Privacy Policy

1. Introduction

Welcome to TarkovTracker ("we", "us", "our", or "Service"). This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you use our Service accessible through tarkovtracker.org and any associated domains, applications, or APIs.

TarkovTracker is a free, open-source, community-driven progress tracking application for Escape from Tarkov, operated by volunteers and maintained by contributors. As a volunteer-run project, we take your privacy seriously but acknowledge that we operate with limited resources and cannot guarantee absolute security or error-free operations.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account or use our Service, we may collect:

• Authentication Information: Email address, username, and profile information provided by third-party OAuth providers (Twitch, Discord, Google, GitHub, etc.)
• Profile Data: Display name, avatar/profile picture, and any other information you choose to add to your profile
• Game Progress Data: Quest completions, hideout upgrade status, player level information, faction progress, and game mode selections (PvP/PvE/Seasonal)
• Team Collaboration Data: Team names, team memberships, shared progress information, and team-related communications
• User-Generated Content: Any content you voluntarily submit, post, or transmit through the Service
• Supporter & Payment Data: If you make a contribution or subscribe, our third-party payment processor (Stripe) handles your payment. We do not store your full card number; we retain limited records such as your supporter status, tier, contribution history, and a processor customer or transaction identifier needed to manage perks, renewals, refunds, and disputes
• Imported Game Log Files: If you use the EFT log import feature, your game log files are processed entirely locally in your browser. They are never uploaded to or stored on our servers; only the extracted progress data you choose to save is sent to us

2.2 Information Collected Automatically

When you access our Service, we automatically collect certain technical information:

• Usage Data: Pages visited, features used, time spent on the Service, interaction patterns, and frequency of use
• Device Information: Browser type and version, operating system, device type, screen resolution, and language preferences
• Log Data: Access times, referring/exit pages, and error logs. Your IP address otherwise appears only in transient access logs maintained by our hosting providers (Cloudflare) under their own privacy policies. Where we retain account-linked IP records, we store a one-way keyed hash (HMAC-SHA256) of the IP address along with your browser User-Agent string — never the raw IP address. As limited exceptions, we store the raw IP address with your User-Agent in account-deletion rate-limit records (retained for up to 90 days) and in administrative audit logs, solely for abuse prevention and security auditing
• API Access Data: API tokens, request timestamps, endpoints accessed, client User-Agent strings, and rate limit information
• Cookies and Similar Technologies: Session identifiers, authentication tokens, preference settings, and, if you allow analytics, analytics cookies or similar browser storage
• Analytics Data: If you opt in to analytics, Google Analytics and Microsoft Clarity may collect page views, approximate location, device and browser details, referral information, clicks, scroll behavior, session replay data, and engagement metrics to help us understand how the Service is used

Your analytics preference applies to Google Analytics and Microsoft Clarity. If we introduce advertising or other monetization technologies in the future, we will update this Privacy Policy and request any additional consent required before enabling those services where applicable.

2.3 Information from Third-Party Sources

We receive information from third-party services you choose to connect with:

• OAuth Providers: Profile information, email addresses, and authentication tokens from Twitch, Discord, Google, GitHub, or other supported providers. Some providers (such as Discord) require us to request your email address to uniquely identify your account — we use it for authentication, account recovery, and the service-related email communications described in this policy (technical notices, security alerts, support messages, and policy-change notices). We do not send marketing email
• Game Data Sources: Public game information from tarkov.dev API, Escape from Tarkov Wiki, and community databases (no personal player data)

