SIGVA Privacy Policy
1. Operator and contact
| Item | Details |
|---|---|
| Name used | SIGVA Operations (run by an individual) |
| Contact | The support desk on the official Discord (tickets) is the main contact. Email is support@sigva.games |
| Necessary name/address details | Actual private details are kept out of public pages; when a request is made under law, the operator personally answers the person who made it |
Selling through an MoR is not treated as removing SIGVA Operations’ responsibility for its personal-data processing or its business identification. Japan’s PPC general guidelines, 3-8-1
2. Information processed
2.1 Ordinary sign-in and inventory
Ordinary online sign-in is Discord only. SIGVA manages an independent ID linked to the Discord ID and creates an EOS Product User ID (“PUID”) in the background for connectivity and related functions. Ordinary use does not require Epic Games account sign-in.
“Temporary processing” means receiving information for authentication/communication, not necessarily persisting it. “Stored” reflects a storage path identified in code.
| ID | Information | Receipt/storage and purpose |
|---|---|---|
| P01 | Discord ID | Selected from authentication and stored in account links for sign-in/identification |
| P02 | Discord authorization code, OAuth tokens and profile response | Temporarily processed at sign-in. Only the ID is selected from the profile; OAuth access/refresh tokens and other profile fields are not persisted. The identify scope does not request email or friends. SIGVA does not handle Discord passwords |
| P03 | SIGVA account ID, EOS PUID and links | SIGVA creates an ID and stores its PUID mapping; sends SIGVA ID/name to EOS for authentication, matches and anti-cheat |
| P04 | Name, account and acceptance histories | Chosen SIGVA name, creation/login times/outcomes, changes and accepted version/time, for identity and records |
| P05 | SIGVA sign-in tokens/state | SIGVA access/refresh tokens, expiration, revocation and reuse history. Service DB stores token hashes; PC refresh tokens use Windows DPAPI encryption. These are separate from P02 Discord tokens |
| P06 | IP, port, destination and traffic records | Processed on connection. An account-API rate-limit path stores an HMAC-derived key, count and expiry. Other game/operation logs may contain raw IPs; not all paths are described as hashed. Connectivity, attack prevention and fault investigation |
| P07 | Match and skill records | Match IDs/times, participants/teams/results/leaving, waiting time, internal skill estimates, leave penalties, Bot attempts/wins, titles/decals. Matches, matchmaking and records |
| P08 | Inputs, read timing and ping | Controls and fresh-read/disabled-input marks plus round-trip time in match traffic/administrative recordings. Frame pacing and menu/window state may be inferred. Gameplay, cheat detection and fault investigation |
| P09 | SIGVA social data | Friend codes/relationships, sent/received requests/times, mutes, presence, search/party/room codes. Persistent records and transient presence, displayed as necessary. Separate from Discord’s friends list |
| P10 | Bot-clear posts and administration | Account ID, clear order, match/replay ID/time, messages and report/hiding/translation histories. Public board and moderation |
| P11 | Administrative online recordings | Official-server matches: state, names, controls/input marks, cars/ball, ping and related records. Anti-cheat and fault investigation. Match records are also used for AI training and research. Training and research use only the copy made from these recordings (P21) (section 3). Separate from player-facing exports |
| P12 | Player-facing shared replays | Recorded names/teams, car/ball motion/appearance, events/scores. Designed to exclude controls/input marks, IPs, ping, account IDs and Bot model names |
| P13 | Reports, bans and security records | Reporter/target/category/match/text, verdict values, reasons/times/actions/objections. EOS/EAC also handles PUIDs and anti-cheat sessions |
| P14 | Inquiries | Subject/body, match ID, status, contacting Discord ID/email and attachments. Please avoid unnecessary real names, addresses or secrets |
| P15 | Discord community records | When used: guild/Discord IDs, language/interests, verification, tickets and entered recruitment/posts/profile data. Not all collected merely by signing in |
| P16 | Purchases and entitlements | Purchase/order/invoice identifiers, product/period/amount/currency/status, grants/revocations/refunds. Legacy code-claim records may remain |
| P17 | Plan and purchase records | The policy is to record the active plan/expiry, the deduction made when a plan is changed, purchase/support contributions and refund adjustments |
| P18 | Additional publishing, market and credit records | Where used: posts, transactions/balances/ledgers and rights. Existing features do not mean currency is bundled with these plans |
| P19 | Legacy migration | Old Friend Test Epic IDs/PUIDs, ownership checks, old/new ID links and migration histories may remain. This is not described as collecting Epic account IDs through new Discord sign-in |
| P20 | Operations, audits and backups | Connections/administrative actions/changes/security history, logs and DB copies. Scope differs by path/settings |
| P21 | Training/research copy (in a form that does not show whose it is) | A copy of P11 recordings is made with the account IDs (SIGVA, Discord and EOS IDs), the name (display name) and the IP address removed, and is kept without a time limit for AI training and research. Controls and input marks, car/ball motion, scores and other match content remain. Until the mechanism that makes this copy is running, records of people’s matches are not used for training (section 3). It cannot be ruled out that a person could be inferred from how they play |
2.2 Information visible to other users
SIGVA names, titles, car appearance, friend codes, match scores/ping, necessary friend/party presence, and Bot-clear order/dates/messages/public replays. Replays may retain names used at recording. Discord names, IDs and avatars are not intended as public game names/profiles.
