ClanStop Privacy Policy

Effective Date: May 28, 2026

Last updated: May 28, 2026 — added disclosure for Google Analytics, restructured the cookies section, removed the email-fonts caveat after migrating to self-hosted Inter.

This Privacy Policy explains how ClanStop ("ClanStop," "we," "us," or "our") collects, uses, shares, and protects information when you use clanstop.com, the ClanStop Discord bot, and any related applications or services (collectively, the "Services"). It also describes the choices you have about how your information is handled. By using the Services you accept the practices described here. If you do not agree, please do not use the Services.

This Policy is read together with our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms.

1. Who We Are and What This Policy Covers

ClanStop is a gaming community platform that lets users create accounts, join or run clans, post on walls, follow tournaments, link external accounts (such as Discord or Steam), and interact through public and semi-public features. This Policy covers all of those features. It does not cover websites or services we do not control, even when we link to them.

2. Information We Collect

2.1 Information You Provide to Us

Account information. When you register we collect your email address, a password (stored only as a bcrypt hash — we cannot retrieve your plain-text password), your date of birth (used for age verification, see Section 8), and your country/region.
Profile information. Optional details you choose to add, such as display name, avatar and banner images, primary language, gaming platforms you play on, game profile identifiers, and external account handles you choose to link.
Content. Posts, comments, reactions, quotes, mentions, hashtags, clan content, tournament entries, custom emoji, images, and other material you submit through the Services. Public content is visible to other users; clan content is visible according to that clan’s settings.
Communications. If you contact us by email or other means, we receive the content of your message and any contact details you provide.
Reports. If you report another user or piece of content, we receive the report and any context you supply.

2.2 Information We Collect Automatically

Device and connection data. Browser type, operating system, and approximate device characteristics derived from your User-Agent string. We do not store your full raw IP address as a long-term identifier; instead we store a hashed subnet derived from your IP, used for device fingerprinting and abuse prevention.
Login security data. Hashed login fingerprints (a SHA-256 of User-Agent plus IP subnet) so we can recognize trusted devices and alert you to logins from new ones. We keep a rolling list of approximately your last twenty recognized devices.
Login attempts. A short-lived record of login attempts (successful and failed), used to detect and rate-limit brute-force attacks. These records are pruned on a rolling basis.
Usage data. Which posts you view, how long they are on screen (dwell time), how many times media in a post is opened, and similar interaction signals. This is used to rank trending content, surface posts in feeds, and improve the product. We do not use these signals to build behavioral profiles for advertisers.
Session cookies. A single first-party session cookie identifies your logged-in session. See Section 7.

2.3 Information from Third Parties

Discord. If you link a Discord account or use the ClanStop Discord bot, Discord shares your Discord user ID, username, avatar, and (depending on permissions) information about the servers you and the bot share. We store the minimum required to provide the linked features.
Steam and other gaming platforms. If you link a Steam (or future similar) account, we receive the public profile identifier and any public profile data the platform exposes. Linking is optional.

3. How We Use Information

We use the information we collect to:

Create and maintain your account, authenticate you, and keep you signed in.
Operate the core features of the Services — posting, comments, clans, tournaments, notifications, linked-account integrations.
Send transactional messages (login codes, security alerts, account-change confirmations) and, if you have opted in, periodic digest or community emails.
Protect the Services and our users — detect and prevent fraud, abuse, spam, brute-force logins, and Terms of Service violations.
Moderate content. Posts may be analyzed by automated content-safety tooling to flag potential violations. Human moderators may also review reported content.
Improve and develop the Services, including by analyzing aggregated usage signals.
Comply with legal obligations and respond to lawful requests.

4. Legal Basis for Processing (EEA / UK Users)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following bases:

Performance of a contract — to provide the Services you have signed up for.
Legitimate interests — to secure the Services, prevent abuse, moderate content, measure how features are used, and protect our and other users’ rights and property. We balance these interests against your privacy rights.
Consent — where required, for example before sending non-transactional marketing emails. You can withdraw consent at any time.
Legal obligation — to comply with applicable laws and to respond to lawful requests.

