Privacy Policy

1. Who we are

Counterwatch is operated by Supre.me AB (Swedish company registration number 559424-3163), a company registered in Sweden. Supre.me AB is the data controller for personal data processed through the Counterwatch website (counterwatch.gg) and the Counterwatch desktop application, which comes in two versions: the app distributed via Overwolf, and Counterwatch Standalone, which runs on Overwolf's ow-electron technology without the Overwolf client. This Privacy Policy covers all of them and explains what we collect, why, and what rights you have. Where the two desktop versions differ, it says so.

Because we are established in the EU, we are not required to appoint an Article 27 EU representative. We have not appointed a Data Protection Officer. You can reach us about any privacy matter using the contact details in section 14.

The Overwolf client has its own privacy policy governing the Overwolf platform itself. This policy is not an agreement with Overwolf.

2. Personal data we collect

Depending on how you use Counterwatch, we may collect or receive the following categories of data.

3. How we use personal data

• To provide and operate Counterwatch services and features.
• To authenticate users and manage accounts.
• To produce community statistics, shown in aggregate on the website, and live-match features, shown in the desktop app, from the match data we observe.
• To keep an archive of whole matches, with identifiers replaced by random codes, so we can work community statistics out again and research new features (see section 2).
• To improve the app and website, fix bugs, measure performance, and develop new features.
• To process subscription payments and meet our bookkeeping obligations.
• To monitor, diagnose, and fix errors and crashes.
• For advertising in the desktop app (through Overwolf, as applicable to your user tier) and to serve and measure third-party display ads on the website (through Nitro). See sections 6 and 9.
• For audits, fraud prevention, security, and compliance.

4. Legal bases for processing (GDPR)

Where GDPR applies, we rely on the following legal bases:

• Contract: to provide the service you sign up for, including account authentication.
• Consent: for website analytics cookies (Mixpanel and Google Analytics), for website advertising and ad cookies (Nitro and its ad partners) where consent is required, for providing your hashed email to our website ad partner for ad matching (see sections 2 and 9), and for desktop-app advertising features where consent is required. You can withdraw consent at any time (see section 12).
• Legitimate interest: for security, fraud prevention, and the reliability of our service, and to record observed players' in-game identifiers and match stats so we can produce community statistics and live-match features, and to keep the match archive those statistics can be worked out from again (see section 5).
• Legal obligation: to keep payment and accounting records for the period required by Swedish bookkeeping law.

5. Players observed in matches (legitimate interest)

Counterwatch's value comes from real match data. To produce hero win rates, counters, and synergies, and to power the app's live-match overlay, we record in-game identifiers and match stats for the players seen in tracked matches. Most of those players are not Counterwatch users. We process this data under the legitimate interest basis in Article 6(1)(f) GDPR.

What we collect: in-game identifiers (BattleTags, NetEase ids), the heroes played, and per-match performance stats. For Overwatch we may add public profile information from Blizzard's public profile pages, which we use to show individual player profiles in the app. Our community statistics come from this live match data, not from profile pages. We do not collect contact details, real-world identity, or any special-category data about observed players.

Our balancing test, in short: the data is already visible inside the game to everyone in the match; we use only what the game exposes; we do not build advertising profiles from it, contact observed players, or sell it; and aggregate statistics benefit the whole player community. We keep the footprint minimal and redact identifiers when someone objects.

The match archive: the full match copies described in section 2 fall under the same basis and the same limits. They exist so a statistic can be worked out again from the matches themselves when we change or fix how it is calculated, and so we can research new features on real matches. In the copy we keep, a player is a random code, not an identifier or a name, and the table linking codes to identifiers is stored apart from it. A coded copy is still personal data while that link exists. If you object or ask for erasure, we delete your entry from the table, and the archived matches can no longer be tied to you.

Children: Overwatch and Marvel Rivals are played by minors, so the players we observe can include children. We treat their data with the same limits: we use only the in-game identifiers and gameplay stats the match already shows everyone, we never collect contact details or special-category data, we do not build individual advertising profiles, and what we publish is aggregate. The right to object and to request removal applies equally, and we act on it the same way.

Where it appears: the website currently shows community statistics in aggregate only. It does not list individual players. The desktop app shows individual players for your own matches, the same information the game itself shows you on the scoreboard.

Your right to object: if you are an observed player and you do not want us to process your in-game identifier, you can object or ask us to remove it on the Data requests page. Because we must avoid deleting another person's data, we verify a reasonable connection to the identifier before acting, and we respond within one month.

6. Cookies and similar technologies (website)

The website uses cookies and browser storage to keep you signed in, to understand which features people actually use so we can improve them, and to serve and measure third-party display ads (Nitro and its ad partners). In the EU, EEA, and UK, analytics and advertising cookies load only after you consent through the consent banner.

In the EU, EEA, and UK, analytics and advertising cookies are only activated after you accept them in the consent banner. You can change your choice at any time using the "Cookie settings" link in the footer. California residents can opt out of the sale or sharing of personal information using the "Do Not Sell or Share My Personal Information" link in the footer (see section 12).

7. Analytics and error diagnostics

8. Which users have hashed emails

Hashed email and advertising behaviour differs between the desktop app and the website, because each uses a different advertising partner. Section 2 explains what a hashed email is and how to opt out of each.

Desktop app (Overwolf)

Website (Nitro / NitroPay)

On the website, the hashed email is only provided where ads are shown, so subscribers never have one sent. Ads run on our stats and blog pages only.

