Privacy Policy
Last updated: 14 October 2026
This policy explains what personal data BroadRoads processes, why, and what your rights are. It applies to the game at broadroads.com and eu.broadroads.com and to these web pages. We keep data to what the game needs: there are no ads, no third-party analytics or tracking, no data sales and no tracking cookies.
1. Who is responsible
The controller (in Turkish law the veri sorumlusu) is the BroadRoads team. You can reach us through the contact form.
2. What we collect and why
| Data | What and why | Legal basis |
|---|---|---|
| Account | Player name, password (stored only as a salted scrypt hash), the date you joined. Guests get a random name. Optional: an email address for password recovery and the weekly digest, and the ID (plus verified email, if any) of a Google or Discord account you choose to link for signing in. | Contract (providing your account); consent for the optional email and linked logins |
| Game profile | Level, experience, rating and rank history, match history (your last 20 games), champion statistics and mastery, shards, cosmetics, quests, season pass, achievements, login calendar, friends and friend requests, club, honor, settings you change in the game, and moderation records (warnings, mutes, suspensions). | Contract; legitimate interests (fair play and moderation) |
| Matches and replays | What happens in a match (champion, movement, actions, results) is processed to run it. The latest 50 matches are saved as replays with player names, viewable by anyone with the link. Live matches can be spectated. | Contract; legitimate interests (replays, highlights, spectating) |
| Chat | Messages are delivered in real time and not stored, except in reports (below). | Contract |
| Reports and moderation | When a player reports someone we store the reporter's and the reported player's names, the reason, an optional note, the match and the moment, and the decision taken. Automated anti-cheat checks can also file reports (input rate, invalid commands). | Legitimate interests (a safe, fair game); legal obligations |
| Voice chat | Only if you join it: your browser connects to the other party members' browsers, either directly (which shows them your IP address) or through our relay server. Audio is never recorded. Microphone access is asked for by your browser. | Consent |
| Connection data | Your IP address is used while you're connected (to run the connection, limit abuse and stop floods), but we don't keep it. We keep only one-way hashes in a few places: to count unique visitors per day (deleted after that day), to count players affected by an error, and a hash of your network (not your full address) with invite codes so people can't invite themselves. | Legitimate interests (security, abuse prevention) |
| Connection quality | Once a minute while you play: your ping, jitter, lost packets and your browser's time zone, added to anonymous totals per time zone (not linked to your account) to decide where to run servers. Your ping is also used to judge skillshots fairly. | Legitimate interests (a responsive game) |
| Error reports | If the game crashes in your browser it sends the error message, where it happened, the page and your browser's user agent, so we can fix it. | Legitimate interests (fixing bugs) |
| Statistics | Daily totals only (players, new players, tutorial and first-game counts, match and champion statistics). No individual profiles are built. | Legitimate interests (improving the game) |
| Notifications | Only if you turn them on: your browser's push subscription address and keys and which notifications you want. | Consent (you can turn them off any time) |
| Contact messages | What you send through the contact form, including any name or email you give. | Legitimate interests (answering you); legal obligations for privacy requests |
We don't process payment data (there is nothing to buy) and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated anti-cheat checks only flag accounts for a person to review.
3. Who else is involved
We use these providers to run the Service; they process data on our behalf under their data processing terms:
- Hosting: Namecheap / Spaceship (servers in Phoenix, United States) and Hosting Dünyam (servers in Istanbul, Türkiye). You play on whichever server is faster for you.
- Database: Neon (on Amazon Web Services, us-east-1, United States), which stores accounts and profiles.
- Google or Discord: only if you choose to sign in with them; they tell us your account ID and verified email.
- Browser push services (operated by your browser's maker, for example Google, Mozilla or Apple): only if you turn on notifications; they deliver the encrypted notification to your device.
- Email: if we send you an email (password reset, weekly digest), it goes through our email provider.
Other players see what's described in section 5 of the Terms. We share data with authorities only when the law requires it. We never sell personal data.
4. International transfers
Our servers are in the United States and Türkiye, so your data may be processed outside your country, including outside the EU/EEA. Where the law requires it, we protect such transfers with appropriate safeguards, such as the European Commission's standard contractual clauses or the standard contracts provided for under Turkish law (KVKK), and our providers' security measures.
5. How long we keep data
- Account and profile: until you delete your account. Deletion removes your profile, email, linked logins, notification subscriptions and invite code from the live database at once. Your player name stays reserved in a locked record with no other data, so nobody can take over a name your friends and old replays still show.
- Backups: deleted data can remain in our daily backups, which are kept on our own server with restricted access, for up to 14 days.
- Replays: only the latest 50 are kept; older ones are deleted automatically.
- Reports and moderation records: the latest 200 reports; moderation history on an account until it's deleted.
- Error reports: rotating logs of a few megabytes, replaced as new errors come in.
- Contact messages: until handled, then for up to 12 months.
- Daily statistics: kept as totals that contain no personal data.
6. Your rights
Depending on where you live (for example under the EU/UK GDPR or Turkish Law No. 6698 on the Protection of Personal Data, "KVKK", Article 11), you have the right to: know whether and how we process your data; get a copy of it (in the game: Profile → Account → Download my data); have it corrected; have it deleted (Profile → Account → Delete account); restrict or object to processing based on legitimate interests; withdraw consent at any time (for example turn off notifications or remove your email); data portability; and to ask what third parties received it. You can also claim compensation for damage caused by unlawful processing where the law provides for it.
Send requests through the contact form; we answer within one month (30 days under KVKK). We may ask you to confirm it's your account. You can also complain to a data protection authority, for example the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or the authority in your EU country.
7. Children
The Service isn't meant for children under 13, and we don't knowingly collect their data. If you believe a child under 13 (or under the age of digital consent in your country, without a parent's consent) has an account, tell us and we'll delete it.
8. Security
Connections are encrypted (HTTPS/TLS), passwords are hashed with scrypt, sessions use signed tokens that expire, and access to servers, the database and admin tools is limited to the people who run the Service. No system is perfectly secure; if a breach affects your data we'll tell you and the authorities as the law requires.
9. Changes
We'll update this policy when our data handling changes, show the new date here and tell players in the game about important changes.