On this page
- The short version
- 1. Who we are
- 2. What we collect
- 3. How we use it
- 4. Automatic screenshot reading and AI
- 5. Who we share it with
- 6. What's public, and when
- 7. Your choices
- 8. Deleting your account
- 9. People who appear in box scores without an account
- 10. How long we keep things
- 11. Age
- 12. Security
- 13. Where your data is processed
- 14. Your rights
- 15. How to reach OVRWire about privacy
- 16. Cookies and similar technology
- 17. Changes to this policy
Updated October 20, 2026
The short version
- You sign in with Discord. We get your Discord ID, username, display name and avatar. Signing in doesn't give us your email, password, servers, friends or messages. If you choose to preview your league from one of your servers, Discord asks you first, and we keep only that server's name and icon, for 7 days.
- A league can connect its Discord server to the OVRWire bot. If it does, the bot reads new messages only in the channel the league picks for box scores and in the game threads it starts, to pick up screenshots, plus any message a member sends to OVRWire with "Send to OVRWire". It keeps the images, not the text of messages.
- Leagues are private while they're being set up. Once a season goes live, its stats are public, and your gamertag is your public name there. Your Discord name and avatar stay off public pages unless you choose to show them.
- Completed seasons stay public as an archive.
- Box-score screenshots are read automatically by AI services so you don't have to type the numbers. They get the image and fixed instructions, never names as text. Google's Gemini API reads most of them on its free tier, and Google may use what it reads to improve its products. When we can tell a screenshot comes from the European Economic Area, the UK or Switzerland, only Cloudflare reads it. Section 4 lists the services and what they keep. AI-written recaps never receive anyone's name.
- Link (Stripe) handles payments. We never see or store your card number.
- Bots your league connects can read league data, but OVRWire never gives them your Discord ID, username or avatar. A bot can't send a box score for you until you allow it once, and you can stop it at any time.
- We count page views and setup steps to see where people get stuck. That counting uses no cookies, never records your screen, and can't follow you to other websites.
- We don't sell your data for money, and we don't use it for ads. The screenshot reading above is the one place a provider may use what it receives for its own products.
- You can opt out of the cross-league player search, hide your name on public pages, get a copy of your data, and delete your account.
1. Who we are
OVRWire is run by OVRWire LLC, 3942 South Parkcrest, Springfield, Missouri 65807. For data protection law, OVRWire LLC is the "controller" of the personal information described here. You can reach us at hello@ovrwire.com, and about privacy at legal@ovrwire.com (section 15).
This policy covers the OVRWire website and app (ovrwire.com, its subdomains and the league pages on them), the OVRWire Discord bot, the OVRWire API and the update notices it sends to other bots, the help center and the support inbox.
2. What we collect
2.1 From Discord, when you sign in
We ask Discord only for basic profile access (the identify permission). Discord sends us:
- your Discord user ID, username, display name and avatar;
- whether two-factor sign-in is turned on for your account;
- the date your Discord account was created, which is built into your Discord ID (we use it to slow down brand-new accounts that create leagues).
We also keep the sign-in tokens Discord gives us. They allow only the basic profile access above. Signing in doesn't give us your email address, phone number, password, server list, friends or messages. Section 2.6 explains what the bot sees in a league's server.
If you preview your league from a server (optional). On "See your league", you can choose to pick one of your Discord servers. Only then do we ask Discord for one more permission (the guilds permission), and Discord shows you that request before anything is shared. It lets us see the names and icons of the servers you're in, so you can pick one. We keep only the name and icon of the server you pick, attached to your private preview, and delete them with the preview after 7 days. We don't keep the rest of the list, and this permission doesn't let us read messages, members or channels. OVRWire doesn't send you email. The only exceptions are answers to mail you send to hello@ovrwire.com or legal@ovrwire.com: one automatic reply, and a reply from a person if you wrote about a legal, privacy or billing matter.
One optional feature asks Discord for one more permission, and only when you tap it:
- Also join the league's Discord. When you accept a team invite, you can let OVRWire add you to the league's server with your team role. We use that permission only for that one step, and don't keep it afterwards.
2.2 Your OVRWire profile
- Gamertags (one per platform), former gamertags, platform and positions.
