Legal

PRIVACY POLICY

What Leafstats collects, why, who else handles it, and how you can see it, correct it or have it removed.

Last updated: 14 October 2026

The short version

You can read most of Leafstats without an account. An account stores the username and email you give us, a scrambled copy of your password, and the region, time zone and country you choose.
There are no ads, no tracking cookies and no analytics on the site, and we do not sell or rent anyone's data.
The site also shows public competitive data about players, teams and casters: in-game names, match results, team rosters, and in some places photos and social links. If that is you and you want something changed or gone, tell me and I will do it.
Your data is kept on servers in Ireland (EU). Every visit to the site passes through Cloudflare, which delivers and protects it, and the confirmation and password-reset emails are sent by Amazon SES (see who else handles your data).

1. Who is responsible

Leafstats (www.leafstats.net) is run by Plantyse, an individual in the European Union. Plantyse decides what data is collected and how it is used, which makes Plantyse the "controller" under the GDPR.

For anything about this policy or your data, use the contact form. For a removal or data request, choose the topic "Remove a photo / my data".

2. What we collect

If you create an account

Your username and email address. The email is not shown to anyone. It is used to confirm your address and to reset a forgotten password.
Your password, stored only as a one-way scrambled copy (a hash). We cannot read it.
The region, subregion, time zone, country and language you choose, and optional links to your social media profiles if you add them.
Your role on the site and the team you are linked to, if any (set by an administrator for team accounts).
What you follow (players and teams) and the notifications that result, which are shown on the site only. The Following page can also give you a private calendar link that lists the events your follows are entered in; it contains no password, so anyone who has the link can see that list, and you should not share it.
The time of your last sign-in.

If you send a message

The contact form stores your name, email address, topic and message, and forwards them to my mailbox so I can reply.

When you just visit

Like every website, our server receives your IP address and basic browser details when a page is requested. They are used to deliver the site, limit abuse (for example too many login attempts) and keep it secure. They are not used to profile you or to track you across other sites.

Every request to Leafstats goes through Cloudflare, a content delivery and security service that sits in front of our server. Cloudflare therefore sees your IP address, the page you ask for and your browser details, keeps copies of the site's pictures, styles and scripts closer to visitors, and filters out attacks and bots. It passes your IP address on to our server so that abuse limits work. Cloudflare handles this data under its own privacy policy.

Visitor counts. To see which pages are used, the server keeps simple daily totals: how many times each page was opened, roughly how many different visitors there were, and from which country and in which browser language. To count a visitor only once a day, a short-lived code is made from your IP address and browser details together with a secret that is replaced every day. The code is kept in the server's memory only, never written to the database, and is gone when the day ends. No IP address, cookie or profile is stored, nothing follows you from one day to the next, and nobody can look up what you personally viewed. Visits with the "Do Not Track" or "Global Privacy Control" signal switched on are not counted at all.

3. Why we use it

What	Purpose	Legal basis (GDPR)
Account data	Creating your account, signing you in, showing times in your time zone, sending the confirmation and password-reset emails, following teams	Needed to provide the service you asked for (Art. 6(1)(b))
Contact messages	Reading and answering your message	Needed to respond to your request, and my legitimate interest in answering (Art. 6(1)(b) and (f))
IP address and technical data (including what Cloudflare sees)	Delivering the site, security, preventing abuse	Legitimate interest in running a secure site (Art. 6(1)(f))
Anonymous daily visitor totals	Seeing which pages and languages are used, so the site can be improved	Legitimate interest in understanding and improving the site (Art. 6(1)(f)); nothing personal is stored and Do Not Track is honoured
Public competitive data	Showing esports statistics, rosters and results	Legitimate interest in providing public esports statistics (Art. 6(1)(f)); you can object, see below
Photos and social links of players and casters	Showing who they are on their pages	Consent or permission from the person, or the person's own upload (Art. 6(1)(a)); you can withdraw it at any time

We do not use your data for advertising and we do not make automated decisions about you that have legal or similarly significant effects.

4. Public competitive data and photos

Leafstats is an analytics site for competitive Brawl Stars. To do that it shows data about people who play or cast, whether or not they have an account here:

Match data collected from Supercell's official Brawl Stars API for the players on the teams we cover: in-game name, player tag, the brawlers they picked, and the results of their battles.
Tournament data from public Matcherino pages: team and player names, brackets and results.
Information entered by the site administrator: team rosters, which team a player plays for, ratings calculated from the results, casters' names, and where available photos and links to public social media profiles.

I only add photos that I am allowed to show. If a photo or any other detail about you is on the site and you would like it removed, corrected or hidden, send a message. You do not need to give a reason and it is free. I will take it down quickly and confirm by email. If you are a photographer or the owner of a photo, the same route applies.

