Privacy Policy
Last updated October 15, 2026
This policy explains what personal data BulletMeta (bulletmeta.app, the Discord bot and the public API) processes, why, on which legal basis under the EU General Data Protection Regulation (GDPR), who receives it, how long it is kept, and what rights you have.
1. Who is responsible
The controller under Art. 4 (7) GDPR is:
Sebastian Steinke, Karlstraße 29, 44532 Lünen, Germany
Email: [email protected], contact form: bulletmeta.app/contact
We are not required to appoint a data protection officer. Send any data protection question or request to the address above.
2. Summary
- We sell no data, show no advertising and use no advertising or social media trackers.
- Public statistics (leaderboards, match and player pages) are recorded for everyone who plays on a game server enrolled in our public statistics, with or without an account.
- Analytics cookies are set only if you agree. Without consent, usage is counted without any cookie or identifier.
- Our servers and our analytics provider are in the EU. Steam, Discord and Stripe involve US companies (section 15).
- You can see, export, correct and delete your data. Most of it is under My account.
3. Visiting the site and hosting
When you open a page, your browser sends us your IP address, the page requested, the referring page, the date and time, and your browser and operating system. We need this to deliver the page and to keep the site secure.
- Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in a working, secure website.
- Hosting: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, as our processor (Art. 28 GDPR).
- Retention: server logs are deleted after 30 days at the latest.
4. Your account: signing in with Steam and Discord
You sign in with Steam and can link Discord. We have no passwords.
- Steam (Valve Corporation, USA) gives us your SteamID64 and your public Steam name and avatar.
- Discord (Discord Inc., USA) sends us your Discord user ID, username, avatar and email address. We use the email only for account and billing messages.
- We store your account, the providers linked to it, your signed-in devices (IP address and browser), optional two-factor settings, and what you put on your profile page.
- If you play on a connected server, we record your play sessions (server, start and end). They are shown to you under My account and to that server's community, never on a public page.
- The players you follow. Only you see that list; nobody is told who follows them, and no follower count is shown.
Legal basis: Art. 6 (1) (b) GDPR — performing our contract with you (the account and the features you use). Security records such as signed-in devices: Art. 6 (1) (f). Retention: while your account exists. When you delete it (My account → Delete account), the deletion runs after 30 days, during which you can cancel it; then your account is deleted and your profile pseudonymised.
5. Statistics from game servers
Communities register their WARDOGS game servers with us. On a server enrolled in public statistics, we record for every player on it, whether or not they have an account with us: their SteamID64, their Steam name and avatar, the name they use in the game, the matches they played, their kills and deaths (including the weapon and the distance), and the rating derived from those matches. This is public: it appears on leaderboards, match pages and player pages. A player who has never signed in has an unclaimed profile, which they can claim by signing in with Steam. More on what is recorded and why: what gets recorded, and how.
Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest, and that of the gaming community, in public statistics and leaderboards of public game servers. The data is what any player on the server can see in the game anyway, and anyone can have it removed (below). Source: the game servers (Art. 14 GDPR) and Steam.
Retention: detailed match records are kept for 3 to 365 days, depending on the community's plan, and individual kills for 180 days. Match results, career totals, ratings and a tally of who killed whom (shown to you as your "nemesis") are kept as long as the profile exists.
Removing your statistics: with an account, write to us and we take you off the leaderboards, or delete the account. Without an account, write to us with your SteamID64. We erase the profile and its public statistics and record later matches as "Anonymous player" until you ask us otherwise. You may object to this processing at any time (Art. 21 GDPR); we then remove your statistics as described.
6. Communities, clans and moderation
On any server a community connects, whether or not it is enrolled in public statistics, that community's administrators also see presence data for the players on it — when they joined and left, which team they switched to and whether an administrator moved them, how long they played and seeded, and their standing under the community's whitelist rules — and the moderation records the community keeps: bans, their reasons and evidence, and administrators' notes, and the names a player used in the game on that community's servers, with when each was first and last seen. This is shown to that community's administrators and to the player concerned, never on a public page.