- Your MyPLAYER build details per 2K edition (positions, height, archetype, OVR), plus a build screenshot if a league requires one.
- Your weekly availability, time zone and display settings.
- Your privacy and notification settings.
- When you accepted the Terms, and which version. This is also your confirmation that you are 18 or older.
2.3 League activity
- League memberships and roles, team claims, applications, and your consent when you join a free-agent or draft pool.
- Rosters, games, box scores, stats, check-ins, forfeit claims, reschedule requests, disputes, rulings and corrections, whether you act on the website or with a button in Discord.
- In franchise leagues: contracts, trades, offers, waiver claims, releases, draft picks and draft queues.
- Award votes. Ballots stay private; only the totals are shown.
- The league log, a public record of commissioner actions with the actor, role and reason.
- Reports you file about names, images or conduct.
2.4 Screenshots and images
Box-score screenshots (uploaded on the website, sent through the bot, posted in your league's box-score channel, or sent by a bot your league connects, including a second screenshot after a game restart), dispute evidence, team and league logos, MyPLAYER build screenshots and screenshots attached to a bug report.
We remove location and other hidden metadata from every image. Screenshots still show whatever was on the screen: every player's gamertag in that game, and sometimes notifications or party chat. The upload screen lets you crop those out first.
Logos. A logo is cleaned up on your own device before it's uploaded: trimmed, a plain background removed, and resized. We keep the cleaned logo and the original file you picked, so it can be processed again later. If a commissioner taps "Use your server icon as the league logo", we copy the Discord server's icon.
2.5 People who haven't signed up
Box scores list everyone who played, including people with no OVRWire account. Commissioners and team captains can also add players by gamertag, and commissioners can import past seasons. So we hold some information about people who never signed up:
- gamertags as read from screenshots, typed in, or imported;
- their stats in that league;
- for leagues that moved from OVRWire's earlier version, their history from it, such as gamertags, results and stats. Links between gamertags and Discord accounts from the earlier version aren't brought over.
These players can claim their profile (section 9) and then use every privacy setting described here. They can also send a request (section 15). If you used OVRWire's earlier version, this policy replaces its privacy page.
2.6 Your league's Discord server and the bot
A league doesn't need the OVRWire bot to set up or to go live. When a league connects its Discord server, we receive and keep:
- the server's ID, name and icon;
- the server's channels and roles (their names, order and permissions), which OVRWire reads when it needs them, to suggest which ones to use and to check what the bot is allowed to do. It keeps only the ones in the next item;
- the channels and roles the league chooses, and which ones OVRWire created, so "Remove everything OVRWire added" removes exactly those;
- whether the bot's permissions still work, so we can tell the commissioner what to fix;
- for the league's own members: their roles and nickname in that server, looked up one person at a time, so OVRWire can give out and take back team roles as rosters change. OVRWire can't list everyone in a server;
- for each command or button you use in Discord (such as
/submit,/standings, "Send to OVRWire" or Confirm): your Discord ID, the server and channel, any images you attach, and any short note you add (up to 200 characters, shown to the other team and league staff); for "Send to OVRWire", also the images in the message you picked and who posted it; - the IDs of messages the bot posts and threads it starts, so it can edit or archive them later (for example, when a result is corrected).
Picking up box scores. In the one channel your league picks for box scores, and in the game threads OVRWire starts (for 72 hours after it starts each one), the bot reads new messages to find box-score screenshots. For each screenshot it keeps a copy of the image, who posted it and when, under the same rules as screenshots you upload, and it adds a reaction (👀, ✅ or ⚠️) so you can see it was picked up. It doesn't keep the text of messages, and it doesn't read any other channel or any message posted before the league connected. If you post a screenshot before signing in to OVRWire, the bot doesn't copy the image or record who posted it: it keeps only the message's ID and when it was posted, so it doesn't reply to you twice. If Discord ever stops OVRWire reading messages there, it reads only messages that mention @OVRWire. Members can also send OVRWire a screenshot from another channel with "Send to OVRWire".
Other things the bot does there:
- Nicknames. If your league turns on nickname sync, the bot sets your nickname in that server to your gamertag and team tag, for example "KeyHolder_ | NS". It never changes the nickname of the server's owner or of anyone whose role is above OVRWire's.
