Privacy Policy

Onstreak is operated by Julien Menthon, an individual entrepreneur in France (SIREN 833 339 815), who is the data controller for the personal data described in this policy. For any privacy question, or to exercise any of the rights set out in section 6, contact us at contact@onstreak.gg.

We collect only what the service needs to work:

• Account information — the email address you sign in with and, where you use a social login, the provider you chose (Google or Discord) together with the account identifier and email that provider returns to us.
• User profile — the @username you pick and the gaming platform you play on (for example PlayStation, Xbox or PC).
• Uploaded match screenshots — the end-of-match images you choose to upload, and the match statistics extracted from them (result, score, game mode).
• Optional mood tags — if, and only if, you choose to log how a match felt, we store that tag alongside the match.
• Basic technical data — device type, browser and IP address, used to keep the service secure and prevent abuse.
• Product usage analytics, when enabled — selected product destinations, scan request outcomes, actions and visible Coach or upgrade states, linked to your internal account identifier. Event details use bounded categories such as destination, Manual or Scan, scan result, Action application, Review decision and billing period.

We never ask for and never store your EA account credentials, your payment card details, or your real-world identity documents. Stripe collects payment information directly; we receive subscription status and billing identifiers.

Account, profile, screenshot and mood data is processed to provide the service you signed up for — performance of a contract, Art. 6(1)(b) GDPR. Limited technical data is processed to keep the service secure and prevent abuse, on the basis of our legitimate interest, Art. 6(1)(f) GDPR. Where we send you product or launch email, that is on the basis of your consent, Art. 6(1)(a) GDPR, and you can withdraw it at any time.

Your data is stored securely with Supabase (Postgres database and object storage). Every table holding user data is protected by Row Level Security (RLS), enforced at the database level, so a given row can only ever be read or written by the account that owns it. Data is encrypted in transit (TLS) and at rest.

Account, profile, match and screenshot data is kept for as long as your account is active. Account erasure is handled manually after a verified request, including coordination with processors. Records we must retain for legal or billing obligations are excluded and explained in our response. You can delete individual matches and their screenshots at any time, without deleting your account.

You hold full rights over your profile and your match history. At any time you can:

• Access — obtain a copy of the personal data we hold about you.
• Export — receive your profile and full match history in a portable, machine-readable format.
• Rectify — correct your profile, or fix any statistic our extraction read incorrectly.
• Delete — erase individual matches and screenshots, or your entire account and everything attached to it.
• Restrict or object — ask us to limit or stop a particular processing activity.
• Withdraw consent — unsubscribe from our email at any time, in one click.

To request access, export or account deletion, email contact@onstreak.gg from the address linked to your account. We verify account ownership before a manual response and normally respond within one month; if a lawful extension is needed, we explain it. Account export and deletion are not automated settings features. You may complain to your national data protection authority, including the CNIL in France.

When product analytics is enabled, we use PostHog Cloud EU to understand activation, product destination visits, scan request outcomes, coaching use and return visits, through its EU ingestion service. We do not send email, username, club name, match scores or statistics, screenshots, OCR output, coaching evidence or text, notes, authentication tokens, page URLs or query strings to PostHog. Automatic interaction capture, automatic page tracking, session replay, heatmaps and performance collection are disabled. PostHog receives only our internal pseudonymous account identifier and the approved event categories; Person profile processing is disabled. We do not track anonymous landing visitors with it. PostHog receives connection information needed to deliver requests; we disable IP-based geolocation enrichment for these events.

Analytics event retention is governed by the configured PostHog service and plan. Deleting an Onstreak account does not automatically delete PostHog events; analytics erasure requests are handled separately by our operators.

Only the processors we need to run the service, each acting on our instructions under a data processing agreement: Supabase (database, authentication and file storage), Google Cloud Vision (image text recognition), OpenAI (OCR text structuring, as described in section 4), Stripe (checkout, subscriptions and payment processing), Vercel (hosting and anonymous traffic analytics), and our email delivery provider. AI providers may process data outside the EEA. Applicable provider agreements set out transfer safeguards, including the European Commission’s Standard Contractual Clauses where required. We do not sell your personal data to anyone, and we never will.

If you sign in with Google or Discord, we receive only your email address, the provider’s account identifier and, where available, your display name — we never receive your password, and we never request access to your contacts, files, drive or any other data held by that provider. Revoking Onstreak’s access in your Google or Discord account settings stops any further exchange immediately; to also remove the data we already hold, request deletion of your Onstreak account by email.

We set only what is strictly necessary: the cookies that keep you signed in, and a preference cookie remembering your chosen language. We run no advertising cookies and no cross-site tracking.

PostHog analytics identity is held in page memory rather than cookies or persistent browser storage. It is cleared on sign-out and restored from your authenticated internal account identifier on a later visit. Anonymous public traffic is measured separately by Vercel.

We may update this policy as the product develops, and will post the revised version on this page with a new “last updated” date. For anything privacy-related, write to contact@onstreak.gg.