Privacy policy

The Onward Snake League (OSA) is a community esports league for the VR game Onward. It is run by OSA league staff, a team of volunteers based in the United Kingdom. We are the controller of the data described here.

We follow the UK GDPR and the Data Protection Act 2018. If you live in the European Union or EEA, the EU GDPR also protects you.

Contact: open a ticket or send a DM to league staff in the league Discord server. That is the only contact channel we use.

From Discord, when you sign in

You sign in with Discord. We only ask Discord for the identify permission. We do not ask for your email address or your server list.

• Your Discord ID, username, display name and avatar link.
• Discord's login token is used once to read these details, then thrown away. We never store it.
• If your Discord username changes, we keep the old one in a name history.
• When your account is first created, we write an entry in our audit log (see section 7).

From you, on your profile

• Your OSA name (handle) and, if you add them: a photo, country, home region, time zone, languages, preferred role, a short bio and your height.
• Your Onward name and platform, and your SteamID64 (Steam) or Meta account name (Meta), so staff can check who you are in game.
• Your settings: whether the league bot may DM you, and which scrim regions you want pings for.
• Old OSA names and old Onward names, so links to your old name still work.
• Free-agent listings (your note and availability) and reservist sign-ups.

From playing in the league

• Teams you join and leave, match lineups, results, stats and ratings.
• Penalties, tickets (reports), votes on tickets and overturn requests, no-show claims and staff roles.
• Your MVP votes and your Oracle prediction picks.
• Notifications we send you on the site.

What we do not collect

We do not store your email address, real name, date of birth, IP address or browser details. We do not call the Steam or Meta APIs. For logins we store only a scrambled (hashed) copy of your session token, not the token itself.

Public (anyone, without signing in)

• Your profile: photo or Discord avatar, Onward name, OSA name, team, region, preferred role, country, height, platform and bio.
• Your honours, badges, match history and stats.
• Public penalties: the type, reason, rule and dates. Penalty evidence is never public.
• Links to your old OSA names, which redirect to your profile.
• The free-agents board: your languages, note and availability, while your listing is on.
• The Oracle leaderboard: your OSA name and avatar.
• MVP votes: the vote counts, once a vote has closed.

Staff only

• Your hidden player rating (MMR) and reservist MMR.
• Your Steam ID link and your Discord username.
• Penalty evidence and the audit log.
• Tickets: the description, evidence and the Discord transcript. Ticket votes and overturn votes, no-show claims and staff role grants.

The reporting team can also see its own tickets. Ticket screenshots stored on the site can only be opened by people who can see that ticket.

Only you

• Your notifications, your own MVP vote and your own prediction picks.

• Running the league you joined (contract): your account, profile, teams, matches, results, stats, ratings, notifications and Discord roles.
• Fair play and moderation (legitimate interests): checking in-game identities, one account per person, penalties, tickets, votes and the audit log. Our interest is a fair league that players can trust.
• Keeping league history (legitimate interests): results, standings, honours and records stay correct for every team that played.
• Optional profile details (photo, bio, country, height, languages): you choose to add them, and you can remove them at any time in your settings.

We use ratings to pair teams and to help staff with reservists. This has no legal or similar effect on you. We do not sell your data or use it for advertising.

We use these services to run the site. They only handle data to provide their service to us.

• Supabase (database): stores all site data, including uploaded images, on Amazon Web Services in Frankfurt, Germany.
• Vercel (hosting): runs the website, in its Frankfurt region.
• Discord: the league runs on Discord. The league bot:
  • sends you DMs about invites, match times and results to confirm (you can turn these off in your settings);
  • gives and removes your league roles, and times you out in the server during a suspension;
  • posts results, transfers, news and public penalties in league channels;
  • opens private channels for tickets, and DMs a text copy of the ticket transcript to the refs and admins who can see the ticket;
  • copies screenshots posted in ticket channels to the site, so they don't expire.

Avatars from Discord load from Discord's servers (cdn.discordapp.com), so Discord can see the IP address of anyone viewing them. Discord's own privacy policy covers what Discord does with your data.

We have no email provider and no analytics or advertising services.

Our database and website are hosted in Frankfurt, in the EU. The UK recognises the EU as giving adequate protection. Supabase and Vercel are US-based companies; their own terms cover any access to data from outside the EU.

Discord is a US company. What the bot sends to Discord (messages, DMs and roles) is handled by Discord, including in the United States, under its privacy policy.

• Your account and profile: until you delete your account.
• Logins: a login lasts 30 days. Expired logins are deleted by the site's daily job.
• Ticket channels in Discord: deleted 14 days after the ticket closes. The transcript and the ticket stay on the site.
• League records: penalties, match history, stats, ratings, results, tickets and the audit log are kept for league records and fair play, with no fixed end date.
• Audit log: a permanent, add-only record of actions on the site. Entries can include details of a change, such as an old and new name. The entry made when your account is created includes your Discord ID.
• Name history (old names) is kept until you delete your account.

You can delete your account yourself, under Profile settings → Delete my account. If you are a team captain, hand over the captaincy (or disband the team) first. You can't delete it while a suspension, ban or team-change cooldown is running. Deleting your account signs you out and can't be undone.

What is deleted

• Your Discord link (ID, username, display name and avatar) and every login.
• Your photo, bio, country, home region, time zone, languages, preferred role, height and settings. Your OSA name becomes an anonymous deleted-… name.
• Your Onward name, platform and Steam ID or Meta name. If you played matches, the in-game record stays but is renamed “Deleted player” and the account ID is removed.
• Your old names, free-agent listing, reservist notes, notifications, prediction picks and your votes in MVP votes that are still open.
• You leave your team, and open invites and join requests are cancelled. Any staff roles end.
• The bot removes your league roles in the Discord server.

What stays, shown as “Deleted player”

• Match lineups and stats, results, transfers, honours and badges.
• Penalties, tickets (including evidence and transcripts), ticket and overturn votes, no-show claims and votes in MVP votes that have closed.
• The audit log, and team logos or banners you uploaded for a team.
• A one-way hash of your Discord ID (not the ID itself, your username or anything else about you). It is used only to enforce bans: if the deleted account has a permanent ban or a season ban that is still running, the same Discord account can't sign in again.

We keep these for league records and fair play: other teams' results depend on them, and penalties must not disappear by deleting an account. Messages the bot already posted in Discord are not changed. If you sign in again later (and the deleted account isn't banned), you start with a new, empty account: no MMR, stats or history carry over.

You have the right to:

• access the data we hold about you;
• correct it (you can edit most of it yourself in your settings);
• delete it (see section 8);
• object to, or ask us to restrict, how we use it;
• portability: get a copy of the data you gave us, in a common format.

To use any of these rights, open a ticket or DM league staff in the league Discord server. There is no automatic download yet, so staff prepare copies by hand. We answer within one month.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live. Please talk to us first, so we can try to fix it.

You must be at least 13 to use this site (rulebook 2.3). This matches Discord's own minimum age, and you need Discord to sign in. If you are under 13, do not sign up. If you think a player is under 13, tell league staff.

We use four cookies, all needed for the site to work: one keeps you signed in, two protect the Discord sign-in, and one remembers which region you last viewed. No analytics or tracking. Details are in the cookie notice.

The site only works over HTTPS. Login cookies can't be read by scripts, and we store only a hashed copy of each login token. Uploaded images are checked to be real PNG, JPEG or WebP files. Staff actions are recorded in the audit log.

If we change this policy, we update the date at the top of this page. We announce important changes in the league Discord server.

Questions or requests: open a ticket or DM league staff in the league Discord server.