Privacy Policy

This policy describes what xtremetop300 does with personal data, written against what the site actually stores rather than in general terms. If something here does not match how the site behaves, the behaviour is the bug — please tell us.

Who is responsible

The controller of this data is xtremetop300, operated from Romania.

For anything about your data, write to privacy@xtremetop300.com. We have not appointed a Data Protection Officer; the site does not carry out the kind of large-scale or sensitive processing that requires one.

What we collect, and why

If you create an account

Data	Why	Legal basis
Display name	Shown publicly next to your listings	Contract
Email address	Sign-in, confirmation, password reset, notices about your listings	Contract
Password	Stored only as a bcrypt hash; we cannot read it	Contract
Sign-in session, IP and browser string	Keeping you signed in and detecting account abuse	Contract, legitimate interests

If you review a server

A review is public, and it is shown with your display name and the date — not your email address. The server owner may reply to it once, publicly. Reviewing needs an account because an anonymous review box on a toplist is a free weapon for rival servers.

The legal basis is your consent, given by posting it. You can edit or delete your own review at any time from the listing page, and deleting your account deletes your reviews with it. A moderator may hide a review that breaks the rules; if that happens the reason is recorded, and you can ask us what it was.

We also count how many times a review has been reported. That count is not shown publicly and a report never removes anything by itself.

If you sign in with Discord

Signing in with Discord is optional and does nothing unless you choose it. When you do, Discord asks your permission and then tells us four things: your Discord account id, your display name, your avatar and your email address — along with whether Discord has confirmed that address is yours. We request nothing else. We never see your Discord password, your servers, your friends or your messages, and we never post anything as you.

The legal basis is contract: it is how we identify you when you come back. We keep the id because it is the only stable link between the two accounts — a display name and an email address can both change.

A verified address from Discord is treated as proof of that address, so if it matches an account here the two are linked, and the address counts as confirmed. An unverified one never is: otherwise anyone could take over your account by typing your address into Discord's sign-up form.

You can unlink Discord at any time under My servers → Sign-in methods, which erases all four items. If Discord is your only way in, you have to set a password first — unlinking would otherwise lock you out of your own account.

If you list a server

Everything you type into the listing form is intended to be published: the name, description, website, Discord invite, server address and port, the game details, and any banner you upload. Treat the whole form as public. We also keep the moderation notes we write about a listing, and the dates we approved, warned or hid it.

If you vote

A vote is recorded against a server, not against you, and voting needs no account. To stop one person voting repeatedly, and to stop automated voting, each vote is stored with:

• your IP address, and separately its first two octets;
• a random device token kept in a cookie, so clearing a session is not enough to vote twice;
• a one-way hash of your browser string — the string itself is not kept;
• the time, and whether the vote was counted or held for review, with the rule that flagged it.

The legal basis is our legitimate interests: a toplist whose votes can be faked is worthless to the players who use it and to the server owners who compete on it. We have weighed that against your privacy and concluded it is proportionate, because the data is the minimum that can distinguish one visitor from a script, it is never used to build a profile or to advertise to you, and it is not linked to an account. You can object at any time using the contact address above; the practical consequence is that we could not accept votes from you.

These identifiers are erased after 90 days. The vote itself stays — rankings and the audit trail are unaffected — but the address, device token and browser hash are cleared, because the fraud checks never look back more than a week and holding them for longer would serve no purpose.

If you ask a server to reward your vote

Some servers give players something in game for voting. Those listings show an in-game name field on their vote page, and if you fill it in, we send that name to the server you voted for, along with the time of the vote and a random one-use token. Nothing else about you is sent: not your IP address, not your email, not your account if you have one.

The legal basis is your consent, given by typing the name. The field is optional on our side and the page says so — leave it empty and your vote still counts in full, you simply do not get the in-game reward. A server owner may choose to make the name required on their own vote page; if they have, and you would rather not give it, do not vote for that server.

The server owner is a separate controller for that name, not our processor. Once it reaches them we do not control what they do with it, and they are responsible for it under their own rules. We have no contract governing their use of it, which is exactly why we send them the minimum possible and why the field is optional.

