Privacy policy

1Who the operator is

The battlemetrics.ru service belongs to the sole proprietor Maxim Sergeevich Suvorov (INN 543317138517, OGRNIP 323547600120282). Hereinafter in this text — “we”.

We process personal data under Russian Federal Law No. 152-FZ of 27.07.2006. The site server, databases, backups and the mail server are located in Russia. Data leaves the country only in the cases from section 7: notifications to Telegram or Discord — if you connected them yourself; short alerts to the team's work chat in Telegram; checking of texts by the AI moderator in the Ollama cloud (USA); a request to Steam (Valve, USA) for your nickname and avatar when you sign in with Steam; vote data — to the reward address set by the server owner, which may be located abroad.

Letters about data processing — to privacy@battlemetrics.ru. A person replies, not an autoresponder.

2Server data is not data about you

Most of what we collect has nothing to do with people. A game server answers requests over the open Valve A2S protocol: name, map, number of players, maximum slots, version, rule set. The server gives these answers to anyone who asks — we simply ask regularly and keep the history.

We do not sell or host game servers, have no access to them and do not manage them. Everything visible on a server page was reported by the server itself.

We request the player list in the “Players” tab from the server at the moment you open it, show it and do not store it anywhere. Player nicknames are not stored in our database; we have no history of “who played where”.

3What we collect about a visitor without an account

The web server writes a regular access log: connection address, time, requested page, referring page address and browser string. It is needed to tell people from search robots, catch brute-force attempts and investigate failures. The log is kept for 14 days and then overwritten.

If you wrote to us via the form on the “Contacts” page, we save the topic, the reply address you left, the server address (if you gave one), the message text and the connection address the form came from. Without this there is no way to answer the message.

The “On the site now” banner counts open tabs. While a tab is visible, once a minute it tells us “I am here”; from the connection address we immediately compute an irreversible hash with a random salt that is created when the site starts and lives only in memory. Neither the address nor the hash is written anywhere, no cookie is set for this, and the mark itself disappears after three minutes. Even we cannot tell who you are from it; several people behind a shared address count as one.

Visit statistics. The Yandex Metrica and LiveInternet counters run for all visitors; what exactly goes to each of them is described in the cookie policy.

Advertising and its impressions forecast. A page tells us it was opened, and an ad row tells us it stayed on screen or was clicked. From this we accumulate only daily numbers: how many times a game list, the home page and search were opened (and which words were searched), how many impressions and clicks each campaign had. So that one page refresh does not count as ten impressions, the connection address is kept in memory for up to 10 minutes and is not written anywhere.

Views of server posts are counted the same way: so that one person cannot inflate views, the connection address is kept in memory for up to six hours and is not written anywhere.

Country by connection address. To show advertising ordered for certain countries and to count which countries visitors come from, we determine the country by the address (the GeoLite2 database by MaxMind, www.maxmind.com). We do not store the country next to the address and do not write it to logs — only a counter like “so many impressions from Russia” goes into statistics.

4What we collect about an account holder

Email address, nickname, display name, avatar — a link to the picture at the sign-in service or a picture you uploaded (we re-encode it without metadata) — and country, if you entered it in your profile yourself. We require none of this except the email.

We do not store the password — the database holds an irreversible hash (scrypt). The password cannot be recovered from it, including by us.

The sign-in method and what the sign-in service told us about you with your permission. Yandex ID and VK ID — your identifier with them, email, name and avatar link. Steam — only the numeric SteamID64: we request the nickname and avatar from your Steam profile from Steam ourselves, by this number, and Steam provides no email. We do not share your SteamID64 and do not show it on public pages.

For each open session — the connection address, the browser string and a short device label like “Chrome · Windows”. This is what you see in the list of sessions in the settings and can end.

The log of sign-ins and sign-in attempts, favorite servers and subscriptions to them. Consent records: what you accepted, which document revision, when, from which address and browser.

Two-factor protection, if you turned it on: the secret for the code app (encrypted in the database) and irreversible hashes of the backup codes.

Notifications: what to send and where, the notification feed in your account and the channels if you connected them — the chat number with our bot and your name in Telegram, the Discord webhook address (encrypted in the database).

Votes for servers: which server and when, the connection address and your in-game nickname if you entered it. The address is needed so that one connection votes once a day, the nickname — so that the server can give a reward.

Support requests from your account: the subject, the conversation and attached screenshots. We re-encode screenshots without metadata — including geotags.

If you own a server or are on its team: ownership verification, team members and invitations, server posts, projects, requests and appeals with your explanations and attachments.

If you pay by invoice as a company or sole proprietor: the payer details — name, INN, KPP and the email for documents — and the issued invoices and statements.

API keys and how many requests were made with them per day.