We do not sell your personal information for monetary consideration, and we do not share it with third parties for their own advertising purposes. We do use Google Analytics for aggregate site-usage measurement, and other service providers to operate the Services; see Section 5.2 and Section 6 for details. We share information only in the following limited ways:

5.1 With Other Users

Your public profile information (such as display name and avatar), the content you post publicly or to clans, and your activity on public pages are visible to other users and visitors of the Services. Anything you would not want to be public, you should not post publicly.

5.2 With Service Providers (Processors)

We rely on a small set of service providers to operate the Services. They process information only on our instructions and only as needed to provide their service:

Service	Purpose	Data Categories
Discord (Discord Inc.)	Account linking, bot features, server role and channel management, notification delivery to linked accounts	Discord ID, username, avatar, server membership, message content that you direct us to send to Discord
SMTP / email delivery provider	Sending transactional and opt-in emails (login codes, security alerts, digests)	Email address, message content
Hosting provider	Running the website and database	All information stored by the Services, at rest on the hosting infrastructure
Google Analytics (Google LLC)	Aggregate measurement of how the Services are used — pageviews, traffic sources, broad device/region breakdowns	IP address, User-Agent, pages visited, referrer, GA cookie identifiers (`_ga`, `_ga_<id>`). Google does not receive your account information or content.

5.3 With Linked Platforms You Choose

When you link Discord, Steam, or another external account, information necessarily flows between that platform and the Services. Each platform’s own privacy policy governs what it does with the data on its side.

5.4 For Legal Reasons

We may access, preserve, and disclose information if we reasonably believe doing so is necessary to (a) comply with a legal obligation such as a subpoena, court order, or search warrant; (b) enforce our Terms of Service; (c) respond to claims that content infringes another party’s rights; or (d) protect the rights, property, or safety of ClanStop, our users, or the public, including investigating fraud or abuse.

5.5 In a Business Transfer

If ClanStop is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will require any successor to honor the commitments in this Policy or notify you of material changes.

6. Third-Party Content and Embeds

Some features can cause your browser to contact third parties:

Link previews. When a post contains a URL, our server (not your browser) fetches that URL to build a preview card. Your IP address is not sent to the linked site during the preview fetch. When you click the preview, your browser then contacts the site directly.
Embedded video / audio (YouTube, Twitch, Kick, TikTok, Streamable, Medal.tv, Spotify). These embeds use a "click-to-load" design: nothing loads from the embedded platform until you click play. Once you click, your browser contacts that platform directly and the platform’s privacy policy applies.
Web fonts. The Inter font family used across the site is served from our own infrastructure. Your browser does not contact a third-party font CDN to render text on our pages or emails.
Google Analytics. Each page of the website loads the Google Analytics 4 measurement script (via Google Tag Manager). This causes your browser to send a request to Google that includes your IP address, User-Agent, the URL you’re viewing, and your GA cookie identifiers. Google processes this on our behalf to give us aggregate site-usage statistics. You can opt out by installing Google’s Analytics Opt-Out Browser Add-On, or by blocking analytics cookies in your browser. See Section 7 for the specific cookies set.

7. Cookies and Similar Technologies

The Services use the following cookies and similar technologies:

Session cookie (first-party). A single cookie keeps you signed in. It is marked Secure, HttpOnly, and SameSite=Lax, and lasts for approximately twelve days. Blocking it will prevent you from staying signed in.
Google Analytics cookies (first-party, set by Google’s script running on our pages). _ga and _ga_<property-id> identify your browser to Google Analytics so we can measure unique vs. returning visits. They are not used for advertising. Default lifetime: up to two years. Blocking them disables analytics measurement for your visits but does not affect site functionality.
Local browser storage. We store a small amount of state (for example, dismissed banners and UI preferences). This data stays in your browser and is not shared with third parties.

