SCWA Privacy Policy
SCWA (Stalzone Clan Wars Analytics), also called SCA, is a free, fan-made analytics service for STALZONE clans. It is not affiliated with EXBO, STALZONE or Discord. This is the English version for users in the EU/EEA, the UK, the US and elsewhere. The Russian version describes the same practices.
Last updated: September 24, 2026
1. The short version
- We collect only what the service needs to work: your sign-in details, your game characters and clan, and game statistics.
- We do not sell your data, do not share it for advertising, show no ads, and use no trackers or third-party analytics.
- Cookies are used only to keep you signed in.
- You can ask for a copy of your data or for its deletion at any time — see section 8.
2. Who we are
The service is run by its administration (the “Administration”, “we”), who acts as the data controller.
Contact: support@scwa.ru · ticket system at scwa.ru/support · community server discord.gg/uS4sbeYdyp.
3. What we collect
Account and sign-in
- Username and password: your login and an irreversible password hash (we never see or store the password itself).
- Discord sign-in: Discord ID, username and avatar URL.
- EXBO sign-in (STALZONE): your game characters, clan name and ID, clan rank, and the clan member list (in-game nicknames). The EXBO access token is stored encrypted.
Game statistics
- From screenshots you upload: in-game nicknames and match results (kills, deaths, assists, score). The images themselves are deleted after processing, within 10 minutes at most.
- From the official STALZONE API: public profile counters of members of clans that use the service (for example grenades thrown, kills, deaths, matches played in different modes). This is the same information anyone can see in the game. It is collected during clan wars and once a day otherwise, including for clan members who do not use the service themselves — see section 5.
What you choose to provide
- Equipment loadouts and who can see your profile (“only me”, “clan”, “everyone”).
- Settings such as language and bot output style.
- Support tickets and their attachments.
Donations (optional): transaction ID, amount, date, status, and the email address you enter for the receipt. Card details are handled by the payment provider — we never receive them.
Technical data
- For each signed-in session: sign-in method, browser and operating system (User-Agent), IP address and last activity time. You can see and end any session in your account under “Active sessions”.
- Request timestamps and error logs; IP addresses for rate limiting and abuse protection.
- Administrator action logs and ban records.
4. Why we use it
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Providing the service: sign-in, clan membership checks, statistics, access rights | Performance of a contract (Art. 6(1)(b)) |
| Clan analytics based on public game statistics of clan members | Legitimate interests of the clan and its members (Art. 6(1)(f)) |
| Security: sessions, rate limiting, abuse prevention, admin logs | Legitimate interests (Art. 6(1)(f)) |
| Donation records and receipts | Legal obligation (Art. 6(1)(c)) |
| Improving recognition of screenshots (on aggregated data) | Legitimate interests (Art. 6(1)(f)) |
We make no automated decisions that produce legal or similarly significant effects on you. Statistics are shown to your clan; what the clan does with them is up to the clan.
5. Clan members who do not use the service
Clan leaders connect their clan to get analytics, and that includes public game statistics of every clan member. We collect nothing but in-game data about them — no names, contacts or accounts. If you are such a member and want your statistics removed, write to support with your in-game nickname; we will delete them and stop collecting them.
6. Who we share it with
We do not sell or rent personal data and do not “share” it for cross-context behavioural advertising (as defined by the CCPA/CPRA). Data is passed only to:
- the hosting provider, to run the service;
- the payment provider (YooKassa), only when you make a donation;
- authorities, only when legally required.
What you publish yourself (for example a profile set to “everyone”) is visible to other users.
7. Where it is stored
Our main servers, where your data is stored and processed, are located in Finland (EU). Screenshot recognition mostly runs on servers in Russia: only the image is sent there, and it is not kept after processing. Donations are processed in Russia by the payment provider. These transfers outside the EU are necessary to provide the features you request — recognising the screenshot you upload, carrying out the donation you make (GDPR Art. 49(1)(b)).
8. Your rights
Wherever you live, you can:
- access your data and get a copy in a machine-readable format;
- correct inaccurate data;
- delete your data and account;
- object to or restrict processing based on legitimate interests;
- withdraw consent where processing is based on it.
Some of this you can do yourself in your account: end sessions on other devices, unlink sign-in methods, hide your profile. For everything else, write to support@scwa.ru or open a ticket. We respond within 30 days (usually within 7 working days), free of charge, and may ask you to confirm the request comes from you.
EU/EEA and UK users may also lodge a complaint with their local data protection authority.
California and other US state residents: you have the right to know, delete and correct your personal information and to not be discriminated against for exercising these rights. We do not sell or share personal information, so there is nothing to opt out of.
9. How long we keep it
| Data | Kept for |
|---|---|
| Uploaded screenshots | Until processed (10 minutes at most) |
| Match statistics from screenshots | 90 days, then deleted automatically |
| Public profile statistics (scanner) | While the clan is connected, or until you ask us to delete it |
| Account, loadouts, settings, password hash | Until you delete your account |
| EXBO / Discord tokens | Until you unlink them or they expire |
| Sign-in sessions | Until you sign out, end them, or after 14 days of inactivity |
| Support tickets | As long as needed to resolve the request |
| Administrator logs | 90 days |
| Ban records | Up to 3 years |
| Donation records | 3 years (accounting requirements) |
10. Security
Encrypted OAuth tokens; password hashes with a brute-force-resistant algorithm; HTTPS everywhere; sessions stored server-side with an HttpOnly, Secure cookie and CSRF protection; parameterised database queries; rate limiting, stricter for sign-in attempts; restricted server access. If a breach affects your data, we will notify you without undue delay and, where required, the supervisory authority within 72 hours.
11. Cookies
We use only strictly necessary cookies: a session cookie (a random identifier) and a CSRF-protection cookie. No advertising, analytics or tracking cookies, so no consent banner is needed. The documentation site sets no cookies.
12. Children
The service is intended for users aged 14 and over. In the EU/EEA, if you are under the age of digital consent in your country (13–16), you need a parent’s or guardian’s permission. We do not knowingly collect data from children under 13; if you believe we have, contact us and we will delete it.
13. Changes
The current version is always at docs.scwa.ru/en/privacy. We announce significant changes through service notifications or our Discord server.
© SCWA, 2026