Privacy Policy
Last revised: November 2026. L2Ranks ("the Platform") is committed to strict data minimization, player confidentiality, and global privacy compliance (GDPR, CCPA/CPRA, and LGPD).
1. Our Commitment to Data Minimization
We believe in collecting only what is strictly necessary to deliver an authentic, bot-free ranking ladder and community directory. We never sell, rent, or monetize personal information or browsing history.
Whether you are an anonymous voter supporting your favorite Lineage 2 server or a registered server owner managing multiple listings, our systems are built with privacy-by-design principles from the ground up.
2. Information We Collect and Process
When you register as a server administrator or verified voter, we collect your email address, securely salted password hash (never stored in plaintext), and preferred UI locale. If you register via Google OAuth, Discord, or Telegram, we receive your verified email and unique platform ID. We do not access your contacts, private chats, or third-party media.
To prevent fraudulent multi-voting and ranking manipulation while preserving player privacy, our voting engine processes:
- Salted IP Hashes: Your IP address is immediately converted into a one-way cryptographic SHA-256 hash using a rotating platform secret. Raw IP addresses are not stored in our voting logs.
- Browser Composite Hashes: Non-invasive device characteristics (screen dimensions, color depth) to differentiate legitimate human voters on shared university or dorm networks.
- Optional In-Game Handles: Game account name and character name provided solely to deliver vote reward tokens to your game server.
Paid advertising and additional server slot subscriptions are processed exclusively through Stripe Inc. (PCI-DSS Level 1 certified). L2Ranks does not store, see, or transmit raw credit card or banking details.
3. Legal Basis for Processing (GDPR Art. 6)
- Contract Performance: Providing server management, account access, 12-hour vote recording, and in-game reward webhook fulfillment.
- Legitimate Interests: Protecting the integrity of server rankings against coordinated Sybil attacks, botnets, and DDoS incidents; platform monitoring and uptime maintenance.
- Consent: Optional server performance notification emails (daily, weekly, or monthly summaries) which can be enabled or disabled at any time from your dashboard.
- Legal Obligations: Compliance with statutory tax, invoicing, and corporate record-keeping requirements.
4. Cookies & Session Storage
We avoid invasive tracking cookies and third-party advertising trackers. We use strictly necessary cookies:
5. Data Retention & Security Standards
All traffic between your browser and L2Ranks is encrypted using Transport Layer Security (TLS 1.3 / HTTPS). Database storage utilizes encrypted volumes, strict network isolation, and parameterized queries.
- Vote Lock Keys: Voting lock records expire and are automatically cleared after 12 hours.
- 30-Day Ranking Aggregates: Votes older than 30 days are automatically retired from rolling ladder totals.
- Account Deletion: You may request full account deletion at any time, removing all personal credentials and contact records.
6. Your Rights (GDPR & CCPA/CPRA)
Under international privacy laws, you possess the right to:
- Right of Access: Request a copy of the personal data held about you.
- Right to Rectification: Correct inaccurate or incomplete information.
- Right to Erasure ("Right to Be Forgotten"): Request the permanent deletion of your account and personal data.
- Right to Restriction & Objection: Object to processing of your data based on legitimate interests.
- Right to Non-Discrimination: We will never deny services, charge different prices, or degrade service quality for exercising privacy rights.
7. Privacy Inquiries & Contact
If you have any questions, requests, or concerns regarding your privacy or data protection, please contact our Data Protection team:
You also have the right to lodge a formal complaint with the relevant data protection authority in your country of residence (such as the EU Data Protection Authorities or UK Information Commissioner's Office).