9. Sharing personal data

10. International data transfers

Supre.me AB is based in Sweden, and some of our processing happens outside the European Economic Area, so your personal data may be transferred internationally. Our website, backend services, and self-hosted error tracker (Bugsink) run on Amazon Web Services in the United States (the us-east-1 region). Other providers, including Mixpanel and Google, are also in the United States. For these US transfers we rely on the EU-U.S. Data Privacy Framework and, where applicable, Standard Contractual Clauses (SCCs); Google, AWS, and Mixpanel are certified under the Data Privacy Framework. Our payment provider, Tebex, is in the United Kingdom, which the European Commission recognises as providing an adequate level of data protection. Our website advertising partner Nitro is operated by Overwolf Ltd in Israel, which the European Commission recognises as providing an adequate level of data protection. The advertising partners Nitro shares ad-request data and the hashed email with, including Google and its ad exchanges under Google MCM, Amazon and LiveRamp, may process it in the United States and other countries; for those transfers we rely on the EU-U.S. Data Privacy Framework and, where applicable, Standard Contractual Clauses. Each provider is contractually bound to protect your data.

11. Data retention

• Account data: retained for the life of your account. You can request deletion at any time (see section 12).
• Observed-player data: kept while it is relevant to current community statistics and the app's live features. If you object and we verify your connection to an identifier, we redact or remove it within one month.
• Match archive: 24 months from the upload, then deleted automatically. An upload that still carries in-game identifiers is deleted within one month. Your entry in the table that links codes to identifiers is deleted about 25 months after the last upload you appear in, and sooner when your account is deleted or when you object or ask for erasure.
• Payment and accounting records: retained for about 7 years to comply with Swedish bookkeeping law (Bokföringslagen). We cannot delete these earlier on request.
• Website analytics data: Mixpanel up to 12 months from collection, then anonymized or deleted. Google Analytics user-level and event-level data is retained for 14 months; aggregated reports may be retained longer by Google.
• Website advertising and consent data: ad cookies set by Nitro and its partners expire per the durations in section 6. Your EU consent choices are stored in the consent platform cookies (euconsent-v2 / ncmp-cc) for up to 12 months, and a California opt-out (CCPAOPTOUT) stays on your device until you clear it.
• Website hashed email: the copy held in your browser lasts for the current tab session only, and we clear it as soon as you sign out. Once the hash has been shared with Nitro and its advertising partners, how long each of them keeps it is set by their own retention policies, which we do not control.
• Support correspondence: up to 24 months after the matter is resolved.
• Counterwatch Standalone diagnostic logs: deleted automatically 30 days after upload.
• Error and crash diagnostics: stored in our self-hosted error tracker, which keeps a limited number of recent events and automatically evicts older or less relevant ones rather than holding them for a fixed period.
• We may retain specific records longer where required to comply with legal obligations, resolve disputes, or enforce agreements.

When we delete personal data, residual copies may remain in encrypted backups until those backups age out on a scheduled roll-off. We do not surgically edit individual records out of backups.

12. Your rights and choices

You have the right to access, rectification (correction), erasure (deletion), restriction of processing, data portability, and objection. To exercise any of these, use the Data requests page.

• Verifying your identity: the website does not have a login. If you have a Counterwatch account, email us from the email address on your account so we can confirm it is you. If you are an observed player without an account, tell us the game and the exact in-game identifier; because we must not delete another person's data, we may ask for more information and may decline a request where we cannot reasonably establish that the identifier is yours.
• Timing and limits: we respond within one month. For complex or numerous requests we may extend this by up to two further months, and we will tell you within the first month if we need to. Some data is kept regardless of your request: payment and accounting records are retained under bookkeeping law, and copies in encrypted backups age out on a roll-off schedule rather than being edited individually.
• Withdraw consent: in the EU, EEA, and UK you can change or withdraw cookie consent (analytics and advertising) using the "Cookie settings" link in the website footer, which reopens the consent manager. Withdrawing advertising consent also stops the website's hashed email being provided to our ad partner. Outside the EU, EEA, and UK you can stop it using the "Do Not Sell or Share My Personal Information" link in the footer, or by sending the Global Privacy Control (GPC) browser signal. In the desktop app you can opt out of hashed email usage under Settings, App Behavior, "Personalized ads", and via Overwolf client settings ("Use data to customize Overwolf for you").
• Object: you can object to processing based on legitimate interest, including our processing of observed players' in-game identifiers (see section 5).
• Lodge a complaint: with a supervisory authority (see section 13).
• California residents: the website shows programmatic third-party display ads, and for signed-in visitors who see ads it also provides our ad partner with a hashed (SHA-256) version of your email address for ad matching (see sections 2, 8 and 9). Under California law (CPRA), both may count as "sharing" personal information for cross-context behavioral advertising. We do not sell your personal information for money. You can opt out of this sharing using the "Do Not Sell or Share My Personal Information" link in the website footer, which records your choice on your device, and we honor the Global Privacy Control (GPC) browser signal as a valid opt-out. Both stop the hashed email being provided. Apart from website advertising, Google Analytics and Mixpanel act as our service providers for first-party analytics only. You can also request access to or deletion of your information using the email in section 14. The desktop app's advertising is governed separately (see sections 2, 8, and 9). If you live in another US state with a comprehensive privacy law, such as Colorado, Connecticut or Virginia, the same opt-out routes apply to you, and if we refuse a rights request you may appeal that decision by replying to our response or writing to the address in section 14. We will tell you the outcome and our reasons.

13. Supervisory authority

If you are in the EU / EEA and you believe we are processing your data unlawfully, you have the right to lodge a complaint with a supervisory authority. The authority for Sweden is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), available at imy.se.

14. Contact information