Privacy Policy

Plainly: Diffed collects what it needs to run leagues and duels off your actual game stats, shows it to the people you’re playing with, and doesn’t sell it to anyone. Here’s exactly what that means.

What we collect

• Account info — your email, display name, username, and password (stored hashed, never in plain text) or the fact that you signed in with Google or Discord instead.
• Linked game accounts — the platform handles you connect (Steam, Riot, Xbox, Battle.net, and others), and any OAuth token needed to keep pulling your match history from that platform.
• Match stats — pulled automatically from a game’s own API where one exists, or read off a screenshot you upload where it doesn’t.
• Uploaded screenshots — stored so a match can be reviewed or disputed later, and sent to Anthropic’s API to read the stats off them (see Third parties below).
• Everything you create in the app — groups, leagues, duels, challenge completions, predictions, achievements, and messages in group chats, league chats, matchup threads, and direct messages.
• Basic technical data — things like IP address and request logs, kept only as long as needed to keep the service secure and working.

We don’t ask for anything beyond this, and we don’t buy data about you from anyone else to add to it.

What it’s used for

• Running the actual features — scoring matches, building standings, generating your digest, showing you your groups and messages.
• Reading stats off a screenshot you upload, so you don’t have to type them in.
• Sending you account emails — a magic sign-in link, or a digest you asked for.
• Catching cheating — duplicate uploads, edited screenshots, and stats that don’t match what actually happened.
• Keeping the service secure and diagnosing it when something breaks.

We don’t use your data to train AI models, and we don’t sell it. If we ever build a paid feature or a subscription, it’ll be something you pay for directly — not a way of monetizing your stats or your friends’ data. If that ever changes, this policy changes first, and you’ll be told before it does.

Who it’s shared with

With other people: only what the feature is actually for. Match stats, standings and achievements are visible to whoever you share a group, league or duel with — that’s the entire point of them. A group or league can be set to public by its commissioner, which makes its standings visible to anyone; your account settings control whether your own profile is public or private regardless. Direct messages are only ever visible to the two people in them.

With outside companies: only the ones that have to run the service, and only what they need. Nobody on this list gets your data to use for their own purposes — they're processing it on our behalf, under their own commercial terms:

• Anthropic — reads the stats off a screenshot you upload. Only submissions you actually make get sent, and only for that purpose.
• Game publishers’ own APIs (Riot, Valve/Steam, Blizzard, and others) — queried to pull your match history for a game you’ve linked. Each operates under its own terms; where a source is explicitly non-commercial, it’s not used here.
• Resend — sends account emails (sign-in links, digests) on our behalf.
• Vercel and Neon — host the app and the database. Infrastructure only; neither has any reason to look at your data.

We’ll never share your data with anyone else without telling you first, and we’ll never sell it. Full stop.

How long we keep it

For as long as your account exists, plus a short window afterward for backups. Match data you appear in in someone else’s league or group stays after you delete your account, for the reason explained below — it belongs to everyone who played, not just you.

Your data, your control

Export it. Download everything we hold about you — profile, linked handles, every match you appear in, and your messages — as plain JSON from Settings. Not a summary — the real thing, so you can actually check it.

Delete it. Also from Settings. This removes your profile, linked handles, messages and friendships, and takes you out of every group and league you’re in. Matches you played with other people stay — they belong to everyone who was in them, not just you — but your line comes out of each one. This can’t be undone, so export first if you want a copy.

Correct it. Most of what we hold you can edit directly — display name, username, profile visibility, linked accounts. If something’s wrong and you can’t fix it yourself, email us and we will.

Security

Passwords are hashed, never stored in plain text. Traffic to the app is encrypted in transit. No system is unbreakable, and if we ever have a breach that affects your data, we’ll tell you directly, not just post about it.

Children

Diffed isn’t directed at children under 13, and we don’t knowingly collect data from anyone under that age. If you believe a child has an account, contact us and we’ll remove it.

Changes to this policy

If this policy changes in a way that matters — especially anything about who we share data with — we’ll tell you before it takes effect, not bury it in a version bump.

Contact

Questions, corrections, or a request about your data: support@diffed.app.