Your answer to whether to show you in the “On the site now” banner. By default — not shown: until you turn it on yourself in the settings, on the “Privacy” tab, you are counted in the total, but neither your nickname nor avatar is visible in the list.

We do not have full card or account numbers: you enter them on the YooKassa and bank side. From YooKassa we receive the payment method and, if you paid by card, the last four digits of its number — they are shown in your payment history so you can recognize your card. When you pay for advertising or top up your balance, we store the email for the receipt, the amount, the payment status, its YooKassa ID and the fiscal receipt details; for a campaign — the display days, counted days and refunds; for the balance — a log of top-ups, spending and refunds with dates and amounts. How payment works is described on the “Payment and refunds” page.

5Why we need this data

So that you can sign in and stay in your account, and we can tell you apart from a stranger who opened a page with your address.

To count honest online. Signs of fake online are only visible when comparing servers with each other and with their own past — without a history of measurements, monitoring turns into a showcase for those who draw numbers.

To protect the service: limit request rates, catch password guessing, and not let us be turned into an amplifier of someone else's attacks.

To understand how the site is used: which sections are opened, where people come from, where they leave and where the site is inconvenient — from Yandex Metrica and LiveInternet statistics.

To answer your message and send messages that matter: the email confirmation code, the password change link, the notice about signing in from a new device and the notifications you turned on in your account under “Notifications” — about wipes and outages of servers you follow, reviews and votes of your own servers, ads, payments and support replies. You choose what to send and where, and you can turn everything off there.

To handle moderation faster: reviews, complaints, appeals and server owners' posts are first read by the AI moderator. In clear cases it decides on its own — it publishes a clean review, removes spam and advertising, accepts or rejects a complaint or an appeal when it is confident in the answer; anything doubtful is left to a person. The decision concerns a text or a server, not your account: the AI cannot block it. If you disagree with a decision, write to us via “Contacts” or to support in your account, and a person will review it.

To do what the law requires — accounting and tax records for paid services, answers to lawful requests from state authorities.

6On what basis

Your consent — you give it at registration by ticking the box next to the link to this document. Consent can be withdrawn.

Performance of a contract — the terms of use are a public offer, and they cannot be fulfilled without processing account data.

A legal requirement — for accounting documents on paid services.

Our legitimate interest in protecting the service — for logs and rate limits. In this part we collect the minimum and keep it briefly.

Our legitimate interest in developing the site (clause 7, part 1, article 6 of Federal Law 152-FZ) — for Yandex Metrica and LiveInternet statistics. The counters run for all visitors; you can turn them off in your browser as described in the cookie policy.

7Whom we share data with

The mail delivery service (a mail server in Russia) — your address and the text of the email: a confirmation code, a password change link, a new sign-in notice and the notifications you turned on.

To the YooKassa payment service (YooMoney LLC NCO) — the amount, the order description, the email for the fiscal receipt and our internal payment, campaign and account numbers used to reconcile the payment, when you pay for advertising or top up your balance. You enter card or account details on the YooKassa and your bank's side; of these, only the payment method and the last four card digits reach us.

Telegram and Discord — only if you connected them yourself under “Notifications”: the notification text — the same as in your account feed — goes to your chat with the @battlemetricsru_bot bot or to your Discord webhook. These are foreign services; you can disconnect a channel in your account, and we remove the link immediately.

The team's work chat in Telegram — short alerts: about a new registration (nickname and sign-in method), about every new review — published, awaiting a check or removed (rating, server or hosting, the author's nickname, an excerpt of up to 200 characters, the outcome of the check), a message via “Contacts” (topic, nickname or “guest”, an excerpt of up to 200 characters — without the reply address) and an owner's reply to a review (nicknames and an excerpt of the reply). No emails or connection addresses go there.

The Ollama Cloud AI model (Ollama, Inc., USA) — texts for the AI moderator to check: a review with its rating and the server or hosting name, a complaint, a server owner's appeal, a server post. Nicknames, emails and connection addresses are not included in the request.

Yandex SmartCaptcha (Yandex.Cloud LLC) — on registration, password recovery, reviews and votes: the one-time captcha answer and the connection address, to tell a person from a program. Details are in the cookie policy.

The owner of the server you voted for — your in-game nickname if you entered it, your name on the site and the time of the vote: their server uses them to give a reward. They go to the address the owner set for rewards, or via the owner's API key.

Hosting providers in Russia — the site server and the backup storage: the data is stored with them, but the providers do not read or use it.

The LiveInternet counter — the address of the open page, its title, the referring page address and screen size. Always, except in the admin and moderation sections; details are in the cookie policy.

Yandex Metrica (Yandex LLC) — the page address and the referring page, information about the browser, device and screen, actions on the page (Webvisor). Always, except for the admin panel, moderation and the new password page; Webvisor does not record the contents of your account pages and sign-in forms. Details are in the cookie policy.

