Privacy Policy

This Privacy Policy explains what data Legends Road (“we”) collects, why, and your rights over it. Legends Road is a free, fan-run tournament hub with a play-money betting game (⚡ Bolts — no real currency is ever involved).

1. Data we collect

• Account (email sign-up): email address, display name, and a salted bcrypt hash of your password. We never store your password in plain text.
• Account (Discord sign-in): your Discord user ID, username, email and avatar, received via Discord OAuth. OAuth tokens are encrypted at rest.
• Two-factor authentication: if you enable 2FA, your TOTP secret is encrypted at rest (AES-256-GCM).
• Gameplay: your ⚡ Bolts balance, bets, match picks, votes, and a ledger of balance changes.
• Analytics (optional): anonymous page-visit counts, only after you accept the cookie banner. No cross-site tracking, no advertising, no profiling.
• Technical: a session cookie to keep you signed in, and short-lived server logs (IP, timestamp) used solely for rate-limiting and abuse prevention.

2. Why we use it

To run your account and the betting game, secure it (login, 2FA, single-session enforcement, rate-limiting), and — only with your consent — count visits to improve the site. We do not sell your data or share it with advertisers.

3. Cookies

• Essential: session cookie (sign-in) and your consent choice. These are required for the site to work.
• Analytics: set only if you click “Accept”. You can decline and the site still works fully.

4. Retention

Account and gameplay data are kept while your account exists. Password-reset and email-verification tokens expire (1 hour / 24 hours respectively) and are deleted after use. Rate-limit logs are short-lived.

5. Your rights (GDPR)

You can export or delete all your data at any time from your account page (My Account). Deleting your account removes your personal data and anonymises gameplay records. You may also withdraw analytics consent at any time by clearing cookies.

6. Contact

For privacy requests, contact the tournament administrators via the project’s Discord server, or email the address shown in the site footer / your verification emails.