Privacy policy

Last updated October 28, 2026

This page lists everything polbielytics stores about you, why, and how long it keeps it. None of it is sold. The whole site works without an account.

Who we are

polbielytics (polbielytics.win) publishes statistics about Polandball Go. It is run by LIS and Stone Apps and is not affiliated with Zone Gaming LLC. "We" and "us" below mean the operators of polbielytics.

Game data on the site

Leaderboards, player profiles, battles, raid clears and alliances come from the official Polandball Go public API. They include in-game usernames and other details the game already makes public.

Polandball Go (Zone Gaming LLC) is the controller of your game data and decides what it shares with third-party developers such as polbielytics. Requests to access, correct or delete your game data, or to stop it being shared, are handled by Polandball Go directly in the game: use its data-sharing setting or its support channels. When you turn off third-party sharing there, the game stops sending us your data and we stop updating your profile.

If you'd like your game data removed from polbielytics, contact us or Polandball Go for more information. If you've linked a game account here, you can unlink it yourself from your account page. Any rights you have under the law that applies to you are not affected; for anything about data polbielytics holds itself, email us from the contact below.

When you visit

To count visitors we record, for each page view: the time, the page, your country and region (such as a state), the Cloudflare data center that served you, and a short token. We also record whether your browser identified itself as a bot or as controlled by automated software, how long the page took to load, and whether it was a full page load or a page opened inside the site. If you're signed in, the record also includes your account ID.

We do not store your IP address, your city or your precise location. The token is a one-way hash of your IP address and browser, mixed with the date and a secret key. It changes every day, so when you're signed out, visits on different days can't be linked to each other. It isn't fully anonymous, though: someone who had that key and already knew your IP address and browser could work out your token for a given day.

When you're signed in, the account ID does link your page views to your account. We keep it so we can see which pages signed-in readers use and answer support questions about your account.

Page-view records have no end date: they are kept to follow traffic over time. If you delete your account, your account ID is removed from them.

To protect the site, requests are checked for abuse. Your IP address is used for a moment to apply rate limits and is not stored. When a request is blocked (for example a hacking attempt or too many requests), we log the time, the page, the country, the reason and the same daily token, never the IP address. Errors the site runs into are logged without any personal details.

Cloudflare's visitor counter

Cloudflare, which hosts the site, adds its Web Analytics script to our pages. For each page view it tells Cloudflare the page, the page you came from, your browser and device type, your country, and how fast the page loaded. Cloudflare says it sets no cookies, stores nothing on your device and doesn't track individual visitors. We see only totals, in Cloudflare's dashboard. Cloudflare's privacy policy is at cloudflare.com/privacypolicy.

If you contact us

When you use the contact form, we keep your message and the email address you give for our reply. We also keep your name if you add one, the topic, the page you came from, your country, and your account ID if you're signed in. It's emailed to the site owner so we can answer. A daily-changing hash (not your IP) is kept to stop spam floods.

If you create an account

Accounts are optional. Depending on how you sign in, we keep:

• Email sign-in: your email address and when you confirmed it.
• Discord sign-in: your Discord user ID, display name and avatar (Discord's "identify" permission only; we can't see your servers or messages).
• Google sign-in: your Google account ID, name and email address (Google's basic "openid email profile" permissions only; we can't see your Gmail, contacts or files).
• Polbies ID sign-in: your Polandball Go player ID and username, and your Polbies tag if you have one ("openid profile polandball-go" permissions only; Polbies never shares your email or password with us). If you remove polbielytics under Connected apps in your Polbies account, we delete what this sign-in stored within 30 days.
• Passkeys: the passkey's public key and a counter. Your fingerprint, face or device PIN never leave your device and we never receive them.
• Linked Polandball Go account: which game account you verified, and when.
• Your account's name: your game name once you link one.
• Saved PvP calculator setups: if you save accounts or comparisons in the PvP calculator, we store them with your account until you delete them or your account. We also keep which game account you picked as yours there.
• PvP calculator results: if you tell us how a matchup went, we keep that report (both game accounts, both lineups, the result and any note) to check the calculator.
• Profile choices: which badges you highlight, your chosen background and your player card settings.
• Sign-in sessions: a random token in a cookie; we store only a scrambled (hashed) copy, plus when it was created and expires.
• When you agreed to the Terms, and when you were last seen.
• Roughly where you last read the site from: your country and region (such as a state), so we can see where our readers are. Never a city, a precise location or an IP address. We keep only the latest one, not a history of where you have been, and it is overwritten the next time you visit from somewhere else.
• A record of what you did while signed in: the pages you opened, and actions like signing in, linking a game account, or Premium starting or ending. We keep it so we can answer support questions about your account. It never includes anything you typed, an IP address or a location. It is deleted with your account.
• If staff time out your account: when the timeout ends and the reason.

