Back

Privacy Policy

Last updated: 19 April 2026

This Privacy Policy explains how we collect, use, and protect your personal data when you use the website at gestal.gg (the "Service"). It applies to all visitors and registered users.

1. Data we collect

Account data

When you create an account, we store:

  • Email address;
  • Display name;
  • Avatar (image reference);
  • Account roles (for example, whether you are an approved creator);
  • Whether your email has been confirmed.

Creator profile data

If you are approved as a content creator, we additionally store the information you provide for your public creator profile:

  • Biography;
  • Profile and banner images;
  • YouTube, Twitch, Twitter/X, and Discord links you choose to display.

Authentication data

If you sign in with Google or Discord, we receive the information those providers return to us for authentication (typically an identifier, email address, and display name). We never receive your Google or Discord password.

Technical data

We use Cloudflare Web Analytics to measure aggregate traffic. This service collects limited technical data (for example, page path, referrer, user agent, and a temporary IP-derived signal) without setting tracking cookies. See Cloudflare's privacy policy for details.

2. How we use your data

  • To provide and maintain the Service, including authenticating you and keeping you signed in;
  • To display public creator profiles and content submissions that you have chosen to publish;
  • To communicate with you about your account (for example, verification and password-reset emails);
  • To measure aggregate traffic and improve the Service;
  • To investigate and prevent abuse, fraud, and security incidents.

3. Legal bases (GDPR / UK GDPR)

If you are in the European Economic Area or the United Kingdom, we process your data on these legal bases:

  • Contract — processing necessary to provide the Service you requested;
  • Legitimate interests — operating, securing, and improving the Service;
  • Consent — where you have given us specific permission, which you may withdraw at any time;
  • Legal obligation — to comply with applicable laws.

4. Service providers and third parties

We share data with a limited set of sub-processors strictly for the purposes described above:

  • Supabase — managed PostgreSQL database hosting;
  • Cloudflare — hosting, content delivery, and privacy-respecting web analytics;
  • Google and Discord — identity providers, only if you choose to sign in with them;
  • YouTube — when you click to play a video embedded on our pages, YouTube loads and may set its own cookies. We use a deferred loader so no request is made to YouTube until you click.

5. Data retention

We retain account data for as long as your account is active. If you delete your account, we remove or anonymise your personal data within a reasonable period, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

6. Your rights

Where applicable law grants you rights over your personal data, you may request to:

  • Access the personal data we hold about you;
  • Correct inaccurate data;
  • Delete your data ("right to be forgotten");
  • Export your data in a portable format;
  • Object to or restrict certain processing;
  • Withdraw any consent you have given.

To exercise any of these rights, reach us on our Discord. If you believe we have mishandled your data, you may lodge a complaint with your local data-protection authority.

7. International transfers

Some of our sub-processors operate servers outside your country. Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on the appropriate safeguards defined by those providers, including Standard Contractual Clauses.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

9. Security

We use technical and organisational measures to protect your data, including encrypted connections (HTTPS), httpOnly cookies for session tokens, and restricted backend access. No method of transmission over the internet is fully secure, but we work to protect your data as best we can.

10. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page always reflects the most recent version. Material changes will be announced on the Service.

11. Contact

For any privacy-related question, reach us on our Discord.