- Pickup games. If your server uses OVRWire pickup games, we also process check-ins, the voice rooms the bot creates, and which players it moves between rooms.
2.7 Payments
Link (Stripe) runs checkout and collects your name, email address, billing address and payment details. Link is the seller, so what you give it at checkout is covered by Link's own privacy policy. Stripe sends us a record of the payment. We keep only the Stripe payment IDs, the amount, currency and tax, the status, the dates, the link to Link's receipt, the league and season, and which league member paid. We never see or store your full card number, and we don't keep the payer's email address. If you use the refund screens, we keep the reason you picked (if any) and the choice you made, to learn which offers help.
2.8 Device and usage information
Sessions. A sign-in cookie, plus the IP address and browser type (user agent) recorded with your session.
Logs. Server logs record requests, errors and which league or role was involved. OVRWire's own log lines leave out sign-in tokens, cookies, Discord usernames and IP addresses.
Cloudflare request logs. Cloudflare's Workers Logs keep a record of each request to OVRWire (the page address, time, status and request details, which can include your IP address) for about 7 days, to debug errors.
Errors. Crash and error reports, with personal details turned off and Discord IDs scrambled (hashed).
Analytics. We count visits and setup steps so we can see where people get stuck and make setup quicker. Two services do the counting, with a small script on our pages:
- Cloudflare Web Analytics counts page views: the page address (never the part after a
?), the site that sent you, your browser and rough device type (phone, tablet or computer), your country, and how fast the page loaded. - PostHog receives selected sign-in and setup events (for example "league created" or "invites sent"), how long setup took, step counts and fixed status values. What OVRWire sends it doesn't contain page addresses, your Discord details, anything you type, your browser or your screen size. Like any web service, PostHog also receives the network information needed to handle a request; its policy describes how it handles that.
Neither one sets a cookie or stores anything on your device. In your browser, PostHog events carry a random number held only in that page's memory, so it's forgotten when you close or reload the page; events from our servers each get a fresh random number. Nothing links one visit to the next or identifies you on other websites, and we don't create a PostHog profile for you. We don't record your screen or your sessions. We don't sell what's counted or use it for ads.
- Cloudflare Web Analytics counts page views: the page address (never the part after a
Bot checks. Cloudflare Turnstile checks some actions (checkout, a brand-new account's first league, signed-out reports) to stop bots.
Phone notifications. If you turn them on, we store your browser's push address and keys.
2.9 Reports and support messages
- Report a problem: your summary and details, an optional screenshot, and diagnostics we tell you about first: app version, the page address, the league, browser family, screen size, and recent error and request IDs. Bug reports are posted in the OVRWire Community Discord so others can follow them, with the summary, details, page and app version. If your league is private, the post doesn't name it or show its page address, and posts never include your diagnostics. Don't put personal information in a report.
- Private requests (Account → Privacy and data → Send a private request): the request type, your details and the account that sent it. Private requests are never posted publicly.
- Email to hello@ovrwire.com or legal@ovrwire.com: an automatic reply goes out at once. For every message we store the subject, a category (such as legal, privacy or billing) and a scrambled version of your address. For legal, privacy and billing messages we also keep the message text and your address, encrypted, so a person can act on it and reply. We delete them 90 days after your request is closed.
3. How we use it
- To run your account and your leagues: sign-in, rosters, schedules, results, standings, playoffs, drafts and franchise moves.
- To run your league's Discord features, when the league connects a server: posts, live standings, game threads, team roles and picking up box scores.
- To read screenshots so nobody has to type every number (section 4), to check the math, and to match each line to the right player.
- To publish league pages once a season goes live (section 6).
- To notify you in the app, by Discord DM, by phone notification and in league channels, following your settings.
- To make share cards, recaps and awards, and to calculate Impact ratings from official stats.
- To take payments and refunds through Link.
- To send league data to bots your league connects (section 5).
- To keep things safe and fair: rate limits, bot checks, abuse reports, duplicate-screenshot checks, and enforcing the Terms.
- To measure and improve accuracy. Confirmed games become a private test set that we use only to measure and improve OVRWire's own screenshot reader (section 4.3).
