Privacy Policy
This Privacy Policy explains how BC Stats handles information when you use bc-stats.com. BC Stats provides private player statistics and server-backed match history for registered users while keeping screenshot OCR on the user’s device.
1. Controller
The controller is Dawid Kobus, Bielsko-Biała, Poland. Privacy contact: [email protected].
2. Screenshot processing
When you select a scoreboard screenshot, BC Stats uses browser-side OCR and image/canvas processing on your device. The browser may temporarily process game UI text and names visible in the screenshot in order to identify your scoreboard row and extract match values. The original image file is not intentionally uploaded to the Operator’s server.
After OCR, only the match data you choose to save is sent to the BC Stats server. This can include result, kills, deaths, calculated ratio, Bodycam nickname, the original local filename, creation time and technical duplicate-detection fingerprints/hashes. These fingerprints are used to reduce accidental duplicate match entries; they are not stored as a copy of the screenshot.
3. Account data stored on the server
| Data | Purpose | Typical retention |
|---|---|---|
| Email address | Create and identify the BC Stats account; account communication where necessary | Until the account is deleted or the data is no longer required |
| Password hash | Authenticate the account securely. BC Stats stores a password hash, not the plaintext password | Until the account is deleted |
| Bodycam nickname | Identify the user’s scoreboard row and label private match data | Until changed or the account is deleted |
| Legal acceptance timestamp | Record the registration acknowledgement of the applicable legal documents | For as long as reasonably needed to document the service relationship |
| Email verification status | Confirm that the user controls the email address used to register | For the life of the account |
| Account timestamps | Operate and maintain the account | For the life of the account and as otherwise legally necessary |
4. Email verification
New accounts must verify the registration email address before sign-in. BC Stats creates a random one-time verification token, stores only its SHA-256 hash with an expiry time, and sends the verification link to the registration email address. The token record is deleted after successful verification, replacement or account deletion. Email delivery uses authenticated SMTP through the hosting provider and the recipient’s email provider will necessarily process the destination address and verification message.
5. Private match history stored on the server
When a signed-in user adds a match, BC Stats stores that user’s private match history in the server database. Stored fields can include match identifier, local source filename, the file modification timestamp provided by the browser for chronological ordering, result, game mode, map name, kills, deaths, ratio, Bodycam nickname, database creation timestamp and duplicate-detection values such as SHA-256, perceptual hash and board signature.
Deleting your statistics
You can delete your complete server-stored match history and statistics at any time using the “Delete all stats” button in the account panel. This action deletes the saved match rows for your account. It does not delete your BC Stats account, email address, password hash, Bodycam nickname, browser preferences, chart settings or other account/browser data. Individual saved matches cannot currently be deleted separately.
The account panel also provides Delete account. After confirmation and password verification, the live user record is deleted and the related saved matches and verification-token records are removed through database cascade rules. Data may remain temporarily in hosting backups and age out under the hosting backup cycle (currently up to 30 days). Requests concerning other personal data can be sent to [email protected].
6. Local browser storage and session data
BC Stats also uses first-party browser storage for functional preferences such as the Bodycam nickname cache, chart range, cookie/privacy preference and ad-block notice state. Legacy local match-history and old onboarding/disclaimer acknowledgement keys may remain on devices that used older versions, but the current interface no longer uses the blocking onboarding acknowledgement.
When you sign in, the server uses a necessary session cookie named bcstats_session. It is used to keep the user authenticated and protect account/API operations. A server-side CSRF token is also used for state-changing requests.
7. Hosting, Cloudflare and technical logs
BC Stats is hosted on infrastructure provided by LH.pl. Technical server logs, including IP addresses and request/security information, may be processed for security, diagnostics and service operation. The hosting provider maintains daily backups for up to 30 days.
Cloudflare is used as a DNS, reverse-proxy, CDN, TLS, caching and security provider in front of the website. Requests to bc-stats.com therefore pass through Cloudflare infrastructure. Cloudflare may process standard network and security data such as IP address, requested URL, timestamps, TLS/HTTP information, browser/user-agent details and security events.
8. OCR and content-delivery resources
The Tesseract.js OCR library is loaded only when analysis is started. The current application loads the library from jsDelivr; Tesseract-related worker/core/language resources may also be requested from delivery endpoints used by the library. These providers can receive standard request metadata. BC Stats does not intentionally send the scoreboard screenshot itself to jsDelivr.
9. Contact and complaints
If you contact the Operator, the Operator may process your email address, name (if provided), message content and related correspondence to answer the request, provide support or handle a complaint.
10. Advertising / Google AdSense
BC Stats plans to use Google AdSense to display advertisements. For visitors in the European Economic Area, the United Kingdom and Switzerland, a Google-certified consent management platform (CMP) supporting the IAB Transparency and Consent Framework will provide information about advertising purposes and vendors and allow visitors to accept, refuse or manage advertising choices where required. This advertising consent is separate from the BC Stats first-party analytics preference.
