Skip to main content

Privacy Policy

Last updated: 6 March 2026

1. Data Controller

The data controller for your personal data is the Cambridge Battlecode team ("we", "us", "our"), based in Cambridge, United Kingdom. You can reach us at team@battlecode.cam.

2. Data We Collect

We collect the following personal data:

  • Account data: name/username, email address, hashed password (if using email registration)
  • OAuth data: Discord user ID, username, and email (if signing in via Discord); Google user ID and email (if signing in via Google)
  • Competition data: team membership, location category (UK/international), competition category (novice/main), bot submissions, match history, ladder ratings
  • Technical data: IP address, browser user agent, session tokens

3. How We Use Your Data

We process your data for the following purposes:

  • Account management: creating and authenticating your account, managing sessions
  • Competition operation: running matches, calculating ratings, determining eligibility for brackets and prizes, displaying the ladder and match history
  • Communication: sending competition updates, notifying you of match results or rule changes
  • Discord integration: syncing your roles on our Discord server based on your team and category
  • Security: preventing abuse, detecting multiple accounts, protecting the platform

4. Legal Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we process your data on the following bases:

  • Contract: processing necessary to provide the competition services you signed up for (account management, match execution, ladder ranking)
  • Legitimate interests: platform security, fraud prevention, and improving the competition experience
  • Consent: where required, such as for optional Discord role syncing or marketing communications — you may withdraw consent at any time

5. Third-Party Services

We use the following third-party services that may process your data:

  • Amazon Web Services (AWS): cloud hosting, database (Aurora PostgreSQL), file storage (S3), and compute (Lambda, Batch). Data is processed in the EU West (London) region. AWS acts as a data processor under our instructions.
  • Discord: OAuth authentication and role syncing. Subject to Discord's Privacy Policy.
  • Google: optional OAuth authentication. Subject to Google's Privacy Policy.
  • GitHub: source code hosting and CI/CD. No user personal data is stored on GitHub.

6. Cookies & Sessions

We use strictly necessary cookies to maintain your authenticated session. These cookies do not track you across other websites and are essential for the Platform to function. We do not use advertising cookies, analytics cookies, or any third-party tracking cookies.

  • Session cookie: stores your authentication session token. Expires when you sign out or after a period of inactivity.

Because we only use strictly necessary cookies, we do not require cookie consent under UK GDPR / the Privacy and Electronic Communications Regulations (PECR).

7. Data Retention

We retain your data as follows:

  • Account data: retained while your account is active. Deleted within 30 days of account deletion.
  • Bot submissions: deleted when you upload a new submission or delete your account.
  • Match replays: retained indefinitely as part of the public competition record.
  • Ladder and match history: retained for the duration of the competition. Anonymised after the competition concludes.
  • Server logs: retained for up to 90 days for security purposes.

8. International Data Transfers

Your data is primarily stored and processed within the United Kingdom (AWS eu-west-2, London). Where third-party OAuth providers (Discord, Google) process data outside the UK, they do so under appropriate safeguards as required by UK GDPR, including Standard Contractual Clauses or adequacy decisions.

9. Your Rights

Under UK GDPR, you have the right to:

  • Access: request a copy of the personal data we hold about you
  • Rectification: request correction of inaccurate data
  • Erasure: request deletion of your personal data ("right to be forgotten")
  • Restriction: request that we limit how we use your data
  • Portability: request your data in a machine-readable format
  • Object: object to processing based on legitimate interests
  • Withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at team@battlecode.cam. You can also delete your account directly from the account settings page. We will respond to rights requests within 30 days.

10. Age Requirements

You must be at least 16 years old to use the Platform. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will delete the account and associated data promptly.

11. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: ico.org.uk/make-a-complaint.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform or Discord. The "last updated" date at the top of this page indicates when the policy was last revised.

Terms & Conditions