Automated Image Checks
Profile avatars and banners, and images manually uploaded by server owners, are placed in private temporary storage and checked automatically before publication. While a check is pending, only the uploader can access the candidate image. Approved images are moved to public storage, rejected images are deleted, and images affected by a processing failure are retained for up to 48 hours for retry. Moderation metadata is retained for up to 30 days.
FindMates uses OpenAI as a service provider to analyse these images for prohibited content. OpenAI states that API data is not used to train its models by default and that abuse-monitoring logs may be retained for up to 30 days.
Community Submissions and Turnstile
For a community server submission, we process the supplied server name and address, observed public response data, and limited security signals such as a client fingerprint and network address to prevent abuse, apply rate limits, and investigate duplicate or harmful probes.
Guests complete Cloudflare Turnstile. The response token, remote network address, expected action, and hostname are sent to Cloudflare for validation. Tokens are not logged or reused, application event logs do not retain raw network addresses, and Cloudflare processes validation data under its own privacy terms.
Controller and Contact
FindMates is owned and operated by 8BIT CLOUD SYSTEMS S.R.L., with its registered correspondence address at Bucharest, Sector 2, 158 Calea Moșilor, Module 393, Room 4, 4th Floor, Romania. This address accepts postal correspondence and is not a walk-in support location.
Privacy contact: support{'@'}findmates.io
Data We Process
- Account and profile data: username, email, password hash, date of birth, gender, settings, profile text, media, language, location, game preferences, verification and account state.
- Social and communication data: friendships, blocks, reports, chat messages, shared server cards, uploaded chat media, and moderation records.
- Connected-service data: identifiers and authorised profile or game statistics from Steam, Discord, OpenDota, and similar providers.
- Server-owner data: owner account, descriptions, FAQ, endpoints, links, tags, versions, media, verification records, archive state, Votifier configuration flags, and promotion selections.
- Observed server data: online status, player counts, capacity, latency, version, map, MOTD, check results, errors, refreshes, impressions, clicks, saves, ratings, and aggregate analytics.
- Vote data: account ID, submitted in-game name, voter network address, target server, delivery status, and error details where Votifier is enabled.
- Billing data: Stripe customer, checkout, subscription, invoice, refund and dispute references; product, price, currency, period, consent record, and risk signals. FindMates does not intend to store full card details.
- Technical and security data: IP address, user agent, device/browser, sessions, timestamps, cookies, consent state, logs, rate-limit events, security events, and approximate country derived from network data.
Google Sign-In and YouTube Data
If you sign in with Google or link a Google account in your account settings, Google provides FindMates with your Google account identifier and verified email address. We use them only to create your account, sign you in, link or unlink Google sign-in, and keep your account secure. Other profile fields Google may include, such as your name or profile picture, are not stored. FindMates does not request access to your contacts, Google Drive, Gmail, calendar, or other Google data and does not store Google passwords or Google sign-in tokens.
If you connect a YouTube channel as a creator, FindMates requests read-only YouTube access (youtube.readonly). We use it only to read the ID, title, and address of the channels you own so you can choose a channel to show on your profile, and to periodically confirm that the connection is still valid. We store the selected channel's ID, title, and address together with encrypted access and refresh tokens. We do not read or change your videos, comments, subscriptions, or other YouTube content. By connecting a channel you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms); Google processes data under the Google Privacy Policy (https://policies.google.com/privacy).
- We do not sell Google user data, use it for advertising, or use it to develop, improve, or train generalised AI or machine-learning models.
- We do not share Google user data with third parties except infrastructure providers that operate FindMates on our behalf, when you ask us to, or when the law requires it.
- Google user data is protected by access controls and encryption in transit; YouTube tokens are also encrypted at rest.
- Deactivate account hides your account without deleting it; the linked Google sign-in and YouTube connection are kept, and signing in again, including with Google, reactivates the account.
- Delete account permanently deletes your account together with the linked Google account identifier and email, the YouTube connection, and the stored YouTube tokens.
- You can unlink Google sign-in and disconnect YouTube in your account settings at any time; YouTube tokens are deleted when you disconnect. You can also revoke FindMates' access at myaccount.google.com/permissions.