To verify a game account we read its public profile and roster through the official API at that moment.

The polbielytics Discord app

polbielyticsBot answers slash commands in Discord. It is an app with commands only: it has no access to your servers' messages, members or channels beyond the command you send it.

• When you use a command, Discord sends us your Discord user ID, the server and channel it came from, and the command with what you typed in it. We use these to answer and don't keep them, except as listed below.
• Usage totals: we count commands and button clicks per hour. To count how many different people and servers used the app each day, we keep a short one-way hash of the ID, mixed with a secret key and the date, never the ID itself. It changes every day, so days can't be linked. Totals are kept to follow use over time.
• Errors: if a command fails, we keep the newest few error messages each day, with IDs and links removed.
• Linked accounts: if you signed in to polbielytics with Discord and linked your game account, commands like /pbl-me use that link to find your player. Nothing new is stored.
• War reminders: when a server admin sets them up, we keep the server's ID, the alliance chosen and the channel's ID. We also keep the Discord ID of the person who set them up, to check their Premium before each recap, and whether they asked for Premium stats. We keep a record of what was sent, and the channel's webhook link, stored encrypted. Turning reminders off deletes this. If the webhook is removed in Discord, sending stops. The record is then kept, switched off, until reminders are turned off or the server asks us to delete it.

Removing the app from a server or from your account stops it there. To have anything above deleted, email us from the contact below.

If you play War Council

We keep:

• Your leagues: the ones you create or join, and your name in each (your game name if you've linked one, otherwise your account's name).
• Your teams: draft picks, rosters, lineups, swaps, trade offers and any note on them, your votes on trades, and your weekly points and results. The same for your public game team, if you enter it.
• What you write in a league's chat or a draft room's chat. You, the League manager, a Co-manager or staff can delete a message; it then shows as deleted.
• Your alerts (the latest 30), and which alerts you want and where: on the site, by email, or as push notifications.
• A count of invite codes you tried that didn't work, for the current hour, so codes can't be guessed.
• If you turn on push notifications on a device: that device's push address and keys. They're deleted when you turn push off on it, when it stops accepting notifications, or with your account. Each notification is encrypted so only your device can read it.

Other Warlords in a league see your team, picks, trades and chat there. The public game's leaderboard shows teams of linked game accounts under their game names. Staff can open any league to look into a problem, and each look is logged.

A league that's deleted is archived, not erased, so its Warlords can still read past seasons.

War predictions

If you pick winners in war predictions, each pick is kept with your account. The predictions board shows the game names of linked accounts and how many of their picks were right.

Emails we send

We only email an address you've given us, and only for these:

• Sign-in links and email confirmations you ask for.
• Site news, only if you turn it on in your account. It's off unless you opt in.
• War Council, to a confirmed address: trade offers, trades for you to review, and a draft about to start. You can turn each one off in War Council's notifications.
• Premium: a thank-you when you pay, a note if staff give you Premium, and reminders a week and a day before Premium ends when it isn't set to renew. If you start a Premium checkout and don't finish it, one reminder, once.
• Premium alerts, only for Premium members who turn them on: your alliance's war starting or ending, your squads being attacked, upsets in your war, and a weekly report.
• Our reply when you contact us.

