Privacy Policy
Last updated: April 22, 2026
Garuda Games (the "club", "we", "us") is a sports and e-sports community based in the Philippines. This policy explains what personal information we collect when you use garudagames.net, why we collect it, how we store it, and the choices you have.
1. What we collect
When you create an account, we store the information you give us: username, a salted hash of your password (we never store the password itself), your in-game name, squad, club role, the games you play, and — optionally — your real name and an email address for password recovery.
When you use the site while signed in, we also record:
- Session metadata: the rough browser type (e.g. "Chrome on Windows") and the IP address your browser connected from, per sign-in, so you can review and revoke your own sessions from the dashboard.
- Activity: tournament accomplishments, Judge/Professional flag requests, and anything else you explicitly submit.
- Audit log: when an admin or verifier takes moderation action on your account (or you do), we log who did what and when. This is a security record, not a behavioural tracker.
- Notifications we send to your in-app inbox.
We do not use third-party analytics, ad
tracking, pixel beacons, or cross-site cookies. There is one
cookie on this site: garuda_sid, an
HttpOnly session cookie that keeps you signed in.
2. Why we collect it
- Your account and profile need identifying information so you can sign in and other members can find you on the leaderboard and members page.
- Your email, if you provide one, is only used for password recovery and security alerts about your own account (e.g. "your password was changed"). We never share it, sell it, or put it on a mailing list.
- IP addresses and browser info are kept for abuse prevention and so you can spot an unfamiliar session on your account.
- Audit logs exist so a verifier or admin can answer "who approved that?" six months from now, and so we can investigate account takeover attempts.
3. How long we keep it
For as long as your account is active. When you delete your
account, we remove your personal data within 30 days. Audit
log rows that reference you are kept in anonymised form
(username replaced by deleted_user) so the
moderation timeline stays intact, but they no longer
identify you.
4. Who can see your data
- Public: your username, in-game name, squad, club role, games played, and tournament accomplishments that have been verified. These appear on the members and leaderboard pages.
- Signed-in members: the same public information.
- Admins and verifiers: the public fields plus your pending submissions, audit trail, and the presence (not the content) of an email address on file.
- Nobody else: we do not share data with third parties except for the email relay service (Brevo) that delivers password-reset mail, and only when you have actually requested such an email.
5. Your rights
You can, at any time:
- Download your data. Your dashboard has an Export my data button that returns a JSON file with everything we have on file for your account.
- Correct your data. You can edit your profile fields directly in the dashboard.
- Delete your account. The dashboard has a Delete my account option. It requires your current password (and two-factor code if enabled) and is irreversible.
- Withdraw optional data. Clearing your email address from the profile form removes it entirely.
6. Security
Passwords are hashed with scrypt. Two-factor authentication is available and required for admins. All traffic runs over HTTPS. See our public security document for the full threat model.
7. Children
Garuda Games is a general-audience gaming club. We don't knowingly collect personal information from anyone under 13. If you believe a child under 13 has created an account, please contact us on Discord and we'll delete it.
8. Changes to this policy
Material changes will be announced on the News page at least 14 days before they take effect.
9. Contact
Questions about your data? Open a DM to an admin on our Discord server or write to no-reply@garudagames.net.