Privacy Policy

Last updated: 18 March 2026

This Privacy Policy explains what personal data BattleStation collects, why, and what rights you have over it. We follow a minimum collection principle — we only hold what is strictly necessary to run the service.

1. Who We Are

BattleStation (battlestation.build) is operated by MGC Marcin Gdowski, a sole trader registered in Poland (EU VAT ID: PL9522050065). As an EU-based data controller we fall directly under the General Data Protection Regulation (GDPR) — no separate EU representative is required.

Privacy contact: privacy@battlestation.gg

2. What Data We Collect & Why

Account data

If you create an account we collect your email address and username. These are used solely to provide account features (saved builds, battlestation profiles, community participation). Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Authentication data

We use passwordless magic-link authentication. We store a one-way hash of each sign-in token (never the token itself) and a 6-digit code, both of which expire after 15 minutes and are destroyed on first use. No passwords are ever stored. Legal basis: performance of a contract.

IP addresses

IP addresses are processed temporarily for rate-limiting and abuse prevention (e.g. throttling magic-link requests). They are held in memory only and are not written to permanent storage. Legal basis: legitimate interests (Article 6(1)(f) GDPR).

Usage data

We collect anonymous, non-identifiable metrics (page response times, request counts) via self-hosted Prometheus and Grafana. This data cannot be traced back to an individual. No third-party analytics scripts are loaded on this site.

We do not sell your personal data. We do not use your data for advertising, profiling, or automated decision-making.

3. Affiliate Disclosure

BattleStation may include affiliate links to hardware retailers (such as Amazon). When you click an affiliate link the retailer may set their own cookies, subject to their own privacy policy. We may earn a commission on qualifying purchases — this funds the free service and does not influence our compatibility results or recommendations. This disclosure satisfies FTC guidelines and EU consumer protection requirements.

4. Cookies

Essential cookies only. We set the following cookies:

• Authentication token — stored in localStorage (not a cookie); holds your signed session token. Cleared when you log out.
• Browser-binding cookie (bs_brk) — a short-lived HttpOnly cookie used to bind a magic-link to the requesting browser. Expires after 15 minutes.
• Language preference — stores your chosen display language (EN/PL). Expires after 1 year.

We do not use advertising, tracking, or non-essential analytics cookies. A cookie consent banner is displayed proactively for transparency, though only essential cookies are currently set. See our Cookie Policy for full details.

5. Third-Party Processors

We use a limited number of third-party services to operate BattleStation. Each processes data only as instructed by us and is bound by appropriate data processing agreements.

• Email delivery — transactional emails (magic links, notifications) are sent via an SMTP provider hosted within the EU.
• CDN / DDoS protection — Cloudflare (planned) may proxy requests. Cloudflare is certified under the EU-US Data Privacy Framework.
• Monitoring — Prometheus and Grafana are self-hosted within our infrastructure. No third-party monitoring service receives user data.

6. International Data Transfers

BattleStation is hosted on servers within the European Union. If we use any infrastructure outside the EU/EEA in the future, we will update this section and ensure appropriate safeguards (such as EU Standard Contractual Clauses) are in place before any transfer occurs. Registered users will be notified at least 14 days in advance.

6. Data Retention

• Account email & username — retained while your account is active. Upon deletion, email and username are anonymised immediately and the record is purged after a short grace period.
• Magic-link tokens — destroyed on first use or after 15 minutes.
• IP addresses — held in memory for rate-limiting only; not persisted to disk.
• Anonymous usage metrics — retained in aggregated form for up to 12 months, then deleted.
• Email delivery logs — retained for up to 90 days for debugging, then deleted.

We never retain personal data longer than necessary for the stated purpose.

7. Your Rights (EU / EEA / UK Residents)

Under GDPR you have the following rights. Email privacy@battlestation.gg to exercise them. We will respond within 30 days.

1. Right of Access — request a copy of data we hold, or export it directly from your profile page.
2. Right to Rectification — correct inaccurate data from your profile.
3. Right to Erasure (“right to be forgotten”) — delete your account and all associated data from your profile page under Account Settings.
4. Right to Restriction — ask us to pause processing in certain circumstances.
5. Right to Data Portability — download your data (builds, battlestations, reports) as structured JSON from your profile page.
6. Right to Object — object to processing based on legitimate interests.
7. Right not to be subject to automated decisions — we do not use profiling or automated decision-making.
8. Right to lodge a complaint — contact the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO) at uodo.gov.pl. Users in other EU states may contact their national authority.

8. Your Rights (California Residents — CCPA/CPRA)

California residents have the right to know, delete, correct, and opt out of sale of personal information. We do not sell personal information. Email privacy@battlestation.gg to exercise your rights. We will not discriminate against you for doing so.

9. Children’s Privacy

BattleStation is not directed at children under 16 years old. We do not knowingly collect personal data from under-16s. If you believe a child has provided us data, contact privacy@battlestation.gg immediately and we will delete it promptly.

10. Security

We implement appropriate technical and organisational measures including: passwordless authentication, one-way token hashing, HttpOnly cookies, and HTTPS-only access. In the event of a personal data breach affecting your rights, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR Article 33.

11. Changes to This Policy

We will update the date at the top of this page when changes are made. For material changes (e.g. new data types collected, new third-party processors) we will notify registered users by email at least 14 days before they take effect.

12. Data Protection Officer

Given our current scale of operations, a formal Data Protection Officer (DPO) has not been appointed. All data protection inquiries are handled directly by the data controller. If our processing activities expand to a scale requiring a DPO under GDPR Article 37, we will appoint one and update this section.

13. Contact

MGC Marcin Gdowski
EU VAT ID: PL9522050065
Email: privacy@battlestation.gg