- To improve the product, using aggregate analytics.
- To meet legal duties, such as tax records and valid legal requests.
4. Automatic screenshot reading and AI
4.1 What gets sent, and where
When a box score comes in, by upload, through the bot, or picked up from your league's box-score channel, OVRWire sends the image, with its hidden metadata removed, to AI vision services. Two separate reads, by two different models, check each other. With the image go only fixed instructions: no names, team names or messages. The image itself shows whatever is on screen, including gamertags. OVRWire matches each line to a player on its own servers after the read. We use the providers' free tiers, so reading has daily limits: when they're used up, the read waits for the next reset or you can type the numbers in. The current providers:
| Provider | Used for | What they say they do with it |
|---|---|---|
| Google Gemini API (free tier) | Both reads of most screenshots | On its free tier, Google says it may use what we send and what it returns to provide, improve and develop Google's products and machine-learning technology, and that human reviewers may read it after it's separated from our account. Google's terms say not to submit sensitive, confidential or personal information to its free tier. A box score shows gamertags and game stats, so read this before you post one. |
| Cloudflare Workers AI | Screenshots we can tell come from the European Economic Area, the UK or Switzerland; screenshots from anyone who hasn't accepted the current Terms; any screenshot when Gemini's free daily limit is used up or Gemini is unavailable; recaps; trade notes | Cloudflare says it doesn't use customer content to train models or to improve its services. |
We don't send Gemini a screenshot when we can tell it comes from the European Economic Area (the EU, Iceland, Liechtenstein and Norway), the UK or Switzerland. We go by the country our servers see on requests from you or your league's staff, and by the language your Discord app or your league's Discord server is set to. If any of these points there, only Cloudflare reads the screenshot. We can't always tell where someone is, so this isn't a guarantee. We also don't send Gemini a screenshot from anyone who hasn't accepted the current Terms.
Workers AI runs inside Cloudflare. OVRWire calls the Gemini API directly over an encrypted connection. Neither call goes through a caching service.
We list a new provider here before it receives any personal information.
4.2 Reading is only a starting point
The reader's output only pre-fills the form. On the website, the person who submits checks the numbers first. A clean read of a screenshot posted in your league's box-score channel, or sent by a connected bot you've allowed, goes to the other team without that step. It doesn't become official until a person has looked at the numbers: the other team confirms it, the person who posted it taps Looks right, or your commissioner rules. If nobody does within 24 hours, your commissioner checks it. A screenshot a bot sends for you before you've allowed that bot isn't read at all unless you tap Send (section 5). If reading fails or the free capacity runs out, the read waits for the next free reset or you type the numbers in. OVRWire staff don't look at your screenshots as part of running the service.
4.3 The accuracy set
Once a game is official, its screenshot (the compressed copy) and its official stats join a private set that OVRWire uses only to measure and improve its own reader. The accuracy set is never sold and never used in demos. Apart from the reading in section 4.1, it is never sent to any service that trains on it. Screenshots that came in through Discord (posted in a league's channel, or sent with /submit or "Send to OVRWire") are used only to measure accuracy overall, never to tune the reader. If a screenshot is removed from a game, it leaves the set too.
4.4 AI-written text, and images
Recaps and trade notes are written by AI from official stats only. They are labeled "Written by AI from official stats". To write them, we send the provider only the official numbers for the games involved, with every team and player replaced by a code such as T1 or P3. OVRWire puts the names back in after the text comes back, so no AI provider receives a gamertag or a team name for this. AI never decides results, disputes or whether a move is allowed.
We don't send your images or your name to AI image generators. Share cards and big-moment cards use a fixed set of backgrounds OVRWire made in advance, and OVRWire's own code adds the names and numbers.
5. Who we share it with
- Service providers that run OVRWire for us, listed on our list of service providers. They may use your data only to provide their service to us, except where section 4.1 says otherwise. Discord and Link also have their own relationship with you, as below.
- Your league and the public, as described in section 6.
- Discord, when the bot posts in your league's server, gives out a role, changes a nickname, adds an event or sends you a DM. Messages in Discord follow Discord's rules, and the server's members can see them. Discord's own privacy policy covers what Discord does with your account and messages.
