Last updated 14 October 2026

Privacy Policy

What changed on 14 October 2026: this policy now describes public team pages and player cards, including who decides to publish them and who can see public match history and statistics; which summaries of public and private matches and competitions can be seen, including without signing in; and the optional availability teams can share for a competition. These are descriptions of features that already exist; this update does not change your settings or make anything public.

This policy describes the current VetoArc service, operated as an independent community project. It covers our Production website and separate Staging test environment. Contact the VetoArc operator through our Contact page about privacy or account requests.

Information we keep and why

We store account information such as username, email, optional display name and any Riot ID you choose to enter. Passwords are stored as password hashes, not readable passwords. Account information supports sign-in, identity within the service and account assistance. Account security emails verify your address and reset your password; these one-time links expire and we store only a hash of each link's token, with its issue, use and expiry times. Optional team invitation, match challenge, scheduling and reminder emails follow your email preferences. Turning off ordinary emails does not disable account security emails or in-app notifications.

We store teams, membership history, frozen rosters, match and competition configuration, Ready and Veto choices, submitted results, statistics and correction history. These records support organizing matches, validating results, calculating brackets and reviewing authorized post-match data. Reasons and actor records support correction review and accountability. Team managers may also enter optional availability for a competition. Only that team's current managers and the competition organizer can see it. It is used to suggest match times; a published time still changes only through the organizer or a request both teams agree to.

We also keep session and authentication security records, including session-token hashes and expiry or revocation timestamps, and limited operational/security logs for reliability, abuse prevention and troubleshooting. Hosting and network providers may process IP addresses and other connection metadata. Please do not put unnecessary personal information or secrets in team names, match notes or review reasons.

Match discussion, activity and notifications

Each match has a short text discussion. Messages are stored on the service and are visible to both teams' authorized members and to authorized match staff (the organizer, active match operators and the current match observer); it is not a private team chat. There are no attachments, voice, global direct messages or game telemetry, and nothing is collected from Riot in real time. Messages never change official schedules or results; those only change through the explicit match controls.

The match activity list comes from actions taken on the platform, such as Ready, map picks and bans, starts, schedule decisions and saved results. In-app notifications point to those actions and to team invitations, challenges and ownership offers. They stay available in the app even if you turn off ordinary emails; account security emails are unchanged. We do not use automated moderation, do not claim end-to-end encryption and do not currently delete messages automatically.

Manual entry and Riot accounts

VetoArc currently has no Riot Sign On integration and does not automatically obtain personal account, match or statistics data from Riot APIs. A Riot ID entered by a user is self-reported. Game results and statistics are submitted manually by authorized people. Any future approved Riot integration will require a separate opt-in flow and an updated explanation of the data collected and shared.

A Captain may choose to paste a Tracker match share link to help fill a single map's draft. Our server extracts the match identifier and sends it with the selected region to HenrikDev, an independent third-party data provider; it does not visit Tracker or retrieve a player's match history. Returned player names and tags, map details, scores and available statistics are shown for mapping and review. The source response is held briefly in memory, not stored as a separate permanent dataset. Only your explicit Save Changes action saves accepted values and source context in the existing match records and audit history. You can edit or discard the draft; imported suggestions and Captain edits remain manual submissions, not verified Riot data. No Riot password is requested.

Public team pages and player cards

Public team pages, player cards and the public match history and statistics described here are published only when a team or a player chooses to. They do not change what people who can already see a match in the app can see, or the team results that public events already show.

A team's Owner or Managers can publish a team page showing the team's name, short name, optional logo and description, self-selected level, usual servers and its results from public matches. Publishing a team page does not list its members: each member decides separately whether to appear on it.

You can publish a player card at a random link that is not based on your username or account ID. It shows your display name, optional avatar and bio, and, if you choose, your current teams that have a published page.