The community decides what it records about players on its servers and is responsible for it. We provide the tools and keep these records on the community's behalf and on its instructions. Questions about a ban or a note go to that community first; we help if you cannot reach them.
Clans and communities have members, roles, invitations, events with sign-ups, and an audit log of what their members did in the console, including the acting member's IP address. Members of an organization see its roster; its administrators see its audit log. Legal basis: Art. 6 (1) (b) GDPR for members and their features; Art. 6 (1) (f) for the audit log (accountability within the community and security). Retention: while the organization exists, or until the community deletes the record. A community's moderation records stay with that community even after a player deletes their account, where the community has a legitimate interest in keeping a ban. The same applies to the in-game names recorded on a community's servers: they are kept as moderation records while the community exists and are not erased when a player deletes their account or asks us to, on the same basis as a ban: the community's legitimate interest (Art. 6 (1) (f) GDPR) in recognising a player it has moderated under another name.
7. Our Discord bot
A community or clan can add our bot to its Discord server. The bot then posts match reports, events and announcements, and reads the roles of that server's members to give console seats or whitelist slots the community linked to a role. For that we process Discord user IDs, names and role memberships of that server. Answers to event sign-ups made with the bot's buttons are stored with the event. Legal basis: Art. 6 (1) (b) GDPR towards the community, and Art. 6 (1) (f) towards its members (the community's interest in organizing itself through Discord). Discord processes the messages under its own privacy policy.
If you have BulletMeta Plus and turn on the session recap under My account, the bot sends you a direct message after you stop playing, with your own match results, rating change, new personal bests and your record against the rivals you chose. We store only that the recap is on and up to when it was sent. Legal basis: Art. 6 (1) (b) GDPR — a feature you turned on. Turn it off at any time under My account.
8. Payments
BulletMeta Plus, Clan Plus and community plans are paid through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your payment details in Stripe's payment form, which Stripe shows inside our page once you choose to pay; they go straight to Stripe, and we never see card numbers or bank details. The form loads Stripe's script from js.stripe.com, which receives your IP address and sets the cookies listed in our Cookie Policy to process the payment and prevent fraud. We store what we need to provide the plan: the product, amounts, dates, invoices and the payment status. Legal basis: Art. 6 (1) (b) GDPR (contract) and (c) (tax and commercial law). Retention: invoices and booking records for 8 to 10 years as German tax and commercial law requires (Section 147 AO, Section 257 HGB); everything else while the subscription and your account exist. Stripe's privacy policy: stripe.com/privacy.
9. Contact form and email
When you write to us, we receive your email address, the topic and your message, and your account ID if you are signed in. Messages from the contact form reach our team through Discord (Discord Inc., USA). We answer by email. Legal basis: Art. 6 (1) (b) GDPR where your message concerns a contract with us, otherwise Art. 6 (1) (f) — our interest in answering you. Retention: we delete the message once the matter is settled, unless the law requires us to keep it.
Bot check. The contact form, and a map vote you cast without signing in, first run Cloudflare Turnstile (Cloudflare Inc., USA): your browser loads it from challenges.cloudflare.com, which receives your IP address and technical details of your browser and decides whether a person or a script is sending. Most visitors see nothing; some are asked to tick a box. We receive only whether the check passed. Without it the form or the vote is not sent. Legal basis: Art. 6 (1) (f) GDPR — our interest in keeping automated spam out of our inbox and out of a community's map vote.
10. Usage analytics
To see how BulletMeta is used — which pages and features, where sign-up or a purchase gets stuck — we use PostHog (PostHog Inc., USA), with data processed in the EU, as our processor. We record which pages you visit and which features you use, never names, email addresses, SteamIDs or message text. Your IP address is not stored.
- With your consent: a cookie lets us recognise your browser across visits, and when you are signed in, usage is linked to your account ID. Legal basis: Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG.
- Without consent: nothing is stored in your browser, and visits cannot be connected to each other or to you. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in understanding how the site is used.