- Bots your league connects. Your league's commissioner can connect other bots, such as a league's own Discord bot, with a key. A connected bot can read what anyone can see on your league's public pages: teams, schedule, final scores, box scores, standings and stats. If the commissioner allows it, it can also read the league while it's private, but never scores that aren't final. A bot never gets your Discord name, picture or ID from OVRWire, and if "Hide my name publicly" is on, bots see "Hidden player" and no screenshot of the games you played in. When a bot sends a box score for you, it tells OVRWire your Discord ID. The first time, OVRWire asks you to allow that bot, and nothing is sent for you until you do. After that you get a notice when it sends one, with a Not me button, and you can stop the bot sending for you at any time in your account settings, under "Bots that can send for you". In more detail:
- Reading. Anyone can read a live league's public pages through the API, without a key. A bot with a key can also sign up to get an update from OVRWire when a result becomes official, the standings change or a move is made.
- Before you allow a bot. A box score it sends for you isn't read, and the other team doesn't see it. If you could post a box score for that game, OVRWire asks you in your inbox and by Discord DM whether to send it, with Send, Not me and a box to let that bot send for you from now on. You can also allow a bot from a link it shows you. If you don't answer within 24 hours, the box score is dropped. Until you allow a bot, OVRWire tells it nothing about you, not even whether you have an account.
- Your Discord ID. OVRWire uses the ID a bot sends to find your account. It also keeps a scrambled code made from the ID for 24 hours, to count how many different people each bot sends for. The ID isn't stored with the box score, and OVRWire never gives it to any bot.
- After you allow a bot. A clean read goes to the other team under your name (section 4.2). Several box scores from one bot in the same hour share one notice. Not me withdraws the box score, or, in the 24 hours after the game is final, puts the game back in review for your league's commissioner. Either way, it stops that bot sending for you.
- A bot's own box scores. A bot can see OVRWire's unofficial read of a box score it sent, so it can show the player who sent it. The Terms require it to keep that private.
- The bot's owner, not OVRWire, decides what the bot does with what it receives, under its own terms and the Terms' rules for bots.
- Link (Stripe), for payments and refunds. Link is the seller and follows its own privacy policy.
- For legal and safety reasons: to follow the law or a valid legal request, to protect people from harm, or to stop fraud and abuse.
- If OVRWire changes hands, a new owner would take on this data under this policy.
We don't sell personal information for money. We don't share it for targeted advertising, and we don't give it to data brokers. Google may use the screenshots its free Gemini tier reads to improve its own products (section 4.1).
6. What's public, and when
| What | Who can see it |
|---|---|
| A season that hasn't gone live, or was refunded | League members only. Hidden from search engines. Earlier completed seasons of the same league stay public. |
| A live season's pages: teams, rosters, schedule, results, box scores, standings, leaders, awards, playoffs, transactions, the draft board, share cards and the public league log | Anyone. Search engines may index them. |
| A result that isn't official yet (pending or disputed) | Members of that league only. OVRWire's Discord posts show no numbers until a game is final. |
| Screenshots on official games | Everyone, or league members only. The league chooses. A game with any player who has "Hide my name publicly" on shows its screenshot to league members only. |
| Screenshots posted in your league's Discord channel | That server's members, like any Discord message. OVRWire's copy follows the row above. |
| Your gamertag | Public in live leagues you play in. It is your public name there. Former gamertags show as "formerly". |
| Your Discord name and avatar | Off public pages, unless you turn on "Show my Discord name and avatar". Your league's commissioner and co-commissioners can see their members' Discord names, so they know who's who. |
| Data read through OVRWire's API | What the league's public pages show. If the commissioner allows it, a bot can also read a private season as members see it, without any score that isn't final. Never anyone's Discord ID, username or avatar. |
| Your cross-league career page and player search | On by default once you claim your profile. You can turn it off. |
| Your league in "Find a league" | Only if the league chooses to be listed. Unlisted live leagues are still public to anyone with the link. |
| The homepage list of recent finals | Only games from listed live leagues. |
| Completed seasons | Stay public as an archive for as long as OVRWire operates. A refunded season becomes private. |
Things that leave OVRWire, such as Discord posts, shared cards, links, data a connected bot received, and screenshots other people save, follow the rules of wherever they end up. Deleting something on OVRWire doesn't delete those copies.
