Privacy Policy

Version 1.3, last updated 2026-10-23.

Who is responsible

Zone Intel is run by Adão Raul, a private individual, who is the data controller. Contact for anything about your data (questions, access, correction, deletion): adao.raul@gmail.com. You can also delete your account yourself in Settings.

What this is

Zone Intel is a free map and progress tracker for the game Gray Zone Warfare, a mature-rated game. You can use the map and tools as a guest. An account is only needed to keep your progress on the server and sync it between devices.

What we collect, and why

Only when you create an account:

• From Steam or Discord (the sign-in provider you choose): the provider's account id, your display name and your avatar URL (see Your avatar). From Steam OpenID we receive only your SteamID; from Discord we ask for the identify scope only. We receive no email address, friends list, game library or messages.
• What you enter: your profiles (up to three, one per faction), the tasks, objectives, keys and hideout levels you mark, and a few display settings.
• The weapon builds you save: a name you choose, the parts, a small picture of the 3D view, whether the build is private, link-only or public, and whether your display name is shown with it. Also the builds you like and the reports you file (see Saved and public loadouts and Likes, reports and moderation).
• Technical data to keep you signed in and the service safe: a session record (a hash of your session token, a hash of your browser's user-agent and a short label such as "Firefox on Windows", times of use) and security events (sign-in, link, unlink, delete, with your account id and no IP address or token).

We use this to run your account and the tool (contract) and to keep the service secure and working (legitimate interest). If you stay a guest, your progress stays in your browser and is not sent to us. The one thing a guest can send us is a report of a public build, which stores a hash of the IP address (see Likes, reports and moderation).

Cookies and tracking

We use no analytics, no error-reporting service, no advertising, no third-party scripts and no tracking cookies. The only cookies are strictly necessary: the session cookie (HttpOnly), a CSRF token that protects your requests, and a short-lived cookie during sign-in. Guests get none of them.

Your avatar

If your sign-in provider has a profile picture, the site shows it next to your name. Your browser loads it directly from the Steam or Discord image servers, which can therefore see that request and your IP address. We send no referrer with it. If you prefer not to make that request, do not sign in; guests see no pictures and make no such request. When the provider has no picture, or it fails to load, you see your initials instead.

Saved and public loadouts

With an account you can save weapon builds. A build is private until you change it: only you can open it. A link-only build can be opened by anyone who has its link; it is not listed in the gallery and cannot be liked. A public build can be opened by anyone, signed in or not, and is listed in a gallery with its name and picture. By default the author is shown as "a player". Your display name (the name from Steam or Discord, which follows the name your account has each time you sign in) is shown only if you switch on "Show my name" for that build. We never show your avatar, email, provider id or account id.

Sharing a build as a link stores nothing in our database: the build is in the link itself. You can share and open such links without an account.

When you save a build the app sends a small picture of its 3D view (a still WebP image of at most 64 KB). We keep it in our database until you delete the build, the picture or your account. It is shown to everyone while the build is public, and to you only while the build is private or link-only. We check that the file is a plain still image of the allowed size, without metadata or animation, but we cannot check what it shows; the operator can hide a picture. The export lists the picture's size, not its bytes.

Likes, reports and moderation

Likes. Signed-in people can like a public build (not their own). A like is stored with your account so you can undo it and so one account counts once. Others see only the number, never who liked.

Reports. Anyone who can open a build can report it, with or without an account. A report stores the reason (offensive, personal information, spam or other), the build and who reported: your account or, for a visitor without an account, a shortened one-way hash of the IP address, never the address itself. A hash of an IP address can still be personal data, and we treat it as such. One person can report a build once. Only the operator reads reports, and the author is not told who reported.

Moderation. The operator can hide a build, which then shows to nobody but its owner, and can delete it. A hidden build is deleted 180 days after it was hidden.

The gallery is part of the feature you switch on (contract); reports and moderation are needed to keep the service lawful and safe (legitimate interest). Someone who publishes a name that identifies another person is responsible for it. The data is in the same database as the rest, so the list of processors is unchanged.

Who else handles data

Cloudflare (hosting and content delivery; it keeps standard request logs such as IP addresses), Supabase (our database, in the EU, Frankfurt region) and GitHub (where the code is kept; no user data). Steam and Discord are the sign-in providers and have their own privacy policies. We do not sell data, do not share it for advertising and make no automated decisions about you. We do not transfer your data anywhere beyond these providers.

How long we keep it

Delete your account in Settings and all profiles and progress, the builds you saved, your likes and the reports you filed are removed immediately; builds you made public leave the gallery at once and your likes leave their counts. Accounts with no sign-in for 24 months are deleted in the same way by the clean-up described below; we hold no email address, so we cannot warn you: you would simply lose the account, so export your data whenever you like (Settings, Export; it includes your builds, likes and reports). Session records expire on their own. Security events are kept 90 days, then deleted. A report is kept while it is open; once closed it is deleted when it is more than 90 days old.

These time limits are applied by a clean-up that the operator runs by hand; it has no automatic schedule yet, so something can stay for some time after its limit has passed.

Your rights

Under the EU/UK GDPR you have the right to access your data, have it corrected, erased or restricted, to receive it in a portable form (the JSON export in Settings, which includes your saved builds, likes and reports), to object to processing and to complain to your data protection supervisory authority. Write to adao.raul@gmail.com and we will answer within one month.

Age

Account features are for people aged 16 or older.

Changes

If this policy changes we will post the new version here with a new date and a line in the changelog below.

Changelog

• 1.3 (2026-10-23): saved, public and liked loadouts, their pictures, reports and moderation are described (Saved and public loadouts, Likes, reports and moderation), and the retention and export statements now cover them.
• 1.2 (2026-10-23): a plain-language summary at the top and a list of sections; the policy itself is unchanged.
• 1.1 (2026-10-23): profile pictures from Steam and Discord are shown (Your avatar).
• 1.0 (2026-10-23): first version.

See also Terms of Service and About the data.