Statistics that come from public game results (for example a win rate) cannot always be separated from the player they belong to, but I will do what is reasonably possible, including hiding a name or removing a profile page.

5. Cookies and browser storage

Leafstats uses only what the site needs to work, so there is no cookie banner and nothing to accept:

A sign-in cookie (plantyse.sid), set when you log in. It keeps you signed in for up to 7 days or until you log out. It is first-party, "HttpOnly" (scripts on the page cannot read it) and is not used for tracking.
Browser storage (localStorage) for settings such as your time zone and display preferences. It stays in your browser. You can clear it in your browser settings.

There are no advertising, analytics or social media tracking cookies or scripts. Cloudflare, which delivers the site (see section 6), may set a small technical security cookie of its own, for example to tell real visitors from automated traffic. It is not used for advertising or to follow you between sites.

One thing to know: the pages load their fonts from Google Fonts. When your browser fetches a font, Google receives your IP address. Nothing else is sent. If you prefer, you can block Google Fonts in your browser and the site will still work with fallback fonts.

6. Who else handles your data

I do not sell or rent data. These companies process it on my behalf so the site can run:

Provider	What for	Where
Amazon Web Services (Lightsail)	Runs the website and the server that fetches the game data	Ireland (eu-west-1)
Supabase	The database: accounts, messages and all the site's data	Ireland (eu-west-1)
Cloudflare, Inc.	Sits in front of the whole site: delivers pages, pictures and files from a data centre near the visitor, and protects against attacks and abuse. It sees the IP address and the requests of every visitor	Its worldwide network (the data centre nearest the visitor)
Amazon SES	Sending the confirmation and password-reset emails (it receives the recipient's email address and the message)	Ireland (eu-west-1)
Discord Inc.	Only if a team's staff connect a Discord channel on the Team Schedule page: the site then posts that team's schedule (event names and times) and reminders to the channel through its webhook. The webhook address is stored on our server	Discord's network (United States)
Google (Gmail)	Receives the messages sent through the contact form	Google's mail infrastructure
Google Fonts	The fonts used by the pages (see section 5)	Google's network

Supercell's Brawl Stars API and Matcherino are sources of public data we read; your account details are never sent to them. I will also disclose data if the law requires it.

7. Transfers outside the EU

Our servers and database are in the EU. Cloudflare delivers the site from the data centre nearest each visitor, so a request may be handled by a data centre outside the EU, and Cloudflare and some of the other companies above are part of groups based in the United States, so their staff or systems may in limited cases handle data from there. In those cases the transfer relies on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses, which are the safeguards the GDPR provides for this.

8. How long we keep it

Account data: until you ask for the account to be deleted, or I remove accounts that are inactive for a long time.
Sign-in sessions: expire after 7 days. Email confirmation and password-reset links expire shortly after they are sent.
Contact messages: until your question is answered and for a reasonable time afterwards, normally no longer than 12 months.
Server and security logs: a short time, only as long as needed to keep the site secure. Cloudflare keeps its own request and security logs for the periods stated in its privacy policy.
Public competitive data: while it is relevant to the statistics shown, or until you ask for it to be removed.

Backups, where they exist, are overwritten in the normal course and can briefly hold data that has already been deleted from the live site.

9. Your rights

Under the GDPR, you can ask me to:

show you the data I hold about you and give you a copy;
correct data that is wrong;
delete your data, including your account;
restrict how it is used while a problem is sorted out;
give it to you in a portable format;
stop using it if I rely on legitimate interest (you can object), and withdraw consent at any time where I rely on consent.

There is no self-service button for these yet. Send the request through the contact form using the same email address as your account, so I can check it is you. I will reply within one month, and usually much sooner.

If you think I have handled your data wrongly, you can also complain to a data protection authority, in particular the one in the country where you live or work. For Bulgaria, this is the Commission for Personal Data Protection (cpdp.bg). I would appreciate the chance to fix it first.

10. Young people

Many competitive players are teenagers, and that is fine, but you should be at least 14 years old, or the age at which you can agree to online services in your country, to create an account. If you are younger, please ask a parent or guardian to do it with you. If you think a child has given us data without permission, contact me and I will delete it.

11. Security

The site is served over HTTPS, passwords are stored as hashes, the database's public web access is switched off, so its data is only read through the site's own server, and access to private tools depends on your role. No system is perfectly secure. If a breach affects your data in a way that puts you at risk, I will tell you and the authorities as the law requires.

12. Changes to this policy

If I change what Leafstats collects or how it uses data, I will update this page and the date at the top. For a significant change I will also tell account holders by email or on the site.