News, War Council emails and Premium alerts each have a one-click unsubscribe link.

Premium and payments

Premium subscriptions are paid through Stripe. You enter payment details on Stripe's pages, not ours; we never see or store your card number.

Stripe tells us your subscription status, plan, renewal date and a Stripe customer ID so we can turn Premium on. Stripe's privacy policy (stripe.com/privacy) covers what Stripe does with payment data. Payment records are kept as long as tax and accounting law requires.

Cookies and local storage

polbielytics uses only the cookies needed for signing in:

• pb_session: keeps you signed in (up to 90 days).
• pb_verify, pb_webauthn, pb_oauth, pb_google, pb_polbies: short-lived (5 to 30 minutes) while you verify a game account, use a passkey, or sign in with Discord, Google or Polbies ID.

That's why there's no cookie banner: these cookies are only there to sign you in, and no ads are running. If ads are switched on, you'll be asked before any optional ad cookie is used where the law requires it.

Your browser's local storage holds these things, on your device and nowhere else. None of it is sent to us.

• The pages you opened recently, so the search box can offer them again (pb_recent).
• Whether you chose the light or dark theme (polbie-theme).
• Which new-feature badges you've already seen, and the newest update you've opened (pbl:nav-seen:…, pb.updates.seen).
• The last ladder values you saw, so the up and down arrows can show what moved (flip:…), and the war scores you've already seen revealed (wsb-revealed, wsb-seen-scores).
• Your choices in the war strategist (pbl:war-strategist:…, pbl:strategist-on), and whether a war's history is open (pbl:war-history-open).
• Sections you folded, simple or detailed stats, and whether drop rates show on the items page and how it is sorted (pb.collapsed, pb.stats.mode, pb.items.dropRates, pb.items.sort).
• Prompts you closed or answered: the match-day banner, linking a game account, news emails and the Premium welcome (pb.matchday.dismissed, pb.linkPrompt.notNowAt, pb.nudge.newsAsked, pb.premium-welcome.…).
• The page to go back to after you sign in, until you're back (pb.signinNext).
• War Council's walkthroughs you've seen, and the draft room's sound, music and volume (wc-walkthrough-v1, wc-…-walk-v1, wc-room-sound-v1, wc-room-music-v1, wc-room-volume-v1).
• Whether you've seen the wiki editor's How to edit guide (wk-edit-tutorial).
• Whether you opened a preview of features still being built (pb.preview.esports), and for staff, whether ads are being previewed (pb_ads_preview).

While a tab is open, its session storage holds a few things for that tab only. Closing the tab clears them.

• A note of where you are in a war, so the back button works (pbl:war-hub).
• A War Council team you haven't saved yet (wc-draft:…, fs-cap:…).
• Whether the draft chat or a testing panel is open, and which intros have already played (wc-dchat-open:…, wc-beta-open, rt-seen:…).
• A card or page layout being compared (pb.cardv, pbl:war-room-beta:…), and whether you just signed in, so a prompt shows once (pb.justSignedIn, pb.acct.out).

When advertising is switched on, an ad network may set its own cookies, described next.

Advertising

We may show one ad to help pay for the site. It is served by Google AdSense or NitroPay, or it is a sponsor image we place ourselves. A sponsor image is just a picture and a link: it sets no cookies and tracks nothing. Premium members don't see ads.

Some visitors are young, so unless you're signed in, every Google ad request asks Google for its teen protections: no personalized ads, and adult, dating, gambling and other sensitive ad categories are blocked. Where the law requires it (for example the EU, UK and some US states) you'll be asked for consent before optional ad cookies are used, and you can change that choice later.

How Google uses information from sites that use its services: policies.google.com/technologies/partner-sites. You can turn off personalized ads at adssettings.google.com.

Children

Anyone can browse polbielytics. You must be 13 or older to create an account, and we ask you to confirm that when you sign up. We do not knowingly collect personal information from children under 13. If we learn an account belongs to a child under 13, we delete it. Parents can contact us to have a child's data removed.

