Privacy Policy

The controller for Flashback is Louis Rädisch & Gabriel Pechstein POVlib GbR, St. Petersburger Str. 26, 01069 Dresden, Germany. Contact us at contact@flashback.gg. Further provider information is available in our Legal Notice.

We have not appointed a data protection officer because we are not currently legally required to do so.

• Account and profile data, such as user ID, email address, display name, avatar and account settings.
• Connected game and community account data, including FACEIT or Steam identifiers, nickname, avatar, Elo, match history and statistics, and a Skool or partner-membership status where needed for a hosted challenge.
• Challenge data, including registration, rule-acceptance time and version snapshot, eligible matches, provisional score, rank, integrity checks, appeals and prize-verification status.
• Uploaded or generated content, including demo files, videos, comments, playlists, tactical drawings and associated metadata.
• Usage, device and security data, such as IP address, timestamps, browser/device information, requested URLs, diagnostics, consent choices and security events.
• Billing and support data. Payment providers process full payment credentials; we normally receive customer, subscription, transaction and status references rather than full card details.

We receive data from you, your use of Flashback, connected providers you authorize, partner challenge hosts and public game/esports sources. Please do not provide identity or eligibility documents unless we specifically request information reasonably necessary for verification.

• To create accounts, provide requested features, analyze matches, administer registrations and calculate challenge standings (Article 6(1)(b) GDPR, performance of our contract or pre-contractual steps).
• To secure the service, prevent abuse, deduplicate data, investigate cheating, protect fair competition, support users and defend legal claims (Article 6(1)(f) GDPR, our and participants' legitimate interests in a secure, reliable and fair service).
• To store which rules and terms a participant accepted and to resolve scoring or prize disputes (Article 6(1)(b) and 6(1)(f) GDPR).
• To process payments, accounting records, lawful requests and other mandatory compliance (Article 6(1)(b) and 6(1)(c) GDPR).
• To run non-essential analytics or similar storage/access on your device only after your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG). You can withdraw consent at any time for the future.

When you join a public challenge, your display name or FACEIT nickname, avatar, relevant match statistics, Elo movement, score and rank are displayed publicly. Do not join under a name or avatar you do not want shown. Account IDs used internally for reliable matching are not intentionally displayed as profile data.

For a partner-hosted challenge, we may share the minimum necessary registration, eligibility, integrity, appeal and winner-contact information with the named host so it can verify winners and deliver prizes. The host acts as an independent controller for its own membership, verification and prize-payment processing and must provide its own privacy information for those activities.

Depending on the feature used, data may be processed by or disclosed to:

• Clerk for authentication and account management.
• Supabase for application databases, storage and backend services in the EU.
• Vercel, Bunny.net, Cloudflare and related infrastructure providers for hosting, delivery and security.
• Stripe or another displayed payment provider for subscriptions and payments.
• FACEIT, Steam, Discord or Skool when you connect or actively use the corresponding integration.
• Google Analytics only after analytics consent.
• Named partner challenge hosts, professional advisers, authorities or courts where necessary as described above or required by law.

We use processors under data-processing terms where required. Some providers may process data outside the European Economic Area. Where no EU adequacy decision applies, we use an available lawful transfer mechanism, normally EU Standard Contractual Clauses, and supplementary safeguards where required. You may ask us for information about the safeguard relevant to your data.

• Account and service data is kept while your account is active and then deleted or anonymized when no longer needed, subject to the exceptions below.
• Challenge registrations, accepted-rules snapshots, final standings, integrity decisions and appeals are generally retained until the end of the third calendar year after finalization so the competition and related claims can be evidenced. A pending dispute may require longer retention.
• Billing and tax records are retained for the periods required by applicable commercial and tax law.
• Security logs and backups are retained for limited rolling periods based on incident-detection, recovery and legal-claim needs.
• Google Analytics data is configured for a limited retention period, generally up to 14 months.

We delete or anonymize data earlier where the purpose ends and no legal obligation or overriding claim-protection need remains.

Challenge scores and provisional ranks are calculated automatically from published formulas and source data. They can materially affect a participant's position, but final eligibility, disqualification, appeals and prize confirmation include human review by the host or Flashback. We do not use solely automated decision-making that produces legal or similarly significant effects within Article 22 GDPR.

Subject to their legal conditions, you have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent for the future. Where processing relies on legitimate interests, you may object for reasons arising from your particular situation. Contact us at contact@flashback.gg. We may need to verify your identity before fulfilling a request.

You may complain to a data protection supervisory authority, in particular the authority where you live or work or where an alleged infringement occurred. Our lead local authority is the Sächsische Datenschutz- und Transparenzbeauftragte, Maternistraße 17, 01067 Dresden, Germany, datenschutz.sachsen.de.

Essential cookies and local storage support authentication, security, consent and interface preferences. Non-essential analytics is disabled until you consent. Google Analytics may then process pseudonymous usage, device, approximate-location and referrer data; we do not enable it for advertising. Manage or withdraw your choice through our Cookie Policy.

Flashback accounts are intended for people aged 16 or older. Prize challenges may require participants to be 18. If we learn that an underage person supplied data contrary to these requirements, a parent or guardian may contact us so we can take appropriate action.

We use appropriate technical and organizational safeguards, but no internet service can promise absolute security. We may update this notice when processing or law changes. Material changes will be highlighted where appropriate, and the version date above will be updated.