Privacy Policy

Last updated: October 7, 2026

This Privacy Policy explains how WinnerMeta ("we", "us", "our", or "the Website") collects, uses, and protects your information when you use our services. This policy is designed to comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

By using this Website, you agree to the practices described here.

1. Data Controller

The data controller responsible for your personal information is:

Wilson (Solo Developer of WinnerMeta) You can contact us at the Contact Page or through the social networks linked there.

2. Information We Collect

2.1 Personal Information

When you create an account or log in, we collect:

Account Information: Username, email address, password (stored as a one-way hash)
Support messages: Name, email address, and message content that you submit through the contact form; signed-in reports may include the public player/broadcaster details and message you choose to report.
Profile Information: Any information you choose to add to your profile
Authentication Data: If you use social login, we may receive your name and email from the social platform

2.2 Automatically Collected Information

We automatically collect certain information when you visit our Website:

Usage Data: Pages visited, time spent, interactions with features
Technical Data: IP address, browser type, device information, operating system, and basic request/security metadata
Cookie Data: Information collected through cookies and similar technologies (see Section 4)
When you use WinnerMeta's public AI/MCP connection, the request may also contain tool inputs you provide (for example a PUBG weapon or player name) and the resulting public statistics.

2.3 PUBG Game Data

Public Game Statistics: We collect publicly available PUBG match data, player statistics, and telemetry from official PUBG APIs
Streamer Information: We collect publicly available Twitch streamer information for our VOD analysis features
This data is public information made available by PUBG Corp and Twitch

3. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

Consent: When you accept our cookie banner, you consent to analytics and advertising cookies
Contract Performance: Processing necessary to provide our services (account management, features, and responding to support requests)
Legitimate Interests: Improving our services, security, fraud prevention
Legal Obligations: Complying with applicable laws and regulations

4. Cookies and Tracking Technologies

4.1 What Are Cookies

Cookies are small text files stored on your device when you visit our Website. We use cookies to enhance your experience and provide certain features.

4.2 Types of Cookies We Use

Necessary Cookies (Always Active)

Essential for the Website to function properly
Enable basic features like page navigation, authentication, and security
Cannot be disabled as they are required for the Website to work

Analytics Cookies (Optional - Requires Consent)

Google Analytics: Tracks how visitors interact with our Website, including page views, session duration, and user flows
Tianji Analytics: Privacy-focused analytics to understand usage patterns and improve our services
These cookies help us understand what features are most valuable and where we can improve

Advertising Cookies (Optional - Requires Consent)

Google Ads: Delivers relevant advertisements based on your interests
Google AdSense: Displays advertisements on our Website and tracks their performance
These cookies may track you across different websites to build an advertising profile

4.3 Managing Cookies

You can manage your cookie preferences at any time:

Click "Cookie Settings" in the footer of any page
Adjust your preferences in your browser settings
Note that disabling necessary cookies may affect Website functionality

4.4 Cookie Retention

Analytics and advertising cookies expire after 24 months
Session cookies are deleted when you close your browser
Your consent preferences are stored indefinitely in your browser

5. How We Use Your Information

We use your personal information for the following purposes:

5.1 Service Provision

Creating and managing your account
Providing access to PUBG statistics and analytics
Personalizing your experience
Communicating important updates about the service

5.2 Analytics and Improvement

Understanding how visitors use the Website (with consent)
Identifying technical issues and bugs
Improving features and developing new ones
Measuring the effectiveness of our content

5.3 Advertising

Displaying relevant advertisements (with consent)
Measuring ad performance
Supporting the free operation of the Website

5.4 Legal and Security

Preventing fraud and abuse
Enforcing our Terms of Service
Complying with legal obligations
Protecting our rights and those of our users

6. Third-Party Services and Data Sharing

6.1 Analytics Providers

Google Analytics (Privacy Policy): Processes anonymized usage data on servers in the United States
Tianji Analytics (self-hosted): Privacy-focused analytics with data stored on our servers

6.2 Advertising Partners

Google Ads (Privacy Policy): Delivers and measures advertisements
Google AdSense (Privacy Policy): Serves ads on our Website

6.3 Data APIs

PUBG API: We retrieve public match and player data from PUBG Corp's official API
Twitch API: We retrieve public streamer and VOD information from Twitch

6.4 Infrastructure Providers

Hosting and cloud services for Website operation
Email service providers for account-related communications
Security and network providers (including Cloudflare, where enabled) may process connection metadata such as IP address, request time, and endpoint to deliver and protect the service.

6.5 AI assistants and the public MCP connection

WinnerMeta offers a read-only MCP connection that compatible AI assistants (including ChatGPT) can use to request PUBG weapon and attachment statistics, popularity rankings, basic player statistics and retained match counts, stream appearance counts, ranked leaderboards, and player profile matches. Public reads do not require account linking.

Optional account linking. You may authorize an assistant through WinnerMeta's OAuth consent page to read your saved favorite players and detailed stream appearances. Your existing account permissions also determine access to richer analytics and retained match details. We process your account identifier, client registration details, authorization scopes, token records and their expiry/revocation status to authenticate requests and enforce those permissions. Login takes place on WinnerMeta; do not send passwords, access tokens or other authentication secrets in a chat or tool input. The MCP tools do not change your account or make purchases.

Recipients and purpose. The assistant provider receives the tool results you request, including account-specific favorites or appearance details when authorized, to answer your request. The public-data and infrastructure providers described in this section may process the inputs and technical metadata necessary to deliver and secure the service. The assistant provider handles received results under its own privacy policy and retention rules.

