Privacy
Last updated: 16.10.2026 · This is a convenience translation. The German version is legally binding.
matchsync.net is built on privacy by design: no tracking, no advertising cookies, no analytics tools, and all fonts and scripts are served from our own server. Below you'll find exactly which data we process and why.
1. Controller
Andreas Bilke, Merkenicher Str. 161, 50735 Köln, Deutschland
E-mail: contact [at] matchsync.net
2. Hosting and server logs
The service runs on a server in Germany (hosting provider: netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Deutschland, under a data processing agreement pursuant to Art. 28 GDPR). The web server logs IP address, date/time, requested URL, status code, transferred bytes, referrer and user agent for security and stability purposes (Art. 6(1)(f) GDPR). Logs are deleted after 14 days at the latest.
3. Cookies
We only use strictly necessary cookies (§ 25(2) no. 2 TDDDG), so no consent banner is needed: __Host-ms_sess (session, login, CSRF protection; until browser close or 12 h of inactivity), ms_remember ("keep me logged in", only if selected; 30 days), ms_lang (your chosen language; 1 year).
4. No third parties on page load
Fonts, styles and scripts are self-hosted. Images from external platforms (Discord/Steam avatars, game covers, Twitch thumbnails) are delivered through our own image proxy/cache, so your IP address is not disclosed to those providers when you browse the site.
5. Account
For e-mail registration we process your handle, e-mail address, password (Argon2id hash only) and language; your e-mail is confirmed via double opt-in. Optional profile data (display name, avatar, bio, playstyle, roles, online times, age group, country/region, spoken languages, platform IDs, game library, ranks) is processed only if you provide it. Legal basis: Art. 6(1)(b) GDPR. When you delete your account, your data is deleted or anonymised within 30 days unless statutory retention applies.
6. Login protection
Login attempts are stored with a hash of the entered e-mail and the IP address for 30 days to prevent brute-force attacks (Art. 6(1)(f) GDPR). New passwords are checked against known breaches using the k-anonymity method of "Pwned Passwords": only the first 5 characters of a SHA-1 hash are sent — never your password or e-mail. Optionally, Cloudflare Turnstile (Cloudflare, Inc., USA; EU-US Data Privacy Framework) protects the sign-up form against bots.
7. Discord, Steam, Battle.net, Epic Games, Xbox and Twitch
Only at your request, we link your Discord (ID, username, display name, avatar, verified e-mail; "guilds.join" adds you to our community server), Steam (SteamID64, profile name, avatar and — if your profile is public — game library, playtime and achievements) and Twitch account (ID, channel name and, while live, title, game, viewer count and thumbnail, which are shown publicly on our homepage). With Battle.net (Blizzard Entertainment S.A.S., France / Blizzard Entertainment, Inc., USA) we receive your account ID and BattleTag (no e-mail) and, with the "wow.profile" permission, your World of Warcraft characters (name, realm, level, class, race, faction, spec, guild, item level, Mythic+ rating, raid progress, character image) to show them on your profile and in group finder; this data is refreshed daily, kept for at most 30 days as required by Blizzard and deleted immediately when you unlink. With Epic Games (Epic Games, Inc., USA) we receive, with the "Basic Profile" permission, your Epic account ID and display name (no e-mail, no game library) so you can sign in and your verified Epic name appears on your profile; we do not store Epic access tokens. With Xbox (Microsoft Ireland Operations Limited / Microsoft Corporation, USA) we receive, via Microsoft sign-in with the "XboxLive.signin" permission, your Xbox user ID (XUID) and gamertag (no e-mail, no game library) so you can sign in and your verified gamertag appears on your profile; we do not store Microsoft or Xbox tokens. If you link Diablo3Stats (diablo3stats.de) with a one-time code, we receive your BattleTag and Diablo III stats (total playtime, paragon, seasons, heroes, kills, best Greater Rift) to show your verified playtime in your library; the sync repeats regularly while the link exists. Tokens are stored encrypted and deleted when you unlink. Legal basis: Art. 6(1)(b) GDPR; transfers to the USA happen at your request (Art. 49(1)(b) GDPR) or under the EU-US Data Privacy Framework where the provider is certified.
8. Discord bot and voice
If your Discord account is linked, our bot processes your Discord ID, server roles and voice state (channel, muted/deafened, streaming) to create temporary match channels, sync roles and show voice presence on the site. Audio is never recorded or processed. Completed voice sessions (start, end, duration — used for XP) are kept for 90 days.
9. Matchmaking and lobbies
Public lobbies (title, game, language, time, participants' handles, avatars and karma) are visible to everyone. Our algorithm suggests groups based on your games, playtime, languages, region, skill, karma, online times and roles (profiling without legal or similarly significant effect — you decide whether to join). Legal basis: Art. 6(1)(b) GDPR.
10. Karma
After organised matches, players can rate each other; the resulting karma score is shown on your profile and affects matchmaking. Comments are only visible to moderators; individual reviews are kept for 12 months. Repeated negative reviews from different players can trigger an automatic, temporary LFG restriction; you may request human review, express your view and contest the decision at any time (Art. 22(3) GDPR) via a support ticket or contact [at] matchsync.net.
11. PRO subscription and payments
Payments are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland). We never receive your card data — only customer/subscription IDs, status, amount, currency, country and invoice data. Invoices are retained for 10 years (Art. 6(1)(c) GDPR with § 147 AO, § 257 HGB).
12. E-mails, overlay, moderation
We only send transactional e-mails from our own mail server (newsletters only with your consent). The in-game overlay receives a read-only token (90 days, stored hashed, revocable). Reports, warnings and bans (account, e-mail, Discord ID, SteamID, Battle.net account ID or IP) are stored for the duration of the measure; staff actions are recorded in a tamper-evident audit log (staff IPs removed after 90 days); application error logs are deleted after 14 days (Art. 6(1)(f) GDPR).
13. Amazon Alexa voice assistant (PRO)
If you enable the MatchSync skill in the Alexa app, you explicitly link your account on our consent page (OAuth 2.0). Amazon receives an access token that only works for the skill, is valid for one hour and – like the matching refresh token – is stored by us only as a hash. When you ask a question, Amazon converts your speech to text and sends us the recognised intent (e.g. "new messages"); we reply with the text Alexa reads out. We only send Amazon what the answer needs: the number and senders of unread messages (never their content), match invitations and dates from your match calendar, the names of friends who are online, your level and your season pass progress. So that Alexa recognises your friends' names, we send the display names from your friends list for the duration of the session. A match is only created after your explicit confirmation. For times we ask Amazon for your device's time zone. We do not receive voice recordings; Amazon's privacy notice applies to their processing. Legal basis: Art. 6(1)(b) GDPR (a feature you requested). You can unlink at any time in your account or by disabling the skill; the tokens become invalid immediately.
14. Recipients
We never sell your data or share it for advertising. Recipients are limited to our hosting provider, Stripe, and — only when you use the respective feature — Discord, Valve (Steam), Blizzard (Battle.net), Epic Games, Microsoft (Xbox), Twitch and Amazon (Alexa).
15. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and may withdraw consent at any time (Art. 7(3)). Contact contact [at] matchsync.net. You may also lodge a complaint with a supervisory authority (Art. 77 GDPR).
16. Minimum age and security
matchsync.net is intended for users aged 16 and over. We protect your data with TLS/HSTS, Argon2id password hashing, encrypted tokens, strict Content Security Policy, CSRF and brute-force protection, role-based staff access and tamper-evident logging (Art. 32 GDPR).