7. Your choices
On your profile page, under Privacy:
- Show me in player search and on my career page. On by default. Turning it off removes your cross-league career page and takes you out of OVRWire-wide search. Each league's own pages still show your stats there.
- Show my Discord name and avatar on public pages. Off by default.
- Hide my name publicly. Public pages, cards, recaps and the API show "Hidden player" with your team and position, and the screenshots of games you played in are shown to league members only, because your gamertag is printed in them. League members who are signed in still see your gamertag and the screenshots. Your stats and team totals don't change.
Also:
- Notifications: choose DMs and phone notifications by category, and set quiet hours. The in-app inbox stays on.
- Bots that can send for you: in your account settings, see each bot you've allowed to send box scores for you, and in which league, and tap Stop to end it (section 5).
- Edit your profile at any time. A changed gamertag is kept as a former one, so your old games stay linked.
- Fix a stat: stats are league records, so your commissioner corrects them, in public.
- Leave a team, league or pool, under the league's rules.
- Export: commissioners can export their whole league, which includes the rosters and box-score lines of everyone in it. Members can export a league's public data. For a copy of your own account data (profile, settings, memberships, requests and payment records), send a private request (section 15).
- Screenshots: a player whose line is in a game can ask for its screenshot to be removed. The screenshot stays as the game's record unless the game's result is corrected at the same time.
8. Deleting your account
To delete your account:
- Sign in and open Account → Privacy and data → Send a private request.
- Choose Delete my account and send it. Because you're signed in with Discord, that confirms the request is yours.
- A person at OVRWire runs the deletion within 30 days. You get an inbox item when it's done.
Private requests are never posted publicly. If you can't sign in, email legal@ovrwire.com with "Delete my account" in the subject. We'll ask you to confirm by signing in with the Discord account involved. If you've lost that Discord account, try Discord's own account recovery first. If that fails, say so in your email, and we'll agree another way to check the account is yours before we delete anything.
When your account is deleted:
- Removed: your OVRWire login and sessions, your Discord link, your profile (gamertags, builds, availability), your notification settings and phone-notification subscriptions, and your cross-league career page. OVRWire stops managing your roles in league servers. Roles it already gave you stay until someone who runs that server removes them, or you leave the server.
- Kept, so league history stays correct: your lines in official box scores and the results they belong to, under the gamertag 2K printed in the box score. Your player profile becomes unclaimed. If you had "Hide my name publicly" on, those lines stay hidden, and the screenshots of those games stay members-only. Screenshots you uploaded stay as evidence for the league but are hidden from the public. Gamertags printed inside screenshot images can't be blurred out.
- First, hand off: if you are a league's commissioner, hand the league to someone else before deleting. If the league never went live, you can delete it yourself instead. If it went live and nobody will take it over, say so in your private request. We freeze the league: nothing new happens in it, its seasons stay as they are, and its completed seasons stay public as an archive. Then we delete your account. You're never stuck.
- Deleted data can remain in backups for up to 35 days.
9. People who appear in box scores without an account
If your gamertag shows up in a league's box scores, you can sign in with Discord and claim your player profile. Claiming links your games to you and gives you every setting in section 7. If you'd rather not sign up, write to the address in section 15 with the league and the gamertag. We can turn on "Hide my name publicly" for that player without asking for proof, because hiding a name can't harm anyone. The screenshots of that player's games are then shown to league members only.
