Stored only in this browser (localStorage), never sent to our servers. Whatever you choose in the storage banner, we keep: that choice, your theme and language, the region you pick on the rankings, the profile you set as My Profile, the email of a sign-up awaiting verification, and a copy of your favourites (adding favourites requires an account; they are saved to it — see Account data). Only if you accept: the players you opened recently (search history), the last page you visited, reopened if you come back within an hour, and a cache of data already loaded — news (2 hours), legend and weapon statistics (15 minutes), the size of the rankings (30 minutes) and player portraits (no expiry). Until you choose, none of these is stored: the site behaves as with “Essential only”, which also deletes them from this browser. Separately, the browser's offline cache keeps the site's shell — styles, scripts, the interface images already displayed (legends, weapons, ranks) and the home page — whatever you choose; no page you visit, such as a profile, is ever kept in it.

Kept in the application's memory for up to 2 minutes for rate limiting, never shared with third parties. For daily visitor counts, only a truncated non-reversible hash (HMAC keyed with a secret salt) is stored — never the IP itself.

Separately, our web server (nginx) logs each request — IP address, page requested, time, referring page and browser identifier (user agent) — and keeps these logs 14 days, for security and diagnostics.

We count page views and daily unique visitors to operate the site. Counts are aggregated per day (no individual browsing profile), the hashing salt rotates every day (no cross-day correlation), and everything is deleted after 90 days.

Brawlhalla API responses are cached for 5 to 15 minutes to speed up the site, then kept for about 6 more hours to answer if the API is unavailable. dair.gg data (legend XP and levels, clan) is cached for 2 to 6 hours; for profiles fetched by NexHalla, each legend's XP and level and the player's clan are kept with no time limit, for the legend XP rankings and clan lists.

Brawlhalla usernames seen when viewing profiles are stored to display name history.

By comparing the public ranked leaderboards every few hours, we note the last day we saw each player play ranked (kept with no time limit) and how many ranked matches we saw per day (kept 60 days).

On profiles fetched by NexHalla: when each legend's game count changed (deleted 60 days after the profile was last fetched).

Ranked 1v1 ELO history (top 1000 and profiles viewed here): kept 90 days.

If you create an account, we store your email, a one-way argon2id hash of your password (never the password itself), your login sessions, and a non-reversible hash of your IP for security auditing. Data is kept until you delete your account; sessions expire automatically. Verification emails are sent via a third-party SMTP relay. This data is never sold or shared.

Signing in sets one cookie, nh_sess. It holds a random session identifier, its expiry date and a signature — no email, no name. The page's scripts cannot read it (HttpOnly) and it travels only over HTTPS (Secure). It lasts 30 days and is renewed for 30 days when you use the site with less than 15 days left; it is deleted when you sign out. A visitor who does not sign in receives no cookie. A second cookie, nh_ops, is set only for the site administrator, on a private dashboard, for 12 hours.

With each login session we also keep your browser identifier (user agent, as your browser sends it), for the same security auditing. It is deleted with the session: when you sign out, or at the first daily purge after the session expires (30 days after its last use).

We also keep the date your account was created, whether your email is verified, and the dates of your last sign-in and of your last password change (each replaced by the next one), until you delete your account.

If you generate a token for the desktop app, we keep a non-reversible hash of it (never the token itself), its name, the date it was created and the date it was last used. A revoked token stays in your list, marked as revoked, until you delete your account; only your 20 most recent tokens are kept.

If you link your Brawlhalla profile (My Profile), we keep its ID and name on your account: they are replaced when you link another profile and deleted with your account.

If you play the mini-games while signed in, we keep, for each game, your current and best streak, the game in progress and the dates of your last games, until you delete your account. The mini-game leaderboards publicly show the 20 best streaks with your username (or, if you have none, the name of your linked Brawlhalla profile).

We also store your optional profile customisation — a nickname and a chosen legend avatar (an identifier only; no image is uploaded) — so it appears on your account across devices.

If you post a Looking For Teammate ad, its content — your Discord handle and the text you write — is public on the LFT board, with a link to your Brawlhalla profile. It is included in your data export, is deleted with your account, and expires automatically after 30 days.