You choose separately who can see your public match history and who can see your statistics: only you, your current teammates or everyone. Both start as “only you”. Statistics cannot be shared more widely than history, and “everyone” requires a published card. On a public match result, your name is shown only to people your history setting allows, and your numbers only to people your statistics setting also allows; otherwise your name appears as “Private player”, or your name appears with “Stats private”. Totals on your player card are shown to others only once they cover at least three public maps; this minimum does not apply to individual match results.

Only matches from public events created after these pages launched are used for public match history and statistics; earlier matches and private matches are never added to them. This applies to these public pages only: you and the people who could already see a match in the app keep that access.

Your Riot ID, email address and login name are never shown on these pages. Turning a setting off or unpublishing takes effect from the next page load, including shared links; we cannot remove copies that others have already saved. These pages are marked so that search engines do not index them.

Who can access information

Account email is available to the account holder and authorized service operation, not through player or roster views. Team and match information is shown according to membership, participation and organizer/operator permissions. Public matches and competitions show a limited summary to anyone, including visitors who are not signed in: the title, format, time, server, level, the organizer's display name and the names of participating teams. A private match or competition shows the same limited summary only to people who open a valid sharing link or an unexpired event code, to teams it has invited, and to its participants and organizer; an expired or replaced code shows nothing more. You need to sign in to apply or join. Rosters, chats and statistics are not part of these summaries. Authorized readers can see historical rosters and reviewed changes. We do not sell personal data or use third-party advertising analytics.

Railway hosts the application and database; Cloudflare provides DNS, HTTPS proxy, network protection and private encrypted backup storage. Account and optional business emails, including your email address and the information needed for that notification, are delivered through Resend, our email delivery provider. Support emails and their sender details pass through Cloudflare Email Routing to the operator’s private Google Gmail inbox so we can handle requests. Remote game artwork or catalog requests may contact valorant-api.com, an unofficial third-party provider, and disclose browser network information to that provider. HenrikDev receives the match identifier and region for a share-link read you request. Healthchecks receives operational success or failure signals for monitored jobs, without chat messages, passwords or match statistics. These providers process information needed to deliver their services under their own applicable terms and privacy policies.

Cookies and browser storage

An essential, secure HttpOnly session cookie keeps you signed in. The default session lifetime is seven days; logging out revokes the current session. Production and Staging use separate host-only cookies and separate databases. A session in one environment does not sign you into the other. We do not use advertising cookies or store passwords or long-lived access tokens in localStorage. Unsaved Match Data entries are kept in this browser's local storage for your account until they are saved or discarded, and are removed when you log out; on a shared computer they remain in that browser until then. Your Light/Dark choice is also remembered in this browser. The clearly labeled design prototype may use temporary browser memory.

Retention, access and deletion requests

We keep information while it is needed to operate accounts and community matches, preserve reliable result and correction history, resolve disputes or address security and applicable legal obligations. There is no automatic account-deletion feature or fixed automatic deletion schedule. A maintenance tool can remove sessions that have been expired for more than seven days; it is run explicitly, not promised as a daily scheduled task.

Use the Contact page to request access, correction, export, account closure or deletion. We may ask you to verify control of the account without sending your password. We assess requests manually and explain any records that must be retained or de-identified to protect other participants, historical results, security or legal obligations. Staging requests are handled separately from Production.

Security and backups

We use HTTPS, password hashing, restricted session cookies, access controls and private database networking. No service can guarantee absolute security. Production has encrypted backups and a tested isolated restore procedure. Weekly backups are scheduled, with additional backups before important releases and migrations. Private backup storage has automatic retention limits: 56 days for weekly copies, 186 days for monthly copies and 30 days for pre-release copies. These are periodic snapshots; point-in-time recovery is not available. Backup copies are restricted, not used for ordinary product access, and require separate manual handling when fulfilling an approved deletion request. A restore must account for approved deletion requests before returning data to service.

Changes and contact

We will update this page when our practices change and use an appropriate notice for material changes. The date above identifies this version. Send privacy questions through the Contact page; never send passwords, session cookies or access tokens.