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Provision: To provide, operate, maintain, and improve the core functionality of TarkovTracker, including progress tracking, team collaboration, and data synchronization
• Authentication & Security: To verify your identity, maintain session security, prevent unauthorized access, and protect against fraudulent or abusive activity
• Personalization: To customize your experience, remember your preferences, display your progress data, and provide game mode-specific features
• Communication: To send you technical notices, updates, security alerts, and support messages (we do not send marketing emails)
• Analytics & Improvement: To analyze usage patterns, identify bugs, understand feature adoption, and improve Service performance, including through Google Analytics and Microsoft Clarity when you consent to optional analytics collection
• Legal Compliance: To comply with legal obligations, enforce our Terms of Service, respond to legal requests, and protect our rights and the rights of others
• Feature Development: To develop new features, test experimental functionality, and enhance existing capabilities based on user feedback

4. Data Storage and Security

4.1 Where We Store Your Data

Your data is stored and processed using third-party infrastructure providers:

• Supabase: Database storage, authentication services, and real-time synchronization (hosted on AWS infrastructure in multiple regions)
• Cloudflare Pages & Workers: Web hosting, content delivery network (CDN), static asset serving, API request handling, and edge key-value caching. Edge caches hold public, precomputed game data with a 7-day retention; shared profile and team responses (display names, progress, and identifiers) are cached for only a few seconds to serve concurrent requests
• OAuth Providers: Authentication credentials managed by Twitch, Discord, Google, GitHub, or other connected providers

4.2 Security Measures

We implement reasonable technical and organizational measures to protect your personal information:

• Encryption in transit using HTTPS/TLS protocols for all data transmission
• Encryption at rest for sensitive data stored in our databases
• Secure authentication using industry-standard OAuth 2.0 protocols
• Access controls and authentication requirements for administrative functions
• Regular security updates and dependency management for open-source components
• Rate limiting and abuse prevention mechanisms to protect against attacks

4.3 Security Limitations & Disclaimers

IMPORTANT: As a volunteer-operated, open-source project with limited resources, we must be transparent about our limitations:

• We cannot guarantee absolute security or 24/7 monitoring of our systems
• We do not warrant that our Service is immune to unauthorized access, data breaches, or security vulnerabilities
• Security incidents may occur despite our best efforts, and response times may vary based on volunteer availability
• You acknowledge that no method of electronic storage or transmission is 100% secure and accept the inherent risks
• We rely on third-party providers (Supabase, Cloudflare) for infrastructure security, and their security practices are subject to their own policies

You use the Service at your own risk and are responsible for maintaining the security of your account credentials. If you discover any security vulnerability, please report it to legal@tarkovtracker.org immediately.

5. Data Sharing and Disclosure

5.1 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes or monetary compensation. Your data is not a product.

5.2 Service Providers

We share data with third-party service providers who help us operate the Service:

• Supabase: Database hosting, authentication, and real-time features
• Cloudflare: Web hosting, CDN, DDoS protection, API request handling, edge caching (public game data retained up to 7 days; shared profile and team data for a few seconds), and performance optimization
• Google Analytics and Microsoft Clarity: Website analytics tools used to measure usage trends and improve the Service, subject to your analytics consent choice
• OAuth Providers: Authentication and identity verification services
• Stripe: Payment processing for one-time contributions and supporter subscriptions

These providers have access to your data only to perform services on our behalf and are obligated to protect it in accordance with their own privacy policies.

5.3 Team Features

When you join or create a team, certain information is shared with team members:

• Your display name, avatar, and basic profile information
• Your game progress data (quest completions, hideout status, player level)
• Your team activity and participation status

You control what you share by managing your team memberships and can leave teams at any time.

5.4 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal processes (subpoenas, court orders, search warrants)
• Government or law enforcement requests
• Legal claims or disputes involving the Service
• Situations involving potential harm, fraud, or violations of our Terms of Service
• Protection of our rights, property, safety, or the rights of users and the public

5.5 Business Transfers

If TarkovTracker is involved in a merger, acquisition, asset sale, or transfer of control, your information may be transferred to the new entity. We will notify you via email and/or prominent notice on the Service before any such transfer.

