Favourites, search history, preferences (theme/language/region) and cookie consent. Stored only in your browser via localStorage — never sent to our servers.

Kept in the application's memory for up to 2 minutes for rate limiting, never shared with third parties. For daily visitor counts, only a truncated non-reversible hash (HMAC keyed with a secret salt) is stored — never the IP itself.

Separately, our web server (nginx) logs each request — IP address, page requested, time, referring page and browser identifier (user agent) — and keeps these logs 14 days, for security and diagnostics.

We count page views and daily unique visitors to operate the site. Counts are aggregated per day (no individual browsing profile), the hashing salt rotates every day (no cross-day correlation), and everything is deleted after 90 days.

Brawlhalla API responses are cached for 5 to 15 minutes to speed up the site, then kept for about 6 more hours to answer if the API is unavailable. dair.gg data (legend XP and levels, clan) is cached for 2 to 6 hours; for profiles fetched by NexHalla, each legend's XP and level and the player's clan are kept with no time limit, for the legend XP rankings and clan lists.

Brawlhalla usernames seen when viewing profiles are stored to display name history.

By comparing the public ranked leaderboards every few hours, we note the last day we saw each player play ranked (kept with no time limit) and how many ranked matches we saw per day (kept 60 days).

On profiles fetched by NexHalla: when each legend's game count changed (deleted 60 days after the profile was last fetched).

Ranked 1v1 ELO history (top 1000 and profiles viewed here): kept 90 days.

If you create an account, we store your email, a one-way argon2id hash of your password (never the password itself), your login sessions, and a non-reversible hash of your IP for security auditing. Data is kept until you delete your account; sessions expire automatically. Verification emails are sent via a third-party SMTP relay. This data is never sold or shared.

With each login session we also keep your browser identifier (user agent, as your browser sends it), for the same security auditing. It is deleted with the session: when you sign out, or at the first daily purge after the session expires (30 days after its last use).

We also keep the date your account was created, whether your email is verified, and the dates of your last sign-in and of your last password change (each replaced by the next one), until you delete your account.

If you generate a token for the desktop app, we keep a non-reversible hash of it (never the token itself), its name, the date it was created and the date it was last used. A revoked token stays in your list, marked as revoked, until you delete your account; only your 20 most recent tokens are kept.

If you link your Brawlhalla profile (My Profile), we keep its ID and name on your account: they are replaced when you link another profile and deleted with your account.

We also store your optional profile customisation — a nickname and a chosen legend avatar (an identifier only; no image is uploaded) — so it appears on your account across devices.

If you post a Looking For Teammate ad, its content — your Discord handle and the text you write — is public on the LFT board, with a link to your Brawlhalla profile. It is included in your data export, is deleted with your account, and expires automatically after 30 days.