Privacy Policy

The HotsMeta desktop application (the “Application”) and the HotsMeta website at hotsmeta.pl (the “Website”) are provided by the HotsMeta operator, an individual residing in Poland who develops and provides HotsMeta as a free, non-commercial hobby project (the “Operator”, “we”, “us” or “our”).

For the purposes of the EU General Data Protection Regulation (GDPR) and the Polish Act on the Protection of Personal Data, the Operator is the data controller for the personal data described in this Policy. You can contact us about privacy at privacy@hotsmeta.pl.

This Policy explains what personal data we collect, why, on what legal basis, who we share it with, how long we keep it, and the rights you have. It applies to:

• the Application (parsing and uploading replay data); and
• the Website (which displays aggregated Heroes of the Storm statistics and player-linked statistics, and lets you upload replay files from your browser).

“Heroes of the Storm” and “Blizzard” are trademarks of Blizzard Entertainment, Inc. We are not affiliated with or endorsed by Blizzard.

3.1 Replay-derived data (Application and Website uploads)

The Application parses replay files locally and uploads derived match data to our backend. When you upload replays on the Website, each file is sent to our server, parsed there and deleted as soon as it has been processed. In both cases we store derived match data, including:

• BattleTags of the players in the match (e.g. Name#1234);
• hero picks and bans, talent choices, map, team, match result, match duration and date; and
• a derived skill/MMR estimate associated with a BattleTag.

We never keep the replay files themselves. For Website uploads we keep a fingerprint of each file (its SHA-256 hash) and the processing result, so that a file we have already seen is recognised without being sent or parsed again. A fingerprint cannot be turned back into the file.

On the replay chat page (/chat) we also read the chat messages in the file on our server, only to send them back to you in the same response. Chat messages are not stored, logged or shared. Translating them runs in your browser (its built-in on-device translation); the text is not sent to us or to any translation service.

3.2 Data about other players

Because replays involve several players, the data we process includes BattleTags and match statistics of other players present in your matches, not only your own. We use this solely to build aggregate and per-player statistics.

3.3 Technical data (Application)

• Application version and basic operational logs (kept locally on your device to help diagnose problems).
• When the Application checks for and downloads updates, the update service and the file host (GitHub) receive your IP address and request metadata as a normal part of serving the download.

3.4 Website data

When you visit the Website, we and our service providers may process:

• technical data such as IP address, device/browser type and pages viewed;
• usage statistics collected by Vercel Web Analytics and Speed Insights, which use no cookies and report only aggregated page views and performance data;
• for replay uploads: your IP address and browser signals checked by Cloudflare Turnstile (a bot check) and used for rate limiting, and a strictly necessary session cookie (hm_upload, valid for 2 hours) that records that the check was passed; and
• if applicable, data related to donations (handled by third-party payment platforms under their own privacy policies — we do not receive your full payment-card details).

Where we rely on legitimate interests, we have considered your rights and interests; you may object at any time (see Section 8).

HotsMeta is a public statistics service. Aggregated statistics and player profiles linked to BattleTags (for example, hero win rates or leaderboards) may be displayed publicly on the Website and in the Application. A BattleTag is a game identifier rather than a real-world name, but it can be associated with you. If you do not want your BattleTag-linked statistics processed, see your rights in Section 8.

We do not sell your personal data. We share it only with service providers acting as our processors, and only as needed to run the service:

• Supabase — backend database and hosting for the uploaded statistics.
• GitHub — distribution of application updates.
• Vercel — hosting of the Website, processing of replay uploads, and cookieless Web Analytics and Speed Insights.
• Cloudflare — Turnstile bot check before replay uploads.
• if used, donation platforms — for the Website only.

These providers process data under their own terms and, where required, under data-processing agreements. We may also disclose data if required by law.

Some of our providers operate outside the European Economic Area (for example, in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision. You can contact us for more information.

Under the GDPR you have the right to: access your data; request rectification of inaccurate data; request erasure (“right to be forgotten”); request restriction of processing; object to processing based on legitimate interests; request data portability; and withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at privacy@hotsmeta.pl and tell us the BattleTag(s) concerned so we can locate the relevant data. Because we identify data by BattleTag and do not otherwise verify identities, we may ask for reasonable information to confirm that the request genuinely relates to you.

You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), or with the authority in your EU country of residence.

We keep replay-derived statistics for as long as needed to provide the historical and aggregate statistics service, unless you ask us to erase data relating to your BattleTag. Replay files uploaded on the Website are deleted right after processing; their fingerprints are kept as long as the statistics. Local logs on your device remain until you clear them or uninstall the Application. Analytics data and request logs (including IP addresses) are retained according to our providers’ configured retention periods.

The Application and Website are not directed to children under the age required by applicable law (see the eligibility requirements in our Terms of Service). We do not knowingly collect personal data from children below that age. If you believe a child has provided personal data, contact us and we will delete it.

We take reasonable technical and organisational measures to protect personal data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Application and Website may link to third-party sites or rely on third-party services (such as Blizzard, GitHub, Supabase, Vercel, Cloudflare or donation platforms). Their privacy practices are governed by their own policies, which we do not control.

We may update this Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you in the Application or on the Website. Continued use after an update constitutes acceptance of the revised Policy.