We delete the reward record, and the name in it, after 14 days — collected or not. To withdraw consent before then, or to have a name removed sooner, contact us; withdrawing does not undo a reward a server has already given you.

If you buy coins

Payments are handled by Stripe. Card numbers are entered on Stripe's own page and never reach this site. We keep the order (how many coins, the price, the currency, the status), the Stripe references for it, your record of asking for the coins to be credited immediately, and the resulting entries in your coin history. Your email address is passed to Stripe so they can send you a receipt.

Legal basis: performing the contract, and a legal obligation to keep accounting records. That obligation is why a paid order survives even if you delete your account — see below.

If you join a launch wait list

We keep the email address you give us, the server it was for, your IP address, and an unsubscribe token. The basis is your consent. We send exactly one message, when that server opens, and every message carries a one-click removal link.

Server monitoring

We query listed game servers and fetch listed websites to show live player counts, uptime and whether a server is still alive. That involves no personal data of yours. These records are kept for 30 days.

What we do not do

• We do not sell or rent personal data, to anyone, for anything.
• We run no advertising or analytics trackers, and no third-party profiling scripts.
• We do not build behavioural profiles, and no decision about you is made by automated means in a way that has legal effect. A vote being held for review is reversible on request, and a person can restore it.
• We do not process special-category data, and the site is not intended for children under 16.

Who else sees it

Only the providers we need to run the service, each under a data processing agreement, and only for what they do for us:

Provider	What for	What they receive
Stripe	Taking payments	Your email, the amount, and your card details directly from you
Cloudflare (Turnstile)	Telling humans from bots when voting	Your IP address and a challenge token; Turnstile sets no tracking cookies
Discord	Signing you in, only if you use it	Nothing from us; they tell us your id, name, avatar and email
Our hosting and email providers	Running the site and sending its mail	Whatever is needed to deliver a page or a message
DNS resolvers	Checking whether a vote came from a datacenter or VPN	The IP address, looked up as a name

Some of these operate outside the EEA. Where they do, transfers rely on the European Commission's standard contractual clauses or an adequacy decision.

One disclosure is not on that table, because it is not a processor. If you type an in-game name when voting for a server that rewards voters, that name goes to the server owner, who decides for themselves what to do with it. They may be anywhere in the world. That is the point of typing it, it is optional, and it is described under “If you ask a server to reward your vote” above.

How long we keep things

What	How long
Vote identifiers (IP, device token, browser hash)	90 days
The vote itself, without identifiers	Kept, as part of the ranking record
Vote reward records, including the in-game name in them	14 days
Reviews you wrote	Until you delete them, or delete your account
Server monitoring history	30 days
Account and listings	Until you delete them
Linked Discord id, name and avatar	Until you unlink it, or delete your account
Paid orders	Kept as accounting records for as long as the law requires, unlinked from you once your account is gone
Wait-list entries	Until the server launches, or until you unsubscribe
Sign-in sessions	Expire automatically; cleared when you log out

Your rights

Under the GDPR you may ask for a copy of your data, correct it, have it deleted, restrict or object to how we use it, and receive it in a portable format. Two of those you can exercise yourself, right now, without asking us:

• Get a copy — download everything we hold about you as a JSON file from your account, under "Your data".
• Delete your account — from the same page. It removes your account, your listings and your coin history immediately.

Two things deliberately survive a deletion, and it is fairer to say so here than to leave you to find out: votes cast for your listings remain, because removing them would rewrite other servers' rankings and they identify nobody once your account is gone; and paid orders remain as accounting records we are required to keep, reduced to the reference and the amount.

For anything else, write to privacy@xtremetop300.com. We answer within one month. If you are not satisfied you may complain to ANSPDCP (Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal), or to the supervisory authority where you live.

Cookies

We use a small number of cookies and none of them track you across sites. They are listed individually on the cookies page.

Security

Passwords are stored as bcrypt hashes. Payment pages are served by Stripe. Sessions and vote cookies are encrypted and marked HTTP-only. Card data is never stored here. No system is perfect, and if a breach ever affects your data we will tell you and the supervisory authority as the law requires.

Changes

If we change how we use personal data we will update this page and its date, and for anything significant we will tell account holders by email rather than relying on you noticing.