6. Data Retention and Deletion

6.1 Retention Period

We retain your personal information for as long as necessary to:

• Provide the Service and maintain your account
• Comply with legal obligations, resolve disputes, and enforce agreements
• Maintain security, prevent fraud, and investigate violations
• Improve the Service and develop new features

6.2 Account Deletion

You may request deletion of your account and associated data at any time:

• Through the Service settings/account management interface
• By contacting us at support@tarkovtracker.org

Upon deletion request, we will:

• Remove your personal information and progress data from active systems within 30 days
• Remove account-linked security audit records (such as hashed IP addresses and User-Agent strings), which are deleted when your account is removed — except account-deletion rate-limit records, which are kept for up to 90 days to prevent abuse of the deletion process
• Anonymize or delete your data from team records (team names and shared data may persist if owned by the team)
• Retain certain data in encrypted backups for up to 90 days for disaster recovery purposes
• Retain limited data (anonymized logs, aggregated statistics) for legal compliance and security purposes

6.3 Inactive Account Purging

Where feasible, we will make reasonable efforts to notify affected users before routine inactivity deletion. Material changes to this policy will be communicated in accordance with the Terms of Service and applicable law.

7. Your Rights and Choices

7.1 Access and Portability

You have the right to:

• Access your personal information stored in our systems
• Request a copy of your data in a portable format (JSON export)
• Review and update your profile information through account settings

7.2 Correction and Update

You can correct or update your information by:

• Editing your profile directly through the Service interface
• Updating information with your OAuth provider (Twitch, Discord, Google, GitHub, etc.)
• Contacting us at support@tarkovtracker.org for assistance

7.3 Deletion and Objection

You have the right to:

• Request deletion of your account and personal data
• Object to certain processing activities
• Withdraw consent for optional data collection

7.4 Cookie Controls

You can control cookies through:

• The Analytics Preferences control in the site footer, which lets you allow or decline Google Analytics and Microsoft Clarity on this browser
• Your browser settings (most browsers allow you to refuse or delete cookies)
• Clearing your browser cache and local storage

Note: Declining analytics will not disable core tracking features of the Service, but blocking essential cookies or local storage may impact authentication, preferences, and session management.

7.5 Regional Privacy Rights

Depending on your location, you may have additional rights under applicable privacy laws:

• GDPR (European Union): Right to access, rectification, erasure, restriction of processing, data portability, and objection
• US State Privacy Laws: Depending on your state of residence, laws such as the CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), and similar state laws may grant rights to know, access, correct, delete, and opt out of the sale or sharing of personal information (we do not sell your data), and non-discrimination for exercising these rights
• Other Jurisdictions: Rights may vary based on local data protection laws

To exercise these rights, contact us at legal@tarkovtracker.org with your request. We will respond within the timeframes required by applicable law.

8. Children's Privacy

Our Service is not intended for children under 13 years of age (or the minimum age in your jurisdiction). Where applicable law sets a higher minimum age for consenting to the processing of personal data (for example, up to 16 in parts of the European Economic Area), that higher age applies. We do not knowingly collect personal information from children below the applicable age.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at legal@tarkovtracker.org. We will take steps to delete such information from our systems promptly.

Users between 13 and 18 (or the age of majority in their jurisdiction) should use the Service only under parental supervision and with parental consent.

9. Third-Party Services and Links

9.1 Third-Party Privacy Policies

Our Service integrates with third-party services that have their own privacy policies:

• Supabase: supabase.com/privacy
• Cloudflare: cloudflare.com/privacypolicy
• Discord: discord.com/privacy
• Stripe: stripe.com/privacy
• Google / Google Analytics: policies.google.com/privacy
• Microsoft / Microsoft Clarity: privacy.microsoft.com/en-us/privacystatement

We are not responsible for the privacy practices of these third-party services. We encourage you to review their privacy policies before using them.

If analytics is enabled, Google and Microsoft may process analytics data according to your consent choices and their own policies. You can change your analytics preference at any time from the site footer.

