Privacy Policy

1. Who we are

StatsGoblin ("the Service") is a market-intelligence dashboard for game-server owners, operated by Rayon Games, MB ("we", "us", "our"), a company registered in Lithuania (rayon.lt). This Privacy Policy explains what personal data we process when you use the Service, why we process it, and what rights you have in relation to it. Questions about this policy, and any requests concerning your personal data, can be sent to us through the contact page.

2. What we collect

We collect only the data the Service needs to operate:

• Account details received from your sign-in provider (Google or Discord): your email address, your name, your provider user ID, and your avatar URL;
• Choices you make in the product, such as your audience type and the selections you save in the dashboard;
• Alert configurations: the servers and criteria you choose to watch, together with the delivery destination you supply — a Discord webhook URL, a notification email address, or a phone number for SMS or other phone-based alert channels. Destinations are stored encrypted and shown to you masked;
• Billing status confirmed via Stripe; card numbers and other payment credentials are handled by Stripe and are never visible to us;
• Session records: the IP address and browser user-agent string of each sign-in, stored for security and abuse prevention;
• Usage measurement: the pages you visit, the links and buttons you click, and — where session recording is enabled — a recording of your pointer movements, clicks, and scrolling on the Service. These measurements are collected with a first-party analytics application that we self-host on our own infrastructure, and are aggregated; they never contain your account identifiers;
• Contact-form submissions: your name, email address, and message, together with the client IP address and user-agent at submission time.

3. Cookies and local storage

The Service uses an HttpOnly session cookie to keep you signed in, together with a small number of browser local-storage entries that remember your dashboard preferences and the changes you make in the product. All of them are strictly necessary for the Service to function, and they are exempt from consent accordingly.

We measure how the Service is used with a first-party analytics application that runs entirely on our own servers. It measures page views and, where session recording is enabled, interaction recordings covering pointer movement, clicks, and scrolling. Visits are identified on our servers, using a hash of your IP address, your browser's user-agent string, and a salt that rotates frequently — the raw IP and user-agent are discarded, and no cookie is placed. No advertising tracker and no third-party tracker participates, and the measurements never leave our infrastructure.

4. Legal bases

Our processing relies on the following bases under Article 6 of the GDPR: Article 6(1)(b) (performance of a contract) for your account and the dashboard features you use; Article 6(1)(c) (compliance with a legal obligation) for billing; and Article 6(1)(f) (legitimate interests) for the operational data needed to run the Service securely and reliably — session records and access/audit logging (incoming IP, URL, timing) in particular. Article 6(1)(f) (legitimate interests) likewise covers our audience measurement: measuring aggregated usage of the Service so we can maintain and improve it, run entirely on our own infrastructure and not shared with any third party. Article 6(1)(f) entitles you to object to that processing (see Section 7); contacting us through the contact page, or blocking the analytics scripts with a content blocker, is as effective as an objection.

5. Third parties

Google and Discord handle authentication when you sign in, Discord additionally receives the alert notifications we post to the webhook you provide, and Stripe handles payments; each processes your data under its own privacy policy in the course of providing that service. Notification emails are sent from our own infrastructure; phone-based alert channels are delivered through our messaging provider. We may also disclose data where required by law, regulation, or legal process, or to a successor entity in a merger, acquisition, or asset transfer. Analytics measurements are processed entirely on our own infrastructure — for them, no outside provider is in the processing chain at all. Because Google, Discord, and Stripe operate outside the EU/EEA, data you provide through them is transferred to their jurisdictions under those providers' standard safeguards. Beyond these providers, we do not sell or rent your data.

6. Retention

Account data — for example, your profile, selections, and alert configurations — is retained for as long as your account remains active; closing the account or an erasure request under Section 7 deletes it. Sessions expire after roughly 30 days of inactivity and are then removed. Contact-form submissions are kept while we handle your request and for our records thereafter, subject to the same erasure right. Billing records are retained for the period required by the legal duties that apply to them, and browser storage items persist until you sign out or clear your browser data.

7. Your rights

You may request access to your personal data, its rectification or erasure, data portability, and the restriction of its processing. You may object to processing — including specifically the audience-measurement processing described in Sections 3 and 4, and you may request that recordings associated with your visits be deleted. You may withdraw consent where, exceptionally, consent is the basis relied on, and lodge a complaint with a competent supervisory authority. Any of these rights can be exercised through the contact page, and we will respond within the timeframe the law requires.

8. Security

All traffic to the Service is protected with HTTPS. Authentication is delegated to Google or Discord, which means no password is ever stored by us. Your session lives in an HttpOnly first-party cookie, so it cannot be read by client-side scripts.

9. Children

The Service is not directed at persons under the age of 16, and we do not knowingly collect their data. If we learn that such data has been collected, we will delete it.

10. Changes to this policy

Material changes to this policy will be published on this page, identified by a new "Last updated" date. We will not reduce your rights under this policy without your consent, and the facts of what we collect and why will not change without being reflected here.