- Session recordings, only with your consent: on the public site and in the consoles — never on staff pages — we record the page structure, clicks, scrolling and navigation, so we can see where people get stuck. Never recorded: anything you type, secrets (keys, tokens, codes), email addresses, SteamIDs, IP addresses, player lists and rosters, and your account and identity-confirmation pages, which appear as blank boxes. Recordings are processed by PostHog in the EU, under the same data processing agreement, and deleted after 30 days.
- Retention: up to 12 months; session recordings 30 days.
- You can withdraw consent at any time in , and object to analytics without consent by writing to us.
11. Error monitoring
Your browser reports errors and loading times, with the page address, browser and IP address, to our own servers so we can fix faults. No third party receives it. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in a site that works. Retention: up to 30 days.
12. Enterprise API and single sign-on
Communities on the Enterprise plan can read their own data through our API with keys they create, and can require their members to confirm their identity with the community's own identity provider (single sign-on). For single sign-on, we receive the identifier and group memberships that provider sends, to give the member the right role. Legal basis: Art. 6 (1) (b) GDPR towards the community and (f) towards its members. Retention: while the community uses single sign-on.
13. Cookies
Strictly necessary cookies are used without asking (Section 25 (2) No. 2 TDDDG), analytics cookies only with your consent. The full list is in the cookie policy.
14. Recipients and processors
- Processors (Art. 28 GDPR), bound by contract to our instructions: netcup GmbH (hosting, Germany), PostHog Inc. (analytics, EU cloud), Cloudflare Inc. (the bot check in section 9, USA).
- Independent controllers you choose to use with us: Valve (Steam), Discord, Stripe.
- The public: public statistics and what you publish on your profile or clan page.
- Communities see what section 6 describes about players on their servers.
- Authorities only where the law obliges us.
15. Transfers outside the EU
Valve Corporation (Steam), Discord Inc., Cloudflare Inc. and Stripe's US parent company are in the USA. Transfers to them rely on the EU–US Data Privacy Framework, under which they are certified (Art. 45 GDPR), and on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). PostHog processes our analytics in the EU; its US parent company is covered in the same way.
16. How long we keep data
| Data | Kept for |
|---|---|
| Server logs, error reports | Up to 30 days |
| Account and profile | Until you delete it, then 30 days until the deletion runs |
| Detailed match records | 3 to 365 days, by the community's plan |
| Individual kills | 180 days |
| Joins, leaves and team changes on a community's servers | 3 to 365 days, by the community's plan |
| Match results, career totals, ratings, who killed whom | As long as the profile exists |
| Moderation records (including in-game name history), audit log | As long as the community keeps them |
| Invoices and booking records | 8 to 10 years (tax and commercial law) |
| Contact messages | Until the matter is settled |
| Usage analytics | Up to 12 months |
17. Your rights
Under the GDPR you have the right to:
- access the data we hold about you (Art. 15) — signed-in users can download it under My account → Download my data;
- have incorrect data corrected (Art. 16);
- have your data deleted (Art. 17) — My account → Delete account, or write to us;
- have processing restricted (Art. 18);
- receive your data in a machine-readable format (Art. 20);
- object at any time to processing based on our legitimate interests (Art. 21), including the public statistics and analytics without consent;
- withdraw a consent at any time with effect for the future (Art. 7 (3)) — for analytics through Cookie settings in the footer.
Write to [email protected] or use the contact form (topic "Data protection request"). We answer within one month.
You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.
18. Automated decisions
We make no decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). The rating on the leaderboards is a game statistic computed from match results. Automated rules that a community sets up (for example a whitelist for seeding time) are that community's decisions about its own server.
19. Minors
BulletMeta is not directed at children. If you are under 16, please ask a parent or guardian before you create an account or accept analytics cookies. If we learn that we hold an account of a child under 16 without that consent, we delete it.
20. Changes to this policy
We update this policy when what we do changes. The date at the top says when it last changed. If a change affects what you consented to, we ask again.