9.2 External Links

Our Service may contain links to external websites (GitHub, Discord, game wikis, etc.). We are not responsible for the privacy practices or content of these external sites. Your interactions with external sites are governed by their respective privacy policies.

10. Open Source Transparency

10.1 Code Accessibility

TarkovTracker is an open-source project licensed under GPLv3. Our source code is publicly available at github.com/tarkovtracker-org .

This means:

• Anyone can review our code to understand how we handle data
• Security researchers can audit our implementation
• Contributors may have visibility into certain technical aspects of data handling
• You can self-host the application if you prefer to control your own data

10.2 Contributor Access

Important Clarification: While the codebase is open-source and maintained by multiple contributors:

• Only the project owner has administrative access to production databases and authentication systems
• Contributors do not have access to user data, production credentials, or personal information
• All code changes undergo review before deployment to production
• Database credentials and API keys are not shared in the public repository

10.3 Community Feedback

Discussions about privacy practices, security improvements, and data handling may occur in public GitHub issues or community channels. We do not disclose specific user data or individual account information in these discussions.

11. International Data Transfers

TarkovTracker operates globally and may transfer, store, and process your information in countries other than your country of residence. These countries may have data protection laws different from those in your jurisdiction.

Our infrastructure providers (Supabase/AWS, Cloudflare) maintain data centers in multiple regions worldwide. By using the Service, you consent to the transfer of your information to these locations.

We take reasonable steps to ensure that your data receives adequate protection wherever it is processed, in accordance with this Privacy Policy and applicable law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Service features. When we make changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you of material changes through the Service interface, email, or GitHub announcements
• Provide a reasonable notice period before significant changes take effect

Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you should discontinue use and delete your account.

We encourage you to review this Privacy Policy periodically to stay informed about our data practices.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Privacy & Data Requests: legal@tarkovtracker.org
• General Support: support@tarkovtracker.org
• GitHub Organization: github.com/tarkovtracker-org
• Security Vulnerabilities: legal@tarkovtracker.org (please include "SECURITY" in subject line)

For data subject access requests, deletion requests, or other privacy rights exercises, please include:

• Your registered email address or username
• A clear description of your request
• Verification information (we may need to confirm your identity)

We will respond to privacy-related requests within 30 days (or as required by applicable law). As a volunteer-run project, response times may vary during periods of high volume or limited volunteer availability.

14. Disclaimer and Limitations

IMPORTANT - PLEASE READ CAREFULLY:

As a free, open-source, volunteer-operated project, we must be transparent about our limitations:

• No Guarantee of Security: We cannot guarantee that your personal information will be 100% secure or that unauthorized access will never occur
• No Warranty: The Service and all data handling practices are provided "AS IS" without warranties of any kind, express or implied
• Limited Resources: Response times for privacy requests may be longer than commercial services due to volunteer availability
• Third-Party Reliance: We rely on third-party infrastructure providers (Supabase, Cloudflare) and cannot control their security practices beyond choosing reputable providers
• Potential Data Loss: While we implement backups, data loss due to technical failures, security incidents, or service discontinuation is possible
• Limits permitted by law: Any exclusion or limitation of liability for data loss or privacy-related incidents applies only to the extent permitted by applicable law. Nothing in this Policy excludes or limits rights or remedies that cannot lawfully be excluded or limited.

By using the Service, you acknowledge and accept these limitations and use the Service at your own risk.

We take privacy seriously and implement reasonable protections, but we cannot provide the same level of guarantees as large commercial platforms with dedicated security teams.

15. Your Acknowledgment and Consent

By using TarkovTracker, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, storage, and disclosure of your personal information as described herein.

You understand and accept:

• The inherent risks of using a volunteer-operated, open-source service
• That we cannot guarantee absolute privacy or security
• That you are solely responsible for the security of your account credentials
• That third-party services have their own privacy policies and practices
• That your data may be transferred and processed in multiple countries

If you do not agree with this Privacy Policy, please do not use the Service.