Privacy Policy
Version 1.0 · effective 28 August 2026
1. Controller
“VEZOFT” EOOD, a private limited liability company incorporated in Bulgaria (EU), company No. (EIK) 202823109, with its registered seat in Kardzhali, Bulgaria. Privacy contact: legal@vezoft.com.
2. What we collect, and why
| Data | Purpose | Legal basis (GDPR) | Kept |
|---|---|---|---|
| GitHub account data on sign-in: GitHub ID, username, display name, avatar URL | Your account; showing who owns a listing | Contract, Art. 6(1)(b) | Until you close your account |
| Anonymous backing ID (random identifier in a cookie; no name, no email) | One back per person per fight — the game's integrity | Legitimate interest, Art. 6(1)(f) | Cookie 12 months; backs kept as pseudonymous game records |
| Listing content: product facts you declare (name, URL, team size, money raised, images, links) | Displaying your product in the arena | Contract, Art. 6(1)(b) | While listed; removed or dissociated on request |
| Tip receipts from Stripe webhooks: amount, product, Stripe transaction ID. Never card data. | Showing verified tip totals; fraud control | Legitimate interest, Art. 6(1)(f); legal obligation, Art. 6(1)(c) | As long as bookkeeping law requires |
| Big-dog applications: product name, category, contact email, declared figures, note | Assessing the application and answering you | Pre-contract steps, Art. 6(1)(b) | 24 months after the last contact |
| Server logs (IP address, user agent) at our host, Cloudflare | Security, abuse prevention, keeping the Service up | Legitimate interest, Art. 6(1)(f) | Short rolling window set by Cloudflare |
We run no analytics, no advertising, no tracking pixels, we do not profile you, make no automated decisions about you, and never sell personal data.
3. Cookies and local storage
| Name | What it does | Lifetime |
|---|---|---|
nw_session | Keeps you signed in (HttpOnly) | 30 days |
nw_anon | Random ID so a fight counts you once (HttpOnly) | 12 months |
nw_oauth_state | Protects the GitHub sign-in against forgery | Minutes, during sign-in |
nw_theme (localStorage) | Remembers light or dark mode on your device | Until you clear it |
All of these are strictly necessary for the functions you ask for, which is why there is no cookie banner: there is nothing optional to consent to.
4. Who else is involved
Processors and services we use: Cloudflare, Inc. (hosting and edge network; our database is stored in Cloudflare's Western Europe region), GitHub, Inc. (sign-in), and Stripe (payments). For tips, the founder you tip is the recipient of your payment and Stripe acts for that founder; Vezoft never sees your card details.
Content your browser fetches directly: some assets load from third-party hosts, which therefore see your IP address as with any web request — fonts from Google Fonts; product and giant logos from icon services (Google, DuckDuckGo) or the product's own site; and, only when you open a product's showcase that has a video, an embedded player from YouTube (privacy-enhanced youtube-nocookie.com) or Vimeo. No video loads before you open that showcase.
Where a provider processes data outside the EU/EEA (Cloudflare, GitHub, Stripe, Google are US companies), transfers rest on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
5. Your rights
You have the GDPR rights of access, rectification, erasure, restriction, portability and objection. Write to legal@vezoft.com — we answer within a month. Closing your account deletes your account data; listings are removed from the board, and duel history is kept only as pseudonymous game records. You may complain to a supervisory authority: ours is the Bulgarian Commission for Personal Data Protection (cpdp.bg), and you may always use the authority of your own country.
6. Security and breaches
Traffic is encrypted in transit; sessions use opaque, HttpOnly cookies; we hold no passwords and no card data at all. No system is perfectly secure — if we learn of a personal-data breach we notify the supervisory authority and, where required, affected people, under Articles 33 and 34 GDPR. Suspect something? legal@vezoft.com.
7. Children
The Service is not directed at children and requires users to be at least 16.
8. Changes
We update this policy when the facts change and publish the version and effective date at the top. The English text prevails over any translation.