10. How long we keep things
| Data | How long |
|---|---|
| Your account and profile | Until you delete your account, or until we close it |
| Sessions (sign-in cookie, IP address, browser type) | A session lasts 7 days and is renewed while you use OVRWire. Records of ended sessions are deleted within 30 days |
| Discord sign-in tokens | Replaced each time you sign in, and deleted with your account |
| Official league records: results, box scores, standings, rulings, awards, the league log | For the life of the league. Completed seasons stay public as an archive |
| Screenshot copy shown on the game page (compressed, about 200 KB) | For the life of the game record |
| Full-size original screenshots and dispute evidence, including ones picked up from Discord | Deleted 30 days after the game is official, and never kept more than 180 days |
| Screenshot reader output | 30 days after the game is official, or 30 days after the read if no official game uses it |
| Daily reading counters (how much free reading was used; no personal information) | 13 months |
| Notes on screenshots the bot picked up (message ID, who posted it, when, which game, and any short note) | 180 days |
Counters that limit how often someone can use /submit (a Discord ID and a count) |
Until the 10-minute limit resets; cleared within a day |
| Your league's server setup (channels and roles chosen, what OVRWire created) | While the server is connected. After you disconnect, the league log keeps a record of what OVRWire set up, for the life of the league |
| Logos: the cleaned logo and the original file | Until it's replaced or the league is deleted |
| API keys | Until the key is removed or ends; a record of each box score or other change a bot sends (the time, the key, what it did, the result and the box score's ID, never what it sent, a Discord ID or an IP address), 90 days; read counts by hour, 90 days |
| Your OK for a bot to send box scores for you: which bot, when you allowed or stopped it, and whether you tapped Not me | While that bot's key exists, so a stopped bot stays stopped; deleted when the key is removed or you delete your account. A count of Not me taps against each bot is kept for 7 days |
| Scrambled codes made from the Discord IDs bots send (made with a secret key, used only to count how many different people each bot sends for) | 24 hours |
| A box score a bot sent for you before you allowed that bot | If you don't tap Send, it's dropped after 24 hours, and its screenshot is deleted within 2 days of arriving |
| A bot's own label for a box score it sent (which can be a Discord message ID) | As long as that box score. Only that bot sees it |
| Update addresses a bot adds, and their signing secrets (stored encrypted) | Until the bot removes the address or its key is removed |
| Update feed for bots (official results and standings) | 30 days |
| Update delivery attempts | 7 days |
| Records that stop a bot's retry from sending a box score twice | 30 days |
| Drafts that were never sent | Deleted 7 days after the draft expires (48 hours idle) |
| Leagues that never go live | Screenshot copies deleted 180 days after the league's last activity. The rest stays until the commissioner deletes the league |
| Refunded seasons | Kept, private |
| A deleted league (only a league that never went live can be deleted) | Erased within 30 days |
| Inbox notifications | 90 days once read, 180 days if unread |
| Rehearsal Draft results | 7 days |
| League export files | The download link works for 24 hours, and the file is deleted within 2 days |
| Report a problem: screenshot | 30 days |
| Report a problem: text and diagnostics | 12 months |
| Support inbox records (subject, category, scrambled address) | 12 months |
| The text and reply address of legal, privacy and billing emails | 90 days after the request is closed; legal notices as long as the law requires |
| Private requests and how we answered them | 24 months (California requires a record of privacy requests for 24 months) |
| Payment records (Stripe IDs, amounts, dates) and refund-screen choices | 7 years, for tax and accounting law |
| Safety and staff-action records (who did what, and why) | Kept permanently, so every staff decision and ban can be checked later |
| Backups | League backups 35 days; database restore points 30 days |
| Cloudflare request logs (Workers Logs) | About 7 days |
| Error reports | Up to 90 days |
| Analytics counts (PostHog) | Up to 12 months |
| Page view counts (Cloudflare Web Analytics) | Up to 6 months |
Link (Stripe) keeps its own payment records under its own policy. If you ask Stripe to delete your payment data, Stripe deletes it, but OVRWire keeps its own short record of the activation.
11. Age
OVRWire is for people 18 and older. When you sign in, you confirm that you are. We don't knowingly collect personal information from anyone under 18, and OVRWire isn't directed to children. If we learn that an account belongs to someone under 18, we close it and delete its personal information. Their stat lines stay as anonymous "Former player" lines so league standings stay correct, and screenshots of their games are shown only to the league's commissioner and co-commissioners, as evidence, because their gamertag is printed in them. To tell us about an underage account, use Report on the player's profile and choose "Underage user". Parents or guardians can also email legal@ovrwire.com with "Privacy request: underage account" in the subject. You don't need an account.
12. Security
- No passwords: you sign in with Discord.
- Connections are encrypted (HTTPS).
- Screenshots are stored privately and shown only through checked links.