An internal ID in technical traffic differs from a public screen display. Traffic such as chat relay may contain internal IDs such as PUIDs; we do not say internal IDs never reach another device. Participant access to recent ordinary online replays is distinct from public Bot boards; it is not treated as though anyone can read every administrative recording.
2.3 Discord friends and chat
Current identify sign-in does not collect Discord friends. Importing friends is a future feature that requires Social SDK integration, appropriate permissions and a separate user choice. If it is introduced, the policy is to separate Discord authorization from SIGVA import and match only established Discord friends who both selected “yes”. No answer is not consent.
In-match chat is relayed. The relay path is designed not to store the text on the server. Bot-board messages, report text and Discord tickets are stored, rather than covered by the chat “not stored” description.
2.4 Information not ordinarily requested, and exceptions
The Discord sign-in code does not select email, real name, address, birth date, card number or friends. SIGVA’s policy is not to actively collect payment real names, addresses or card numbers. It does process orders, amounts and entitlements. Users may provide contact/personal details in inquiries/posts. We do not say “no personal information is collected” or “no purchase information is collected”.
No function for microphone recording, advertising behavior analytics or automatic crash reporting has been identified in the game itself. We do not assert that the complete configuration, including EOS/EAC and the checkout page, handles no device, OS or security information at all.
2.5 Data on your PC
Settings, accepted version/time, sign-in persistence, logs, local/edited replays/clips, downloaded shared versions and training packs are stored mainly under %APPDATA%\SoccarPlayable. Logs can contain file locations incorporating a Windows user name. These files are not all automatically uploaded. Check names/participant information before sharing or submitting files.
Replay lists have saving/organization features; the policy does not universally say the game lacks deletion. Local deletion does not erase server data or copies others downloaded.
2.6 External providers’ separate processing
Discord, EOS/EAC providers, the MoR and hosts process information under their own functions/contracts. Purchases are made on the page of the MoR (Xsolla), which is opened in an external browser. Purchaser names, contact details, payment methods, tax/security and similar information entered with the MoR are separate from SIGVA’s ID-only sign-in. Xsolla Privacy Policy
3. Purposes
Information is used for identification/sign-in/acceptance records; gameplay/matchmaking; play/social/public-board/shared-replay features; entitlements/renewal/refunds administration; cheating/attacks/abuse investigation; fault investigation and handling; AI training and research (below); inquiries/objections/data requests; necessary legal obligations and notices.
Records of matches through official servers (P11) are used for anti-cheat and fault investigation, and also for training and research of SIGVA’s AI (such as Bots, cheat detection and play analysis). Only the copy with the account ID, name and IP address removed (P21) is kept without a time limit for training and research. Recordings that show whose match they are keep the periods in section 4 (ordinarily 90 days; review-pending matches and ban evidence are protected). Training and research use only this copy (P21). Recordings that show whose match they are are not used for training, even during that period. Until the mechanism that makes the P21 copy is running, records of people’s matches are not used for training.
There is no decision to give the P21 copy to third parties or to publish it. Ordinary acceptance alone is not treated as blanket permission for promotional reuse. A change to the purposes described here, or an external disclosure, requires explanation and any necessary consent.
4. Retention
| Information | Retention period and handling |
|---|---|
| SIGVA/Discord/EOS links, name/acceptance/friends/titles/stats/migration | Retained for continuing accounts and necessary records. No blanket deletion after 24 months of inactivity is applied |
| Authentication flows/token hashes/rate limits | Cleaned up on expiry. History needed for revocation/reuse detection and similar is preserved |
| IP address and connection records | Cleaned up after 90 days |
| Future HTTP-body/AI records | A table’s existence alone is not treated as meaning HTTP bodies or AI context are currently stored |
| Official administrative match recordings (recordings that show whose match they are) | Ordinarily cleaned up at 90 days. Capacity can cause earlier deletion. Review-pending/ban evidence is separately protected |
| Administrative Bot Challenge recordings | Cleaned up at 30 days. Review-pending/ban evidence is separately protected |
| Training/research copy (P21; in a form that does not show whose it is) | No time limit. Account ID, name and IP address removed; controls and motion remain |
| Shared replays/public clear records | Shared replays held centrally for fetching are removed in principle 7 days after the match (up to 100 per person). What is kept while the account exists is what the person saved or obtained themselves, and public clear records. When the person deletes them, publication also stops. Public, participant-accessible and PC copies are handled as distinct; copies already obtained and copies on a PC may remain |
| Bans/review-pending/cheat verdicts/evidence | Protected for investigation/objections; indefinite-retention paths exist. Necessity is reviewed every 30 days, and reassessed using 12 months after lifting a ban as a reference |
| Reports/ordinary inquiries | Reports 180 days; ordinary inquiries 1 year after resolution. Security investigations differ |
| Purchases/entitlements/refunds/market ledgers/audits | Retained for transaction investigation, necessary legal retention and similar. There are durable records excluded from the periodic privacy cleanup |
| Backups/old migration copies/deletion ledger | Methods/generations differ by system. Ordinary backups at most 30 days; deletion ledger until relevant backups expire |
Continued retention needed for investigations/disputes/legal needs is limited by reason and scope. Refund/claim records may remain after shutdown. The training/research copy (P21) may remain after the Service ends.