Sources of Data
Data comes from you, other users who interact with you or your content, public game-server endpoints, connected providers you authorise, payment and infrastructure providers, and technical activity generated when the service is used.
Purposes and Legal Bases
- Contract: create accounts, deliver profiles, chat, discovery, server listings, verification, votes, billing, Server Boost placement, support, and requested integrations.
- Legitimate interests: secure the service, prevent fraud and abuse, perform proportionate server checks, maintain reliability, enforce rules, defend claims, measure non-intrusive operations, and improve features.
- Consent: non-essential analytics, advertising storage, advertising personalisation, optional marketing, and optional integrations where consent is the appropriate basis.
- Legal obligation: accounting, tax, sanctions, lawful requests, consumer rights, reports about content, safety reporting, and regulatory compliance.
- Vital interests or public-interest grounds may be used in exceptional safety situations where the law allows.
Public Data and Search Indexing
Information set as public, including usernames, permitted profile fields, server pages, server media, ratings, and observed server status, can be viewed without an account and indexed, cached, quoted, or copied by search engines and third parties.
Archiving or deleting content removes it from active FindMates surfaces according to the feature, but copies controlled by search engines, recipients, backups, or independent sites may take additional time to disappear. Exact dates of birth are not intended to be returned in public profile responses.
Recipients and Independent Services
- Cloudflare and compatible storage/CDN providers for traffic delivery, security, caching, and media storage.
- Stripe for checkout, subscriptions, billing, refunds, fraud prevention, and payment records.
- Google services for consented analytics and advertising, including GA4 and AdSense.
- Email, hosting, database, queue, monitoring, and infrastructure providers used to operate FindMates.
- Steam, Discord, OpenDota, and other providers when you connect or request an integration.
- A target game-server operator when you submit an in-game name for a Votifier-enabled vote; the target server also receives network-level connection data.
- Authorities, advisers, insurers, acquirers, or courts where disclosure is lawful and necessary.
Retention
- Account and active feature data are normally kept while the account or feature is needed, then deleted or anonymised subject to backup, security, dispute, and legal requirements.
- Unattached pending server media may be deleted after 48 hours. Ordinary server archive retains attached media so the owner can restore the listing.
- Raw and aggregated server analytics are currently subject to a 90-day operational retention window unless a shorter period or lawful exception applies.
- Vote delivery records containing an in-game name or IP address are retained only for delivery, retry, fraud, and dispute needs and should be deleted or anonymised under the configured retention job.
- Billing, consent, refund, dispute, accounting, and tax records are kept for the period required by applicable law and legitimate claims.
- Report and appeal records are kept long enough to process the case, provide redress, prevent abuse, meet transparency duties, and defend legal claims.
Security and International Transfers
We use technical and organisational measures designed to protect data, including access controls, encryption in transit, secret handling, rate limits, audit records, and storage lifecycle controls. No online system can guarantee absolute security.
Providers may process data outside your country. Where GDPR transfer restrictions apply, we rely on an adequacy decision, contractual safeguards, or another lawful mechanism.
Users Aged 16 or 17
FindMates is not available to users under 16. We use date-of-birth information to enforce this threshold and to disable advertising personalisation for known users under 18.
Profiles for users aged 16 or 17 may remain public under the user's chosen settings. We encourage minors to limit profile details, avoid sharing precise location or contact information, use block and privacy controls, and contact support about unwanted contact.
Your Choices and Rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or information about certain disclosures. You may also complain to a supervisory authority.
Send requests to support{'@'}findmates.io. We may request proportionate information to verify identity and protect other users. See the GDPR Rights page for more detail.
Changes
We may update this policy when data practices, providers, features, or law change. We will identify the version and effective date and provide additional notice or request a new choice where required.
Private evidence
Report evidence includes selected messages and limited nearby context, including the reporter’s replies, authors, timestamps and accessible attachments. Full chat history is not disclosed. Evidence is private; staff access to legal cases is restricted to ADMIN/SUPERADMIN. Evidence access is audited. Evidence is removed 180 days after the case and appeals are finally completed unless a justified retention hold applies.