your voice notes; don't record other people without their permission. If a voice note is reported, staff listen to it and may hide it or take it down; a taken-down note's file is deleted and a short record of the decision is kept. You can delete a voice note at any time in the editor, and all of them are deleted with your account; they are included in "Download my data". Legal basis: performing our contract with you, by showing on your page what you put on it (Art. 6(1)(b)); for reviewing reported notes, our obligations under the EU Digital Services Act (Art. 6(1)(c)).
  • Your profile: everything you add in the editor: display name, description, links, images, audio, video, colours and settings. Your profile is public: anyone can see it at its address, it may appear in link previews when it's shared, and search engines may index it.
  • Premium: whether your account has Premium, since when, and how it came (a purchase, a gift, a code or our staff), including the code that unlocked it.
  • Orders: when you buy something, we keep the order: its number, what was bought, which account it was for (a gift's recipient too), the price, the payment service that handled it, that service's reference and the payment's status, the dates, and that you confirmed you're 18 or older and accepted the Terms of Sale, with the version and the time. A gift code you bought is kept so you can see it on your order. We never see or keep your wallet's keys or your card details. Legal basis: our contract with you (Art. 6(1)(b)), and our legal duty to keep sales records (Art. 6(1)(c)).
  • Acceptance records: each time you approve our Terms of Service, Privacy Policy or Terms of Sale, we keep which one, which version, when, and whether it was at sign-up or when asked again, as proof that you agreed. Legal basis: our legitimate interest in being able to show what you agreed to (Art. 6(1)(f)).
  • Badges and how you got them: when a badge is given to your account or taken away, we keep a log of it: which badge, when, how it came (our staff, a rule, a code or a purchase), which staff member did it, and, for a rule, the conditions it checked. It lets us explain and fix mistakes in awards. It goes when your account is deleted.
  • Security records: when you sign in, from which IP address and browser, and changes to your sign-in details, so we can spot and stop account takeovers. Kept for 90 days.
  • Invites: while sign-up needs an invite code, we keep each code only as a keyed hash (plus its last four characters), who made it (you, if you made it, or sov.gg staff), when, and who used it and when. An account keeps the link to whoever invited it. If you invite someone, they see your username as the person who invited them, and you see the username of whoever used your code. These records keep the usernames as they were, so they can still say who invited whom after an account is deleted (see "How long we keep data"). We use them to stop abuse of invites and to show people who invited them.
  • Emails: we only email you about your account: confirming your address, resetting your password, security alerts and important changes to our terms. No marketing unless you ask for it.

Legal basis: our contract with you (Art. 6(1)(b)); for security records, our legitimate interest in protecting your account and our service (Art. 6(1)(f)).

When you report content or contact us

  • Reports. When you report content, we keep your report and, if you give them, your name and email address, so we can deal with it, tell you the outcome and keep a record of how we handled it. Reports are kept for 12 months after they're closed.
  • Emails to legal@sov.gg are read automatically. If one links to a profile on sov.gg, we record it as a report: the sender's address and name, the subject, the text and the profiles it names. The profile is hidden until a person reviews the report (see section 4), and the sender gets a confirmation. Other emails there are only read by staff. Legal basis: our obligations under the EU Digital Services Act (Art. 6(1)(c)), and our legitimate interest in keeping sov.gg safe (Art. 6(1)(f)).
  • Emails to us are kept as long as we need them to answer you and follow up.

4. What we don't do

  • We don't show ads, and we don't sell, rent or trade personal data.
  • We don't use analytics scripts, tracking pixels or advertising cookies.
  • We don't make decisions about you by purely automated means that have legal or similarly significant effects. Where automated checks flag spam or harmful links, a person makes or reviews the decision. The one automatic step: a profile linked in an email to legal@sov.gg is hidden until a person has reviewed the report. That's temporary, and a person decides what happens next.

