PRIVACY
POLICY.

Effective date: October 20, 2026 · Last updated: October 20, 2026

1. Who operates Powerbound

Powerbound (the “Service”) is a community combat power archive operated by the Powerbound Archive operator (“we,” “us,” or “our”). For privacy questions or data requests, contact info@insyc.digital.

2. Information we collect

• Discord profile information: when you authorize Discord sign-in, we receive your Discord account ID, username, display name, and avatar identifier through Discord’s identify OAuth scope. We use these details to create a session and associate your record with your account. We do not request access to your Discord messages or server list.
• Record information: the guild you select, in-game name and combat power you enter, the screenshot you upload, the date of submission, and the Discord account ID associated with the submission.
• Verification and session data: a one-time code is sent to your Discord direct messages. We store a protected digest of that code for up to 10 minutes, plus temporary rate-limit and attempt data. A signed session token lasts up to 7 days and the website signs you out after 5 minutes without activity. OAuth sign-in state expires after 10 minutes.
• Basic service request data: our hosting and infrastructure providers may process technical data such as IP address, browser headers, timestamps, and security logs when your browser connects to the site or API.

3. How we use information

We use information to sign you in, send the verification code you request, prevent abuse of the code flow, receive and store a screenshot, maintain the member leaderboard, allow the operator to review proof and export record data (including your Discord account ID), respond to support or deletion requests, and protect or operate the Service.

The verification code confirms that you can access the Discord account used for a submission. The Service checks that an image file is attached and has a supported image format; it does not automatically read or independently authenticate the game, name, or power shown in the image.

4. What other members can see

After you submit a record, your selected guild, in-game name, combat power, Discord display name, and record date appear on the community leaderboard for signed-in members who have also submitted a record. The leaderboard is not available to anonymous visitors or members who have not yet submitted their own record. Your Discord account ID, avatar identifier, verification code, and session token are not included in leaderboard responses.

Your screenshot is stored in a private object bucket, is not included in the leaderboard, and is available only to the service operator through an authenticated admin tool for proof review. The operator can export record details to a CSV file. Do not include information in your in-game name or screenshot that you do not want the Service operator to receive. Authorized leaderboard members can view and copy the leaderboard details.

5. How we share information

We do not sell personal information. We share or make information available only as described here:

• Member leaderboard: the record fields listed in section 4 are available to signed-in members who have submitted their own record.
• Discord: Discord handles OAuth sign-in and delivers the verification DM. Your use of Discord is also subject to Discord’s terms and privacy policy.
• Cloudflare: the Service uses Cloudflare Workers, KV, and R2 to run the API, hold temporary/session-related data and records, and store screenshots privately.
• GitHub Pages and Google Fonts: GitHub may host the website, and the site requests fonts from Google Fonts. Those providers may receive technical request data when your browser loads their resources.
• Legal and safety: we may disclose information when reasonably necessary to comply with law, respond to valid legal process, protect users or the Service, or investigate abuse.

These providers process information to provide their services to us. Their own privacy terms apply to information they process on their systems.

6. Retention and deletion

Verification codes and related attempt data expire after 10 minutes; OAuth state expires after 10 minutes; the signed session token expires after 7 days (and the website clears the browser session after 5 minutes without activity); and a code-request rate limit expires after 1 minute. A leaderboard record, its screenshot, and the date/version of your Terms acceptance remain while the record is active. If you submit a replacement record, the previous screenshot is removed after the replacement is saved.

You may request deletion of your record and associated screenshot by emailing info@insyc.digital and including the in-game name and Discord display name shown on the entry so we can locate it. We will use that information only to locate and process the request, and will delete the record and screenshot promptly unless retention is required by law. Copies in provider backups or security logs may persist for their ordinary rotation periods. You can also revoke Discord’s authorization to the Service in your Discord account settings; revocation does not itself delete an existing leaderboard entry, so contact us to request deletion.

7. Security and international processing

We use technical and organizational safeguards intended to limit access to information, including signed session tokens, five-minute idle sign-out, admin-only record and screenshot endpoints, short-lived verification codes, and private screenshot storage. No internet service can guarantee perfect security. Our providers may process information in countries other than yours, subject to their infrastructure and applicable safeguards.

8. Your choices and rights

You can choose whether to connect Discord or submit a record. If you have a privacy right under laws that apply to you—including rights to access, correct, or delete personal information—contact us at info@insyc.digital. We may ask for enough information to identify the entry before acting on a request. You may also raise a concern with your local data protection authority where applicable.

9. Children

The Service is not directed to children who are not permitted to use Discord under Discord’s minimum-age rules or applicable law. We do not knowingly seek to collect personal information from such children. If you believe a child has submitted information, contact us so we can review and remove it as appropriate.

10. Changes and contact

We may update this policy when the Service or applicable requirements change. We will update the effective date above when we publish a material change. Questions and data requests: info@insyc.digital.