We do not set advertising cookies, third-party tracking pixels, or cross-site behavioral-advertising identifiers. You can opt out of Google Analytics specifically via Google’s Analytics Opt-Out Browser Add-On, or block all cookies in your browser settings.

8. Children’s Privacy

The Services are not directed to children under 13. By using the Services you represent that you are at least 13 years old. In some jurisdictions a higher minimum age applies; you must also meet the minimum age set by the laws of your country.

We collect a date of birth at registration to enforce this requirement. If we learn that we have collected personal information from a child under 13 (or under the minimum age in their jurisdiction), we will delete that information and terminate the account. If you believe a child has provided us with personal information, please contact us at [email protected].

9. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights with respect to your personal information:

Access — request a copy of the personal information we hold about you.
Correction — ask us to correct information that is inaccurate or incomplete. Most account and profile fields can be updated directly through your account settings.
Deletion — ask us to delete your account and personal information, subject to limited exceptions (such as records we are required to retain for legal or security reasons). Account self-deletion may be temporarily disabled while we improve the flow; in the meantime you can request deletion by email.
Portability — request a copy of certain information in a portable, machine-readable format.
Objection / restriction — object to or restrict certain processing of your information.
Withdraw consent — where we rely on your consent (for example, promotional email), you can withdraw it at any time.
Complain — lodge a complaint with your local data protection authority.

Email choices. Transactional emails (login codes, security alerts, account-change confirmations) cannot be turned off while you have an active account, because they are required to operate the Services. Optional emails (weekly digest, tournament digest, recruiting updates) can be turned off in your account settings or via the unsubscribe link in each email.

To exercise any right, contact [email protected]. We may need to verify your identity before acting on a request. We will respond within the time required by applicable law.

10. California Privacy Notice

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you specific rights, including the rights to know, delete, correct, and limit the use of your personal information. We do not sell personal information for monetary consideration. We do share certain information with Google Analytics for site-usage measurement (see Sections 5.2 and 6); whether this constitutes “sharing for cross-context behavioral advertising” under California law depends on account-level settings in our Google Analytics property. If you would like to opt out of Google Analytics on this site, install Google’s Analytics Opt-Out Browser Add-On or block analytics cookies in your browser. You may exercise your other CCPA rights by contacting [email protected]. We will not discriminate against you for exercising these rights.

11. Data Retention

We keep personal information only for as long as we need it for the purposes described in this Policy or as required by law. In practice:

Account information is kept while your account is active and for a limited period afterward to allow recovery and to satisfy legal and security obligations.
Login-attempt records are kept on a short rolling window (on the order of days) for abuse prevention.
Login fingerprints are kept while you have an active account, with the oldest entries rotated out as new devices appear.
Content you have posted may remain visible after your account is deleted in a deidentified form (for example, attributed to "[Deleted User]"). You can request removal of specific content through the report or contact channels.
Soft-deleted clans and posts are retained for a recovery window and then purged.

12. Security

We use a combination of technical and organizational measures to protect your information, including bcrypt password hashing, secure-cookie session management, device fingerprinting for new-login alerts, rate limiting on authentication endpoints, and notification of changes to security-sensitive account settings. No system is perfectly secure, however, and we cannot guarantee absolute security. Please use a strong, unique password and keep your email account — which can be used to recover access — secure.

13. International Data Transfers

The Services are operated from the United States. If you access them from elsewhere, your information will be transferred to, processed, and stored in countries that may have data-protection laws different from those of your country. Where required, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) for transfers out of the EEA or UK.

14. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Effective Date" at the top and, if the changes are material, provide additional notice (for example, in-app or by email). Your continued use of the Services after the new Policy takes effect means you accept the updated Policy.

15. Contact Us

If you have questions about this Policy or how we handle your information, contact us at [email protected].