01 · The short version

WARDOGS Europe uses Discord to log you in. We store the account, competition, and moderation records needed to run the competition. We do not collect a real name, address, phone number, date of birth, or email from you. Legal controller details and retention periods are not invented here: REQUIRES HUMAN / LEGAL DECISION.

02 · What we store

Discord user ID, Discord username, Discord display name, Discord avatar URL, Discord locale if Discord sends it, an internal account ID, account status, created date, last login time, assigned roles, nation membership, optional Discord guild membership check, sessions, match and championship participation, moderation records, and administrative audit records. We do not store Discord access tokens after login. We do not currently store IP addresses or user-agent strings in the application database.

03 · Why we use it

Authentication, showing your public competition identity, nation/roster membership, match results, standings, staff access, and moderation. Sessions exist so you stay logged in.

04 · What is public

Nation names and codes, match participants, results, standings, championship participation, and the display name/avatar shown on public or member-facing competition pages. Discord IDs, moderation history, sessions, and staff audit logs are not public.

05 · Who can access it

You can view your own account data. Staff with the relevant permission can view users, moderation, or audit logs. Nation managers can manage their own nation’s roster, not other nations. Hosting operators with server access can technically read the database. Discord receives the OAuth login request.

06 · How long we keep it

No retention period has been adopted in this application. REQUIRES HUMAN / LEGAL DECISION. Competition results and moderation/audit records may need to remain after an account is deleted so the competition record stays intact.

07 · Discord login

You click Discord Login. Discord authenticates you. WARDOGS requests the OAuth scopes `identify` and `guilds`. Discord returns the user object permitted by those scopes. WARDOGS creates or retrieves the account keyed by Discord user ID, not by username. If you change your Discord username, display name, or avatar, the same WARDOGS account remains. Access tokens are used during that login and are not stored.

08 · Cookies and sessions

`wdeu_session` is an httpOnly login cookie. `wdeu_oauth_state` is a short-lived httpOnly cookie used during Discord OAuth. Both are SameSite=lax and Secure in production. There are no analytics or advertising cookies in this application.

09 · Moderation

Warnings, timeouts, suspensions, bans, unbans, and reinstatements are stored as separate records: target, action, reason, issuing staff member, timestamps, and expiry where applicable. Later actions do not overwrite earlier ones. Account deletion does not erase that history; personal profile fields on the deleted account are removed or replaced.

10 · Competition data

Matches have participating nations and results. Standings are calculated from confirmed league results. Championship squad membership can remain attached to a de-identified account after deletion so historical records stay consistent.

11 · Your rights

Depending on applicable law you may have rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent where consent is the basis, and complaint to a supervisory authority. Those rights are not absolute. Legal wording for production: REQUIRES HUMAN / LEGAL DECISION.

12 · Deleting your account

You can delete your account from Settings → Privacy. That signs you out, invalidates sessions, removes roles and nation membership, and replaces Discord identity fields so the same Discord account can register again as a new WARDOGS account. Historical matches, results, standings, championship rows, moderation actions, and audit logs that still need to exist are kept. Deleted profile data is not restored on re-login.

13 · Data export

You can download a JSON file of your stored account data from Settings → Privacy. It contains your information only. It does not include other users’ private data, session secrets, or server configuration.

14 · Contact

Controller name, address, privacy email, and DPO: REQUIRES HUMAN / LEGAL DECISION.

15 · Third parties actually used

Discord (login and avatar files loaded from Discord’s CDN in your browser). The website and API run as a hosted Docker application with PostgreSQL. TLS certificates are issued by Let’s Encrypt where configured. No analytics or error-tracking product is wired into this application. Processing locations and international transfers: REQUIRES HUMAN / LEGAL DECISION.