Privacy policy

Data controller

Maxence Hedin, the individual publisher of Replay Nexus, is the controller for the data described below. Contact for any request about your personal data: hedin.maxence2@gmail.com.

Data we collect

Replay Nexus only collects the data needed to run the service. Here is, exhaustively, what is processed:

User account (if you create one)

Username, email, password (never stored in plain text, only as a hash), linked Battle.net identity, favorites, watchlist, MMR history, account creation date and last login. Legal basis: performance of the contract formed by the Terms of Use when you register.

Analyzed replays

The .SC2Replay file and the statistics extracted from it (APM, build order, composition, etc.), including the usernames and Battle.net identities of every player in the match — not just yours. Your replays are private by default; publishing one to the public community database is an explicit, voluntary action you trigger yourself. The published original file can be downloaded by anyone and may also contain match chat messages. If you are an opponent appearing in someone else's replay and want it removed, write to the contact address above.

Game statistics derived from replays

For every analysed 1v1 game, a few numbers per player are kept (workers and army at set times, expansion timings, reaction times, opening) to compare players of the same level, measure what costs you games and build scouting cards. A game uploaded by several people is stored once. These statistics are deleted with the replay or the account, and after 180 days at most. A scouting card only uses games in which the player was someone else’s opponent and never names an alternate account; you can hide yourself from scouting cards in your account privacy settings. Legal basis: legitimate interest (statistics of a public ladder).

Ladder username history

Name changes of ranked ladder players are recorded from data that is already public via the Battle.net and SC2Pulse APIs, to support historical profile tracking. Legal basis: legitimate interest (public ladder statistics).

Feedback and reports

The type and content of the message sent through the feedback form, and your username if you are signed in. No email address is requested in this form. From the desktop app, a technical report can be attached (version, system, latest local log messages): tokens, BattleTags and personal paths are removed automatically and you review it before sending.

Server technical logs

IP address, called endpoint, response code and timestamp, for security (abuse protection, rate limiting) and troubleshooting. Legal basis: legitimate interest. These logs are never used for profiling or advertising.

Browser identifier

A random identifier is created in your browser on your first visit and sent to our server with replay uploads to associate their history with that browser. It remains if you sign in or out, until you clear local storage. It is not used for advertising tracking or shared with third parties.

Audience measurement

Only if you accept it via the consent banner: a self-hosted audience-measurement tool (Umami) that does not set a tracking cookie and never resells data. Full details are in the cookie policy.

Battle.net / SC2Pulse

Searching for profiles and signing in with Battle.net query Blizzard Entertainment's and SC2Pulse's APIs. Those services process your data under their own privacy policies, independent of this one.

Connected Battle.net and Twitch accounts

If you connect these accounts, we store your Battle.net account ID and SC2 profiles (IDs and names), and, if applicable, the ID, name and public address of your Twitch channel. The channel is visible to everyone on your verified SC2 profiles. OAuth tokens are not stored. You can remove each connection in your account; the related data is then deleted. Legal basis: providing the requested service.

Third-party images

Map thumbnails are loaded from sc2replaystats.com, and live stream thumbnails (home page and Ladder tab) from Twitch's CDN (static-cdn.jtvnw.net). Those services see your IP address when those images load, as with any external web resource; we do not send them any additional data. Unit icons are hosted on our own server.

Donations

Donations go through Ko-fi (ko-fi.com) and the payment provider you pick on their site. Replay Nexus embeds no Ko-fi script or widget: the button on the Support page is a plain link. Ko-fi processes your data under its own privacy policy. The site owner receives the donation details (amount, name or nickname, any message you leave and, depending on the payment method, your email address), but never your payment details; this information is not linked to your Replay Nexus account.

Player flags (confirmed hacker / suspicious)

To protect fair play, the administrator can publicly flag a StarCraft II account as a "confirmed hacker" or as "suspicious". This processing covers the account's public identifier (region, realm, profile number), its in-game name, the stated reason and, where applicable, a link to evidence. It is based on Replay Nexus's legitimate interest in informing the community about cheating. The flag remains until the administrator removes it. If you are the player concerned, you can object to or contest the flag at any time through the feedback form ("Status contest" type) or by email; the request is reviewed and the flag is corrected or removed if it is not justified.

The administrator can also highlight outstanding players with a "GOAT" badge. This positive badge relies on the same public data (account identifier, in-game name, optional reason) and can be removed on request through the feedback form or by email.

Retention period

Your account and associated data are kept while the account remains active and deleted on request. Replay source files kept for analysis and share links are automatically purged after 7 days by default; history entries after 30 days by default. A replay you voluntarily publish in the community database, along with its metadata, remains available until you remove it in your account privacy settings or request its removal. After a player requests removal, the file hash and block date are kept for as long as community publishing is offered to prevent republication. The automatic periods can be configured by the service administrator. Web server logs rotate daily across 14 archives. Application logs have automatic volume-based rotation (about 150 MB). Neither type of log currently has a guaranteed maximum age. Site backups follow a policy of 7 daily and 4 weekly copies.

Who receives your data

No data is sold or rented. Only the publisher, who hosts the service themselves, accesses the database directly. If you publish a replay, its metadata and original file are available to all visitors; a previously downloaded copy may remain after unpublishing. Profile search and login features also communicate with Battle.net and SC2Pulse. Optional audience measurement is self-hosted.

Your rights

Under the GDPR and French data-protection law, you have the right to access, rectify, erase, object to, restrict, and port your data. To exercise it, write to hedin.maxence2@gmail.com; you will receive a reply within one month at most. You can also file a complaint with the French data protection authority, the CNIL (cnil.fr), if you believe your rights are not respected.

Security

Passwords are hashed and never stored in plain text. The site applies security headers (CSP, HSTS behind a TLS reverse proxy) and rate-limits requests to protect against abuse.

Minors

Accounts are available only to people aged 16 or over. We ask you to confirm your age when registering and do not collect your date of birth. Younger visitors can still use features that do not require an account.

Changes

This policy may change as the service evolves. The last-updated date is shown at the top of this page.