- Each league's data is kept separate from every other league's.
- API keys are shown once and stored scrambled. Updates OVRWire sends to a league's bot are signed, so the bot can tell they came from OVRWire.
- Staff actions need recent sign-in with Discord two-factor turned on, and every staff action is logged. If staff ever have to open a private league to investigate a problem, the league log says so.
No system is perfectly secure. If a breach affects your information, we will tell you, and Discord where its rules require, as the law requires.
13. Where your data is processed
OVRWire runs in the United States. The account database is in western North America. Each league's records are kept in a Cloudflare data center near where the league was first opened, which may be outside the United States. Cloudflare's network handles requests around the world. Our providers may process data in other countries. Where the law requires, we rely on safeguards such as the European Commission's standard contractual clauses (contract terms the EU approves for sending personal information abroad) in our providers' data terms.
14. Your rights
Depending on where you live, you may have the right to:
- see the personal information we hold about you, and get a copy;
- correct it;
- delete it;
- object to or limit some uses;
- move it to another service;
- withdraw consent where we rely on it;
- not be treated differently for using these rights.
Some of this is self-serve (section 7). For a copy of your data, a correction, a deletion or an objection, send a private request (section 15). A request you send while signed in is already confirmed as yours. For an email request, we may ask you to sign in with the Discord account involved. Where the law allows, someone you authorize can make the request for you. We answer within the time the law sets (for example, one month in the EU and UK, or 45 days in California).
If we turn down all or part of a request, we tell you why. You can appeal: send a private request, or use the email address in section 15, and say it's an appeal of a privacy answer. We answer appeals within 60 days. If we still say no, you can complain to your state's attorney general or your local data protection authority.
EEA and UK. Our legal bases are:
- contract: running your account and leagues, including your league's Discord features;
- legitimate interests (uses the service needs and you'd reasonably expect, weighed against your rights): public league records and the archive, cross-league career pages, safety and fraud prevention, measuring reader accuracy, and product analytics;
- consent: showing your Discord name publicly, phone notifications, and joining a league's server through OVRWire;
- legal obligation: tax records and legal requests.
You don't have to give us anything, but without the Discord sign-in details in section 2.1 we can't give you an account. You can complain to your local data protection authority.
US states. We don't sell personal information for money or share it for targeted advertising. Section 4.1 explains how Google may use the screenshots its free Gemini tier reads. We don't use sensitive personal information to infer things about you.
15. How to reach OVRWire about privacy
- Signed in: Account → Privacy and data → Send a private request. This is the fastest way, and it's never public.
- Not signed in, or no account: email legal@ovrwire.com with "Privacy request" in the subject. You'll get an automatic reply with self-serve links at once. If you've lost your Discord account, say so (section 8).
- By post: OVRWire LLC, 3942 South Parkcrest, Springfield, Missouri 65807.
A person handles every privacy request within 30 days and replies in the app or by email.
16. Cookies and similar technology
| What | Why | Can you turn it off? |
|---|---|---|
| Sign-in session cookie | Keeps you signed in | No: OVRWire can't work without it |
| Sign-in security cookie | Protects the Discord sign-in step | No |
| Cloudflare Turnstile | Bot checks on a few actions | No, on those actions |
| Local storage and app cache | Remembers display preferences and makes the installed app load fast | Clear it in your browser |
| Analytics scripts (Cloudflare Web Analytics and PostHog) | Count page views and setup steps (section 2.8) | They set no cookies and store nothing on your device. A content blocker in your browser stops them, and OVRWire works the same without them |
We don't use analytics cookies or advertising cookies, and we don't record sessions. Our analytics scripts set no cookies, store nothing on your device and can't identify you on other websites. The cookies and storage in the table above are needed for OVRWire to work or remember a choice you made, so there's no cookie banner.
Do Not Track and Global Privacy Control. OVRWire doesn't follow you across other websites and doesn't sell or share your information for ads, so there's nothing for these browser signals to switch off. Where the law asks us to, we treat a Global Privacy Control signal as a request to opt out of selling or sharing.
17. Changes to this policy
When we change this policy, we update the date and version at the top. For a material change, we show a notice in the app at least 14 days before it takes effect.