Your controls. You can revoke future access through AI connections and disconnect WinnerMeta in the assistant's settings. Revocation invalidates the connection's authorization codes and access/refresh tokens; it does not erase information already received by the assistant provider. For access or deletion requests, use our contact page. OAuth token/code bodies are excluded from application request capture.

Website versus MCP. The website cookie, analytics and advertising disclosures above describe visits to our website, including browser visits for login and consent. The MCP tool interface returns data, not website advertising or analytics scripts. Its operational logging is described below.

When you ask an AI assistant to use WinnerMeta, the assistant sends the relevant tool request to our service. This can include the weapon/category or player name needed to answer. The assistant provider independently processes your conversation and tool use under its own privacy policy and settings; review that provider's terms before use. WinnerMeta receives the tool request and returns the requested public result, but does not receive the rest of your conversation unless it is included in a tool input.

The MCP integration's application logs record limited operational metadata (such as tool name, duration, and outcome), not tool arguments or player names. Request-body capture is excluded from Laravel Telescope for this endpoint. The integration reuses the website's public-data caches instead of storing a separate copy of every tool response. Weapon and published five-day player-stat caches have a total lifetime of up to 72 hours. Player-search and optional upstream lookup caches expire after up to two hours; stored lifetime stats and ranked seasons after up to 12 hours, ranked leaderboard entries after up to six hours, and retained-match/appearance counts and recent detail caches after up to 30 minutes. Our hosting, network/security providers, and upstream game-data providers may separately process request or public game data under their own terms and retention practices; their exact access-log retention is not controlled by this MCP integration.

We do not sell your personal data to third parties.

7. International Data Transfers

Our Website is hosted and some of our service providers (including Google) operate servers in the United States and other countries outside the European Economic Area (EEA).

When we transfer your data outside the EEA, we ensure adequate protection through:

Standard Contractual Clauses approved by the European Commission
Relying on service providers who participate in recognized certification mechanisms
Your explicit consent where required by law

8. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

Account Data: Retained until you delete your account, then deleted within 30 days
Analytics Data: Aggregated and anonymized after 26 months (Google Analytics default)
OAuth Authorization Records: Access tokens expire after one hour and refresh tokens after 30 days. Revocation prevents future use but does not itself delete stored authorization records. There is currently no scheduled automatic purge of these records; expired or revoked records remain stored until separately removed. Contact us to request deletion, subject to applicable legal and security obligations. Client registration records are separate from your individual account connection.
Usage Logs: The application's daily rotating log channel defaults to keeping 14 daily files; runtime configuration and other log destinations can have different retention. This is not a universal deletion deadline for all infrastructure logs. The MCP integration's tool logs record tool name, duration and outcome, not tool arguments or player names. Technical request metadata (including IP/security logs) may also be processed by infrastructure providers under their own retention policies. Contact us for requests concerning your technical data.
Legal Data: Retained as required by law (e.g., tax records for 7 years)
Public Game Data: Retention varies by dataset and maintenance process; public availability does not mean every record is retained forever. Some historical statistics and player/streamer records have no fixed deletion date. You may contact us about records associated with you. The AI integration shares expiring public-data caches with the website; weapon and five-day player-stat caches expire after up to 72 hours, with shorter expiries for search, ranked leaderboards, and other player reads as described above. Cache expiry does not delete underlying game records.

9. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), UK, or Switzerland, you have the following rights:

9.1 Right to Access

You can request a copy of the personal data we hold about you.

9.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

9.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data in certain circumstances.

9.4 Right to Restrict Processing

You can request that we limit how we use your personal data.

9.5 Right to Data Portability

You can request a copy of your data in a structured, machine-readable format.

9.6 Right to Object

You can object to our processing of your personal data based on legitimate interests.

9.7 Right to Withdraw Consent

You can withdraw your consent for cookie use at any time by clicking "Cookie Settings" in the footer.

9.8 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority if you believe we have violated your privacy rights.

9.9 Exercising Your Rights

To exercise these rights:

Visit your Profile Settings when logged in
Use the account deletion feature to delete your account at any time
Contact us through the Contact Page for specific requests, including a request to remove a support message where legally and operationally possible

We will respond to your request within 30 days.

10. Children's Privacy

WinnerMeta is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete it.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

Encryption: Passwords are hashed using industry-standard algorithms
HTTPS: All data transmission is encrypted using SSL/TLS
Access Controls: Limited access to personal data on a need-to-know basis
Regular Security Audits: We regularly review our security practices

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

Updates will be published on /privacy-policy
We will update the "Last updated" date at the top
For material changes, we may provide additional notice (e.g., email notification)
Your continued use of the Website after updates means you accept the changes

We encourage you to review this policy periodically.

13. Do Not Track Signals

Some browsers have a "Do Not Track" (DNT) feature. Our Website does not currently respond to DNT signals. However, you can control cookies through our cookie consent banner and your browser settings.

14. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

Contact Page: /contact
Data Protection Requests: Use the contact form and specify "Data Protection Request" in your message
Developer: Wilson (Solo Developer)

We will respond to your inquiry within 30 days.

15. Additional Information for Specific Regions

15.1 California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to know what personal information is collected
Right to delete personal information
Right to opt-out of the sale of personal information (we do not sell personal information)

15.2 UK Residents

For UK residents, the data controller is Wilson, and the applicable law is the UK GDPR and Data Protection Act 2018.

Thank you for trusting WinnerMeta with your data. We are committed to protecting your privacy and being transparent about our data practices.