Services the site runs on

These companies see data because they run part of the site, and only the part they run:

• Cloudflare: hosting, database, email delivery, Web Analytics, and the country/region shown for visits and accounts.
• Stripe: subscription payments.
• Discord: if you choose to sign in with Discord, and to run the polbielytics Discord app.
• Google: only if you choose to sign in with Google.
• Polbies: only if you choose to sign in with Polbies ID.
• Your browser's push service, run by its maker (such as Apple, Google, Mozilla or Microsoft): only if you turn on War Council push notifications, and it carries them encrypted.
• Google: ads (AdSense), when switched on.
• NitroPay: ads, if we use it instead of Google.
• Google Fonts: fonts on the pages. Game art is loaded from the Polandball Go asset server.

We do not sell personal information, and we don't share it for cross-context behavioral advertising. We may disclose information if required by law or to protect the site and its users.

How long each thing is kept

• Account data: until you delete your account.
• Sign-in sessions: until they expire or you sign out.
• Email sign-in links: deleted within a day of expiring.
• War Council leagues and their chat: kept, and archived rather than erased when a league is deleted. Your alerts: the latest 30.
• Records of which Premium alerts were sent: 40 days.
• Contact messages: up to two years, or sooner if you ask us to delete them.
• Security logs (blocked requests and site errors): up to one year. They hold the daily token, never an IP address.
• Page-view records: kept indefinitely. They hold the daily token, never an IP address, and your account ID only while you have an account.
• A log of what staff do to accounts (such as a timeout, Premium given or removed, or a Premium email sent): kept for security, with the account's number.
• Payment records: as long as the law requires.

Deleting your account

You can delete your account on your account page at any time, and it takes effect right away. If your Premium is set to renew, cancel it first. If you run a War Council league with other Warlords in it, transfer it to one of them or delete it first.

Deleting your account removes:

• Your account, sign-in methods, sessions, linked game account, profile choices and saved PvP calculator setups.
• The record of what you did while signed in.
• Your news, War Council and Premium alert settings, your push devices, and your War Council alerts.
• Your war predictions.
• Everything you wrote in War Council chat, and the notes on your trade offers.
• Your public game team and its place on the leaderboards.

These stay, with nothing that names you:

• A team you drafted in a private league, so the league can play on: other Warlords' standings, matchups and trades depend on it. It becomes an Open team the League manager can hand to someone else. Its picks, results and trades stay, with no name and no link to any account.
• Lines the game itself wrote in a league's chat, such as a pick or a trade. They stay as they were, and may show the name you had in that league.
• Page views, contact messages and PvP calculator results lose your account ID. Contact messages are still kept for up to two years.
• The log of what staff did to the account, kept with its number for security.
• Stripe's own payment records, as the law requires.

Your rights

You can see and change most of your data on your account page, remove any sign-in method, and delete your account there at any time.

You can also email us to ask for a copy of your data, a correction, or deletion. Depending on where you live (for example under the GDPR in the EU/UK or the CCPA in California) you may have further rights, including to object to processing or to complain to a data protection authority. We'll respond within 30 days and won't treat you differently for asking.

Where the GDPR applies, we rely on:

• Performing our agreement with you: your account, War Council and Premium.
• Our legitimate interests: security, keeping the site running, and counting visits.
• Your consent: news emails, Premium alerts, push notifications and optional ad cookies.

Security

What the site does:

• HTTPS only, with strict transport security and a content security policy.
• Session and sign-in tokens are stored as hashes, so the database does not hold anything that would sign you in.
• Sign-in links and passkey challenges work once.
• Automated abuse is rate limited and blocked.
• Staff tools need a second factor from an authenticator app.

None of that makes a site unbreakable. If a breach puts your data at risk, we will tell you.

Security problems go to security@polbielytics.win.

Where data is processed

Our providers may process data in the United States and other countries. By using the site you understand your information may be transferred there, with the protections those providers offer.

Changes

If this policy changes we'll update the date above, and for significant changes we'll show a notice on the site or email account holders who gave us an email.

Questions or requests: privacy@polbielytics.win