Data controller
Paweł Rzewnicki — StatRivals.
For privacy enquiries and requests to exercise your rights, contact: pawel.rzewnicki@gmail.com.
Website and security
Vercel hosts StatRivals and Supabase stores private application data. Requests involve IP addresses and technical metadata. We process these to deliver the website, diagnose failures and prevent abuse, based on legitimate interests (Article 6(1)(f) GDPR). Operational logs follow the applicable hosting retention settings; incident records may remain until the matter is resolved.
Optional Google Analytics
Only after consent, Google Analytics 4 processes pseudonymous browser identifiers, sessions, page views, device/browser information, approximate location and chart interactions. The legal basis is consent (Article 6(1)(a) GDPR). Google uses IP to derive location but does not log or store IP in GA4. Advertising personalization and Google signals are disabled in our integration. We do not intentionally send names, emails, admin pages, private tokens, arbitrary search text or URL fragments. Restricted campaign labels may be included. Location and visitor counts are estimates.
Optional popularity statistics
After consent, StatRivals records page/card views, clicks, shares and PNG downloads by chart, day and broad traffic source in Supabase (Article 6(1)(a) GDPR). These reports have no persistent visitor IDs or raw IP. Daily aggregates are retained for up to 90 days. A daily rotating IP hash limits collector abuse and is removed after up to 2 days.
Cookies and retention
The necessary statrivals_consent_v1 cookie stores your choice, notice version and timestamp for up to 180 days, so we can respect and demonstrate your choice (Article 6(1)(f) GDPR). Optional _ga and _ga_* cookies expire after 180 days without automatic renewal. GA4 user/event data follows the property retention setting, up to 14 months in standard GA4; aggregate reports may remain longer. Theme and chart-export preferences may be stored locally when chosen. Administrator login uses a necessary HttpOnly session cookie lasting up to 12 hours.
Your choice and withdrawal
Analytics is optional and starts only after acceptance. Rejection does not restrict charts. Reopen “Cookie settings” in the footer at any time. Withdrawal stops future collection and removes GA cookies accessible to this site, but does not automatically erase data already sent to Google or affect the lawfulness of prior processing. Do Not Track and Global Privacy Control requests are respected. Public charts do not require an account.
Recipients and international transfers
Technical providers include Vercel Inc., Supabase and, after consent, Google Ireland Limited / Google LLC. Subprocessors may process data outside the European Economic Area, including the United States. Applicable data-processing agreements and transfer safeguards, such as an adequacy decision where applicable or Standard Contractual Clauses, govern these transfers. Provider details are linked below.
Your rights
Where applicable, you may request access, rectification, erasure, restriction and portability, or object to processing based on legitimate interests. You may withdraw consent and complain to the President of the Polish UODO or your local supervisory authority. We do not make automated decisions producing legal or similarly significant effects on visitors. We may not be able to locate your events from a name alone because analytics does not attach names to events.
Contact and changes
Analytics data is voluntary. If you contact us, we process your message and contact details to answer and handle the request, based on legitimate interests or a legal obligation for GDPR rights requests. Correspondence remains for the time needed to resolve the matter and applicable legal obligations. Material changes to optional analytics require renewed consent when necessary.