State authorities — in cases directly provided for by law and to the extent stated there.

We share nothing about you with sign-in services (Yandex ID, VK ID, Steam): the exchange goes the other way — you allow them to tell us your identifier.

We do not sell data, do not pass it to ad networks or brokers and do not build targeting profiles; analytics gets it only through the two counters above. The project has no such source of income and does not plan one.

8How long we keep it

Minute online samples — 8 days: the daily chart is built from them, after that they are not needed. Hourly summaries — 90 days, daily ones — three years. These periods are set in the database itself, not only in this text.

The web server access log — 14 days. Messages via the “Contacts” form — until the matter is closed and a reasonable time after.

The connection address in a server vote is kept for 30 days, in a message sent via “Contacts” — 90 days: then we erase the address, while the vote and the message remain. The account sign-in log (address, browser, sign-in method) — 180 days. Emails in the mail queue — 90 days after sending. These periods are also set in the database itself.

Yandex Metrica and LiveInternet statistics are stored by Yandex and LiveInternet — the periods are set by their rules; we do not store this data ourselves.

A sign-in session lives 30 days from the last visit and no longer than 180 days from creation. Any session can be ended in the settings.

The presence mark for the “On the site now” banner — three minutes, and only in RAM. It never gets into the database or logs, all marks disappear at once when the site restarts, and no attendance history can be built from them.

Account data — as long as the account exists: the profile, subscriptions, notification feed and channels, votes, support requests. We keep consent records even after that: otherwise there would be nothing to confirm that consent was given at all.

Invoices, statements and payment documents — at least five years after the reporting year, as the accounting law requires.

Database and file backups — up to 15 days: each new copy pushes out the oldest one. So whatever is erased from the database disappears from the backups within 15 days at most.

Messages sent to you in Telegram, Discord or by email stay with you — they can only be deleted there. Alerts in the team's work chat stay in that chat's history.

9Your rights and how to exercise them

To find out what exactly we store about you, to demand correction or deletion of inaccurate data, to withdraw consent, to complain to Roskomnadzor or a court — these are all your rights under 152-FZ. Write to privacy@battlemetrics.ru from the address the account is registered to; we answer requests for information within 10 business days.

You can delete your account yourself in the settings. Deletion takes effect immediately: we erase the email, name, avatar together with an uploaded picture, country, links to Yandex ID, VK ID and Steam, the password hash, two-factor protection, notification channels and feed, favorites and subscriptions, support conversations, membership in server and project teams, the team's notes about you, your letters in the mail queue, connection addresses and browsers in sessions and the sign-in log, the address and nickname in your votes, the connection addresses of your reviews, complaints and messages; we revoke API keys and end all sessions.

Only what cannot be erased remains. Reviews and votes stay in place, but without an author: they are addressed to other players, and erasing them retroactively would be unfair to them. Complaints about servers and messages via “Contacts” — until the matter is closed. Consent records and the sign-in log — without addresses and browsers. Payment documents and the details they were issued for — as long as the law requires. Erased data disappears from backups within 15 days.

10What we do not process

Special categories of data — about health, views, religion, nationality, intimate life — and biometrics. We do not ask for or accept them: do not send them to us in the feedback form.

The service is not intended for children under 14. If you are younger, you may use an account only with the consent of a parent or guardian.

11How we protect data

The site works only over a secure connection; session cookies are marked Secure and HttpOnly. Passwords are stored as an irreversible hash, session tokens as a SHA-256 hash: even having stolen the database, one cannot sign in as you with it.

Access to the servers is restricted by keys, the rate of requests to the sign-in and recovery forms is limited, and attempts are logged.

Inside the project only the site team sees the data, and each member only within their role: for example, a moderator sees reviews, complaints and appeals, and finance sees payments and documents. The admin panel can only be entered with two-factor protection, and every team action is written to a log. To sort out a request, a staff member with a separate permission can open your account through your eyes for an hour (“Log in as”); the start and end of this mode are logged, and in it no one can change your email, password or sign-in methods, export or delete the account, pay, vote or write a review on your behalf.

You can add two-factor protection to sign-in — a code from an app; for the site team it is mandatory. Two-factor secrets and Discord webhook addresses are encrypted in the database.

We do not promise absolute protection — it does not exist. We promise that we do not collect anything extra: what is not in the database cannot be lost.

12Changes

A new revision takes effect the moment it appears on the site; the revision date is at the top of the page. We will announce significant changes on the site itself, and to registered users by email.

If something you gave separate consent to changes (for example, the set of optional cookies), we will ask again rather than treat the old answer as still valid.

13Operator details

Individual Entrepreneur Maxim Sergeevich Suvorov

INN 543317138517 · OGRNIP 323547600120282

Website: battlemetrics.ru · Contact email: info@battlemetrics.ru · Personal data inquiries: privacy@battlemetrics.ru