5. Disclosure, outsourcing and visibility
Necessary processing includes displays to participants/friends, SIGVA ID/name to EOS, MoR order/entitlement reconciliation, Discord community functions and contracted operations providers. Ordinary acceptance is not permission for unrestricted third-party disclosure.
The MoR’s seller role does not determine the legal classification of outsourcing/third-party disclosure. Lawful official requests are handled after reviewing conditions. The Operator has no policy to sell personal data or supply it for advertising sales. External providers’ independent processing is not represented as identical.
AI training and research (section 3) are expected to run on computers the Operator controls. If an external provider’s computers are used, that provider is added to the recipients in section 11.
6. Processing abroad
The Service is offered worldwide from the start. Because Discord, EOS/EAC, Xsolla and others are used, we do not say that choosing a domestic host confines all processing to Japan. Pressing the first-launch button alone is not treated as satisfying every international-transfer condition.
7. Security
Token validation, token hashes, local DPAPI storage, transport encryption, authorization/rate limits and similar measures are in use. The direct UDP path has keys and an encryption-required setting. We do not say all data is encrypted.
Personnel/contractor scope, access management and incident/contact operations are verified and published. Required incident reporting and user notices follow applicable law.
8. Access, correction, restriction, deletion and withdrawal
- Send the request and necessary SIGVA name/friend code or other identifiers through the support desk on the official Discord (tickets; the main contact) or to support@sigva.games. Do not send Discord passwords, tokens or card numbers. Minimally necessary identity verification is carried out using authenticated links or similar.
- Requests are handled free of charge and without delay, and are normally answered within 30 days. If there is a delay, we explain the reason and expected timing; if we cannot comply, we explain the reason. This number of days is not treated as a universal statutory deadline.
- Withdrawing online acceptance differs from deletion and does not erase all records or stop Lite renewal. Terms Article 8 describes cancellation.
- Necessary transaction/investigation/ban evidence, legacy links, other-host recordings, logs/audits, backups and downloaded copies may remain. Some administrative recordings cannot remove one participant separately. A request under law is not refused unconditionally merely because data technically remains; we explain the restriction/deletion that is possible and the reasons/periods for retained data. Because the account ID and name are removed from the training/research copy (P21), it is not expected to be possible to find and delete one person’s part of it later. A copy already made remains after acceptance is withdrawn.
- The Operator cannot guarantee recall of every shared copy. Requests to Discord/EOS/EAC/the MoR may also be needed for their independently held data.
9. Minors
This matches the age conditions in Terms Article 3 (13 or older, guardian consent under 18, and the minimum age of the country of residence and of Discord). Because the Service is offered worldwide from the start, age conditions differ by country. Match records of people under 18 are also used for the purposes in section 3 (for AI training and research, as the copy with IDs removed). Ordinary SIGVA sign-in does not request a birth date or identity document. Purchases are made on the page of the seller (Xsolla). What age check is made on that page depends on the seller’s terms.
Guardians may raise concerns/requests subject to necessary verification. When use by someone below the eligible age is learned of, restrictions on use, necessary deletion and similar measures are checked and carried out. We do not say that a clicked declaration alone removes minors’ rights.
10. Cookies and device storage
Game settings/token storage differs from cookies in browser sign-in/purchase pages. We do not say that external pages do not use cookies because the game does not.
11. Outbound information and recipients
| Recipient | Main data/purpose |
|---|---|
| SIGVA services/Coordinator/match servers | IDs/authentication, name/acceptance, matches/inputs/ping/social/reports/rights; sign-in, matches, records/security |
| Discord | OAuth authorization/authentication; posts/tickets if community features used |
| Epic EOS/EAC | SIGVA ID/name authentication, PUID, connectivity/anti-cheat data |
| MoR (Xsolla) | Account/product reconciliation necessary for the purchase and information the user enters on the checkout page; payments/tax/refunds/security and similar. No policy to store unnecessary raw Discord IDs/card data with SIGVA |
| Hosts/email providers/future translation or assistance recipients | Content necessary for features used. Necessary explanations are added |
This document alone does not guarantee no pre-acceptance traffic.
12. Changes
When purposes, recipients, storage, visibility or similar matters are changed, the change and its effective date are notified and any necessary consent is obtained. Notice is ordinarily given 30 days in advance.
13. Inquiries and users outside Japan
Contact the support desk on the official Discord or support@sigva.games as in section 1. We respect applicable regional access, correction, deletion, restriction, objection and consent-withdrawal rights. The Service is offered worldwide from the start. We do not assert universal adequacy coverage for Japan, verified lawful worldwide availability or exemption from all foreign laws merely because advertising data is not sold.