5. Who else handles data

  • Our hosting provider runs the servers sov.gg is on, and stores data for us under a data processing agreement.
  • Cloudflare, Inc. (USA) runs Turnstile, the check before a profile view counts. It processes your IP address and technical details from your browser to tell people from bots, under Cloudflare's privacy policy. Transfers to the USA rely on the EU–US Data Privacy Framework, under which Cloudflare is certified, and on standard contractual clauses.
  • Discord Inc. (USA), only if you choose to sign in with Discord or link it. Your Discord account is covered by Discord's privacy policy. If you switch on "Use Discord avatar" or "Discord avatar decoration" for your page, visitors' browsers load those pictures straight from Discord's servers (cdn.discordapp.com), so Discord can see that visitor's IP address and browser details, and the picture's address contains your Discord user ID. Both are off unless you turn them on. Discord presence (above) is read by our own bot in the sov.gg Discord server; its pictures are fetched from Discord by our server and served from sov.gg, so visitors' browsers don't contact Discord for them and your Discord user ID isn't in them.
  • X Corp. receives requests from our server for public posts that profiles show. We send X nothing about you.
  • Roblox Corporation and Valve Corporation (Steam), only if a member adds their widget to a profile. Our server asks them for that member's public account details (see section 3); we send them no information about visitors, and visitors' browsers never contact them: avatars are fetched by our server and served from sov.gg. Their own privacy policies cover your account with them (Roblox, Steam).
  • GitHub, Inc. (USA) and Bluesky PBC (USA), only if a member lets the Numbers setting read their follower count from them. Our server asks GitHub's public API or Bluesky's public service for that member's count; we send them no information about visitors, and visitors' browsers never contact them. Their own privacy policies cover your account with them (GitHub, Bluesky).
  • Spotify, Apple and SoundCloud, only if you press the button that loads one of their players on a profile. From then on that service handles your use of its player under its own privacy policy (Spotify, Apple, SoundCloud), including your IP address and any cookies it sets. Nothing loads from them before you press it, and we send them nothing about you.
  • Payment services, only if you buy something. They run the checkout page you pay on and handle the payment under their own terms and privacy policies, which you accept at checkout. Today that is NOWPayments (cryptocurrency) and Polar, as merchant of record for card and wallet payments. We send them the order number, the price and where to send you back afterwards; they tell us whether the payment went through. For a card or wallet checkout we also send Polar your IP address, only so it can choose your local currency; we send it no name or email address. A card payment is handled by the service, not by us, so we never see your card details. A payment on a blockchain is public on that blockchain.
  • Email is sent from our own mail server.
  • Authorities, when the law requires it, for example under a court order, or to report child sexual abuse material or an imminent threat to someone's life.

We don't share personal data with anyone else.

6. Cookies and similar storage

Public pages, including every profile, set no cookies. Cloudflare's Turnstile check runs a script from Cloudflare when a view is about to be counted, and may keep technical data in your browser that the check needs. A Spotify, Apple Music or SoundCloud player that you choose to load on a profile is that service's own page inside ours, and may set the service's cookies; none of it loads until you press its button.

When signed in, you get one cookie that keeps you signed in. It's strictly necessary for the service you asked for, so it needs no consent and there's no cookie banner. Staff have a similar cookie for the admin console.

7. How long we keep data

  • Server logs: 14 days.
  • View counter visitor records: until the end of the day (UTC), at most 24 hours.
  • Visit statistics: about 13 months (400 days), with no IP addresses; the daily secret behind the visitor codes is deleted when its day ends.
  • Account and profile data: until you delete your account. It's then removed within 30 days, and from backups as they expire, within a further 35 days.
  • Invite records: these outlast the account they mention. When an account is deleted, its link to the account is removed, but the invite record keeps the usernames as they were (who made a code, who used it) and the dates, so the history of who invited whom stays intact and invite abuse can still be traced. Nothing else about the person is kept in them. The records are kept as long as invite-only sign-up is in use, and for a further 12 months after it ends.
  • Security records: 90 days.
  • Reports, including those made by email: 12 months after they're closed.
  • Orders: an order is kept for as long as the law requires us to keep sales records, and only for that purpose. If you delete your account, the order stays but is no longer linked to you.
  • Acceptance records and the badge log: until you delete your account, and then removed with it.
  • Other records the law makes us keep: for the period that law requires, and only for that purpose.

8. Your rights

Under the GDPR you can ask us to:

  • tell you what personal data we hold about you, and give you a copy;
  • correct anything that's wrong;
  • delete your data;
  • limit how we use it;
  • give you the data you provided in a portable format;
  • stop using it where we rely on our legitimate interests (you can object at any time);
  • and, where you gave consent, you can withdraw it.

Write to support@sov.gg. We answer within one month, and may first need to confirm it's really you. You can also complain to the data protection authority where you live or work.

9. Children

sov.gg isn't for children under 13. If you're under the age at which you can agree to the use of your data yourself in your country (between 13 and 16 across the EU), you need a parent's or guardian's permission to have an account. If we learn that a child under 13 has an account, we delete it. Profiles may contain links, marked 18+, to adult websites run by others. Those sites have their own age checks and privacy policies, and we don't see what you do there.

10. Security

Connections to sov.gg are encrypted, passwords are stored only as salted hashes, stored secrets are encrypted, and staff sign in with two-factor authentication and every staff action is logged. No system is perfectly secure. If a breach puts you at risk, we tell you, and the authorities, as the law requires.

11. Changes to this policy

When we change this policy, we update it here and change the date at the top. Before a significant change takes effect, we tell account holders by email or in the dashboard.

12. Contact

Privacy questions and requests: support@sov.gg. Legal matters: legal@sov.gg.