Privacy policy
Controller
In short
- No analytics, no tracking, no advertising, no third-party scripts or fonts.
- An account is optional; without one we only know a random id of your browser.
- Tierlists and their images are deleted when their lifespan runs out.
Hosting and network
tiermates runs on a server at OVH in France (EU). Traffic passes through Cloudflare, which delivers the site and protects it from attacks, and in doing so processes your IP address. The legal basis is our legitimate interest in running the service securely (Art. 6(1)(f) GDPR).
The server writes no access logs. It keeps IP addresses in memory for minutes only, to limit requests and lock out guessing; it does not store them.
Browser id
Every browser gets a random id (cookie tm_client). The server stores only a hash of it, the tierlists this browser belongs to and the tierlists that removed it. An id without a membership is deleted after a day.
Tierlists
We store the tierlist's name, your name in it, uploaded images, texts and labels, votes and invites. Images are re-encoded; all metadata (location included) is removed and the originals are not kept.
Only a tierlist's members see it; its link alone lets nobody in. It is deleted with its images one day after its last activity; with an account, its owner can choose up to 14 days.
Accounts
Accounts are created by the administrator only. We store the username, display name, language, theme, a hash of the password and the signed-in devices (device and browser, derived at sign-in; the browser's identification itself is not stored). A sign-in lasts 30 days from its last use. Deleting an account deletes its tierlists and templates.
Templates
A published template is public: its title, tiers, images and labels, until it is unpublished or deleted.
Cookies and local storage
Only strictly necessary cookies and entries in the browser's local storage, so no consent is needed:
- tm_client: the browser id, 400 days.
- tm_session: signed in with an account, 30 days from its last use.
- tm_admin: signed in to the administration, 12 hours.
- Local storage: the name used last, the export settings, the account's language and theme, one-time keys of newly created tierlists.
Legal bases
We process data to provide the service you use (Art. 6(1)(b) GDPR) and to protect it (Art. 6(1)(f) GDPR).
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Without an account we can match your data only through the tierlist's link: include it in your request.