If advertising is enabled, Google and participating advertising partners may process cookies/local storage, IP addresses, device/browser information and similar identifiers for ad delivery, fraud prevention, measurement and, where permitted by the visitor’s choices and applicable law, personalization. Visitors will be able to revisit their advertising choices and withdraw consent using the CMP’s privacy and cookie settings control. The CMP message must be published and verified in AdSense before consent-dependent advertising is activated.
11. Service-usage counters and optional first-party analytics
Privacy-minimal aggregate service counters
BC Stats records a small set of aggregate operational counters so the Operator can tell whether the Service is being used and whether the analyzer is functioning even when optional analytics is declined. These counters can include page loads by page path, analyzer runs, number of screenshots processed, duplicate counts and count-only analyzer errors. Saved-match and registration totals are also available to the administrator directly from the normal account/match database.
The aggregate usage table is intentionally designed so that individual activity cannot be reconstructed from it: counters are grouped into one-minute buckets and do not store a BC Stats user ID, analytics session ID, persistent visitor ID, raw IP address, full user-agent string, referrer, country or browser/device profile. The browser-side counter request does not create an optional analytics identifier. Signed-in administrator activity is skipped server-side, and an administrator can additionally exclude the current browser from both aggregate counters and optional analytics.
Aggregate usage counters are retained for up to 12 months. Because these records contain only bucketed totals and no account/visitor identifier, they cannot be linked back to a particular user or removed on an individual-account basis.
Optional detailed analytics
BC Stats uses detailed first-party analytics only after the visitor chooses “Accept all” in the privacy banner. The purpose is to understand traffic patterns, retention and product use in more detail and to diagnose failures.
The optional analytics can record a random visit identifier, a random persistent first-party visitor identifier, page path, landing page, referring domain, language, viewport size, broad device type, browser family, operating-system family and the two-letter country code provided by Cloudflare, together with product events such as sign-in, analyzer completions, screenshot counts, duplicate detections, saved-match counts and analyzer error messages. For a signed-in user, consented activity can be associated with the account ID so the administrator can see account-level usage such as visit count, active days, tracked analyses and last-seen time. BC Stats does not intentionally store the visitor’s raw IP address, full user-agent string or a generated browser fingerprint in its own analytics tables.
The persistent visitor identifier and visit identifier are created in first-party local storage only after consent. The visit identifier is replaced after approximately 30 minutes of inactivity; the persistent visitor identifier allows aggregate unique/returning-visitor measurement between visits. A lightweight one-minute heartbeat can update the visit’s last-seen time while the page is visible, improving session-duration and “active now” statistics without writing a separate analytics event each minute.
Raw optional analytics events and visit records are retained for up to 12 months and are then pruned. Withdrawing optional consent through Privacy choices → Necessary only stops future detailed first-party analytics and removes the local analytics visit and visitor identifiers. It does not disable the privacy-minimal aggregate service counters described above. Account deletion removes optional analytics records linked to that account; aggregate service counters cannot be linked back to the account.
Cloudflare may separately provide infrastructure traffic, performance and security metrics as part of operating the proxy/CDN service.
Access to detailed analytics and aggregate service-usage statistics is restricted to BC Stats administrator accounts. The administrator dashboard clearly separates anonymous aggregate usage from consent-dependent traffic/visitor analytics; account-level zeroes are not treated as proof of no activity when consented telemetry is unavailable.
12. Recipients and processors
Depending on the feature used, data may be processed by the Operator and service providers including LH.pl, Cloudflare, and jsDelivr/Tesseract resource delivery providers. If advertising is activated, Google and vendors disclosed through the certified CMP may also process data according to the user’s choices.
13. International transfers
Some infrastructure, CDN, OCR-resource or future advertising providers may process data outside the European Economic Area. Where GDPR applies, such transfers should rely on an applicable legal mechanism, such as an adequacy decision or appropriate contractual safeguards.
14. Legal bases
- Service/account operation: processing necessary to provide the requested BC Stats account and private match-history features.
- Security, diagnostics and abuse prevention: legitimate interests in maintaining a reliable and secure Service.
- Legal/compliance records and claims: applicable obligations and/or legitimate interests in establishing, exercising or defending claims.
- Optional advertising/analytics: consent where required by applicable law.
15. Your rights
Where GDPR applies, you may have rights to access, rectify or erase personal data, restrict processing, receive data portability where applicable, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time. You may also lodge a complaint with the competent supervisory authority; in Poland this is UODO.
16. Automated decisions
BC Stats does not use automated decision-making that produces legal or similarly significant effects. OCR and calculated game statistics are informational features only.
17. Children
The Service is not directed to children and the Operator does not intentionally design the account system to profile children.
18. Changes
This Policy may be updated when the Service, account system, hosting, Cloudflare configuration, OCR delivery, advertising, analytics or legal requirements change.