Privacy Policy
Last updated: April 2026 · Operated by an independent developer based in Europe
1. Who we are

BountyWatch (bountywatch.org) is an independent community project operated by a private developer based in Europe. We are not a company. For data-related enquiries, contact us via the Contact us page.

2. What data we collect

Registered users: When you create an account we store your chosen display name, email address, and hashed password. If you register or link via Steam we store your Steam ID and publicly available Steam profile data (display name, avatar URL).

Player board entries: Steam usernames, Steam IDs, and publicly accessible Steam profile images sourced from the Steam public API. No private Steam data is collected.

User-generated content: Forum posts, comments, gallery submissions, and player submissions you create while logged in.

Visit tracking: We record a daily count of unique visitors using a one-way hashed (SHA-256) version of your IP address. The raw IP address is never stored. This hash cannot be reversed to identify you.

We do not collect: Real names, physical addresses, payment information, phone numbers, or any sensitive personal data as defined under GDPR Art. 9.

3. Legal basis for processing

Registered user data is processed on the basis of contract (Art. 6(1)(b) GDPR) — it is necessary to provide the account and service you signed up for.

Player board entries (Steam public data) are processed on the basis of legitimate interest (Art. 6(1)(f) GDPR) — the protection of the gaming community from reported cheaters and the recognition of good sportsmanship. Only publicly available data is used. See the full balancing test on our About page.

Visit tracking is processed on the basis of legitimate interest (Art. 6(1)(f) GDPR) — understanding site usage. No identifiable IP addresses are stored at any point.

4. Data retention

Account data is retained for as long as your account is active. If you wish to have your account and associated data deleted, contact us and we will action it promptly.

Player board entries are retained indefinitely as community documentation. Any individual listed may request removal at any time — see Section 6.

Hashed visitor logs are retained for up to 12 months for statistical purposes and then deleted.

5. Cookies

We use only a single strictly necessary session cookie to keep you logged in. This cookie contains no personal data, expires when you close your browser or log out, and does not require consent under GDPR or the ePrivacy Directive. We use no tracking cookies, advertising cookies, or third-party analytics.

6. Your rights

Under GDPR you have the following rights. To exercise any of them, contact us via the Contact us page. All requests are handled within 30 days.

  • Right of access (Art. 15): Request a copy of data we hold about you.
  • Right to erasure (Art. 17): Request deletion of your data. For player board entries, requests are reviewed and honoured unless there is a compelling legitimate interest to retain the record.
  • Right to object (Art. 21): Object to processing based on legitimate interest.
  • Right to rectification (Art. 16): Request correction of inaccurate data.
  • Right to restriction (Art. 18): Request that we restrict processing of your data while a dispute is resolved.
7. Dispute and takedown mechanism

If you are listed on this board and believe the entry is inaccurate, you may contact us to dispute it. We will review the submission and supporting evidence. Entries that cannot be substantiated will be removed. While a dispute is under review, you may request restriction of processing under Art. 18. Contact us via the Contact us page with your Steam name or profile URL.

8. Third-party services

Steam (Valve Corporation): We use the Steam public API to retrieve publicly available player data. Steam's own privacy policy applies to data on their platform.

Email delivery: We use an SMTP server to process contact form emails. We receive the email address and message content you submit via the contact form. No email content is retained beyond what is necessary to respond.

We do not sell, rent, or share your personal data with any other third parties.

9. Data security

All data is stored in a private database accessible only to the site operator. Passwords are hashed and never stored in plain text. The site is served over HTTPS. We take reasonable technical measures to protect data but cannot guarantee absolute security.

10. Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects when it was last updated. Continued use of the site after changes constitutes acceptance of the updated policy.

Not affiliated with Valve Corporation, Steam, Crytek, or any game developer. This is an independent fan community project. For any data protection enquiries contact us via the Contact us page.