Draft for legal review. Not yet in effect. Text in [brackets] still needs to be filled in.
Privacy policy
Last updated 23 October 2026
This explains what data NoBoost handles, why, and what you can do about it. To hide or erase a player, use the privacy request form.
1. Who we are
NoBoost is run by [OPERATOR NAME, OR COMPANY NAME AND REGISTRATION NUMBER], [POSTAL ADDRESS] ("we", "us"). We decide how and why the data described here is used, which makes us its controller.
Questions, requests and complaints: [CONTACT EMAIL]. You can also use the privacy request form, which needs no account.
2. The short version
- Replays contain the in-game names, platform IDs and gameplay of everyone in the match, so we hold data about players who have never used this site. Anyone can ask us to hide or erase theirs, with or without an account.
- We don't sell data, show adverts or use tracking or analytics cookies.
- You can upload without an account. We then keep your birth year, a one-way hash of your network address and your upload history.
- Accounts hold your Steam or Epic account ID and birth year. You can delete your account at any time.
- Data is stored in the EU (Frankfurt) with the providers listed in section 6.
3. What we collect, why, and our legal basis
Where the GDPR (or a similar law, such as South Africa's POPIA [CONFIRM WHICH LAWS APPLY]) applies, each use of data needs a legal basis. They're listed below.
| Players in uploaded replays (including people without an account) | In-game name, platform (Steam, Epic, PlayStation, Xbox, Switch) and platform ID, team, and gameplay: positions, touches, boost, goals and other events. From these we calculate stats, ratings, expected goals (xG) and session patterns. Why: to provide match pages, profiles and rank benchmarks. Basis: our legitimate interest, and that of the players who use the site, in analysing matches they played. We've weighed this against your interests [LINK TO BALANCING TEST / DPIA]: we show names only where the game itself shows them to everyone in the match, honour Streamer Mode, show no profile page until a player claims one, and let anyone hide or erase their data. |
|---|---|
| Accounts | Your Steam ID or Epic account ID (from sign-in, never your password), birth year, profile visibility, ranks you report, console claims and API keys (stored only as a one-way hash). Why: to run your account, link you to your matches and apply the age rules. Basis: performing our agreement with you (the terms of use). |
| Guest uploads (no account) | Birth year, a keyed one-way hash of your network address (the first 64 bits for IPv6) and your upload history. Why: the age check, and per-network upload limits that stop abuse. Basis: legitimate interest in preventing abuse; our agreement with you for the uploads. |
| Uploads | The replay file, its file name and checksum, and when you uploaded it. If you import from ballchasing.com, your Ballchasing API token, which we encrypt and delete when the import finishes or after 72 hours at most. Why: to process your replays and avoid duplicates. Basis: our agreement with you. |
| Privacy requests | Your email address and message, if you send a request without signing in. Why: to verify and answer it. Basis: legal obligation. |
| Technical data | Your IP address, used briefly for rate limiting (counters expire within a day) and kept in our hosting providers' request logs for about 30 days. Why: security and keeping the service running. Basis: legitimate interest. |
| Error reports | When something breaks, technical details of the error are sent to Sentry. We've turned off sending IP addresses, cookies and request contents. Basis: legitimate interest in fixing faults. |
| Bot check | When enabled, Cloudflare Turnstile checks that a guest session isn't automated. Cloudflare processes technical signals from your browser for this. Basis: legitimate interest in preventing abuse. |
4. What is public
- Match pages are public: everyone in a match appears with their in-game name and stats, as they would in the game's own scoreboard. Players who ask to be hidden appear as "Hidden player". Players who used Streamer Mode in the game appear anonymously.
- Profile pages exist only for claimed players. You choose public or private. Accounts under 18 are always private.
- Link previews (the image shown when a match or profile is shared) only use what a signed-out visitor could see.
6. Who processes data for us
These providers process data only on our instructions. We don't sell or rent data to anyone.
| Fly.io | Runs our API and replay processing (Frankfurt, Germany). |
|---|---|
| Neon | Our database (AWS Frankfurt, Germany). |
| Cloudflare | Stores replay files (R2) and, when enabled, the bot check (Turnstile). |
| Vercel | Hosts the website, which forwards your requests to our API. |
| Sentry | Error reports (EU region). |
| Valve (Steam) and Epic Games | Only when you choose to sign in with them. They confirm your account ID to us. |
| Ballchasing | Only when you import from it, using the token you give us. |
Some of these companies are based outside the EU or [YOUR COUNTRY]. Where data leaves the EU, they're covered by the European Commission's Standard Contractual Clauses or an adequacy decision [CONFIRM AND LINK EACH PROVIDER'S DATA PROCESSING AGREEMENT].
7. How long we keep data
- Replay files and match data: kept while the service runs, because other players' match pages depend on them. Erasure (below) removes what identifies you.
- Accounts: until you delete them. Deletion completes within 30 days. You can also choose to delete the replay files you uploaded; a file someone else also uploaded is kept for them.
- Guest sessions: until you delete them from the account page [DECIDE: OR AUTOMATICALLY AFTER A PERIOD OF INACTIVITY].
- Ballchasing tokens: until the import ends, and 72 hours at most.
- Request logs at our hosting providers: about 30 days.
- Privacy requests: [PERIOD], to show we handled them.
8. Your rights
You can ask to access, correct, export or delete your data, object to how we use it, or restrict it. For players in replays, the privacy request form handles the common cases:
- Hide: your name becomes "Hidden player" everywhere and you have no profile page. Applies immediately when we can confirm it's you (signed in with that Steam or Epic account, or a verified console claim).
- Erase: your player record is made anonymous within 30 days. Your stats stay as an anonymous slot so other players' match pages still add up, and we block your platform ID from being added again.
- Object: we stop using your data as described in section 3 unless we have compelling grounds to continue.
Account holders can delete their account under Account settings. For anything else, email [CONTACT EMAIL]. We answer within one month.
You may also complain to a data protection authority, such as the one where you live [ADD THE AUTHORITY FOR YOUR COUNTRY, E.G. SOUTH AFRICA'S INFORMATION REGULATOR].
9. Children
You must be at least 13 to use the site. We ask for your birth year (only the year) before you can upload or use an account. If you're under 13 we refuse, and we keep nothing: a new account is deleted straight away.
Accounts under 18 are always private and can't create developer API keys. [CONFIRM WHETHER PARENTAL CONSENT IS NEEDED IN YOUR JURISDICTION FOR 13 TO 17 YEAR OLDS.]
10. Security
Connections are encrypted (HTTPS). Session cookies are HttpOnly and protected against cross-site requests. API keys are stored only as hashes, and Ballchasing tokens are encrypted. Network addresses for limits are stored only as keyed hashes. Access to production systems is limited to [WHO].
If a breach puts your data at risk, we'll tell the authorities and, where required, you.
11. Changes to this policy
If we change how we use data, we'll update this page and the date above, and for significant changes give notice on the site before they take effect.