Privacy Policy

This policy explains what information the100.io collects, why, who else handles it, how long we keep it, and what you can do about it. We've tried to describe what the site actually does, not everything it might conceivably do. If something here doesn't match what you see, tell us at [email protected].

The short version

• We collect what we need to find you people to play with: your email, gamertag and platform IDs, rough age, play schedule, play style and time zone, plus the sessions and groups you join.
• Your profile, your gamertags and platform IDs, and the sessions and groups you join are public.
• We don't sell your personal information, we don't share it for targeted advertising, and we don't show ads.
• A short list of service providers runs parts of the site for us: hosting, email, chat, payments, analytics and error reporting.
• You can delete your account yourself from your profile settings. Doing that also cancels any monthly contribution.
• You can turn off any type of email from the links at the bottom of each email, without logging in, and turn push notifications off in your settings.

Contents

1. Who we are
2. What we collect
3. Connected gaming accounts (Discord "connections")
4. What other people can see
5. How we use your information
6. Cookies and analytics
7. Service providers
8. Other sharing, and what we don't do
9. Your email and notification choices
10. How long we keep things
11. Deleting your account
12. Your rights
13. Children and teens
14. Where your information is stored
15. Security
16. Other sites and services
17. Changes to this policy
18. Contact us

Who we are

the100.io (the website, the The100.io mobile app, our Discord bot and our Slack app) is run by Resonant Ventures, LLC, 14729 Shore Acres Dr, Bigfork, MT 59911, USA. In this policy "we" and "us" means Resonant Ventures, LLC. Under data protection laws such as the GDPR, we are the "controller" of the personal information described here.

What we collect

Your account and profile

When you sign up, or later in your profile settings, you give us:

• Account details: your email address, a gamertag (display name) and a password. We store passwords only as a one-way hash, never in readable form. If you sign up with Discord, you don't need a password.
• Gaming details: your main platform and any platform IDs you add (for example Xbox gamertag, PlayStation Network ID, SteamID, Battle.net, Epic, EA, Ubisoft, Bethesda, Riot or Bungie name), your main game and the games you play, and your Destiny power level if you enter it.
• Matchmaking details: your rough age (sign-up asks for an age bracket such as "twenties"; you can set an exact age later), your play schedule, play style (casual or serious), hours played per week, whether you use a headset, whether you're fine with profanity, your time zone and region, and tags describing what you like to play.
• Optional profile details: gender, a description of yourself, a profile picture and a header image.
• Your settings: notification preferences, chat sounds, font size and similar choices.

Signing in with Discord

If you sign up or log in with Discord, Discord asks your permission to share your Discord user ID, username, avatar and email address with us (Discord's identify and email permissions). We use these to create your account and sign you in. Separately, you can choose to let us read the gaming accounts you've linked to Discord; that's explained under Connected gaming accounts below.

Linking a Bungie.net account

If you choose to connect your Bungie.net account in your profile settings, Bungie sends us an access token, a refresh token, and your Bungie membership ID and display name. We use them to read your Destiny power level from Bungie. You can revoke our access on Bungie.net at any time.

What you do on the100

• Gaming sessions you create, join, leave or are added to, and groups (clans) you create, join or moderate.
• Friends you add, karma you give and receive, no-show reports, feedback you leave after a session, and reports you file about other players.
• Ideas you post and vote on in our public feature request board.
• Messages you send through our support form, along with the page you were on and your browser type, so we can reproduce problems.
• When you open a session from a link someone shared, we record that the visit came from a shared link, which channel it was shared on (for example Discord or Reddit), and who shared it. A random token in your session cookie lets us tell whether that visit later turned into someone joining.
• When you were last online and last active, which we use to keep groups and matchmaking current.

Chat and messages

Group chat, session chat and private conversations are stored in Google's Firebase database along with your user ID, gamertag and avatar. Our own database records which two members each private conversation is between, and holds some older private messages. Members of a group can read that group's chat, and the people in a conversation can read it. We can read chat when we need to, for example to look into a report of abuse.

Emails, push notifications and our send log

• We keep a log of each automated email, push notification, in-site message and Discord post we send (or decide not to send), recording what kind it was, who it was for and when.
• Our email provider, Mailgun, reports back whether each email was delivered, bounced, opened or clicked (detected with a small image and redirected links), marked as spam, or unsubscribed from. We store those results in the log, and we use bounces, spam reports and unsubscribes to stop sending to you automatically.
• If you use the mobile app and allow notifications, we store your device's push token and the delivery receipts that come back for each push.

Payments

If you contribute to the100, the payment is handled by Stripe or PayPal on their own pages. We never see or store your full card number. We keep your Stripe customer and subscription IDs, any alternate email you give for Stripe, PayPal transaction IDs, and the amount and date of each contribution, so we can give you supporter perks and handle billing questions.

Technical data and logs

Like most websites, the servers and services that run the100 automatically record technical data for each request: your IP address, browser and device type, the page requested and the time. This data is kept in our hosting provider's logs, by Cloudflare (which sits in front of the site), and in error reports and performance traces. We use IP addresses briefly to limit abusive traffic; we don't store your IP address in your account. We don't collect your precise location. The time zone and region on your profile are ones you choose.

Information other people give us about you

Other members can add you to a session, invite you to a group by email, give you karma, or report you. If a member invites an email address that has no account, we use that address only to send that invitation and don't add it to any mailing list.

What other people can see

the100 exists to help strangers find each other, so a lot of it is public by design:

• Your profile is public, to anyone and through our public profile API. That includes your gamertag, avatar, platform and platform IDs, gender if you set it, time zone, region, play schedule and style, description, tags, karma and activity. Your age is shown on your profile page only if you choose to show it; new accounts created on the website start with it hidden.
• Sessions and groups, including who has joined them, are public unless the group is private or the session is limited to a group or to friends. Session rosters show your platform IDs, including as buttons such as "Add on Steam", so the people you play with can find you.
• Discord and Slack. If a group connects our Discord bot or Slack app, we post session activity (for example "gamertag joined session") in that server's or workspace's channel. When you join a group with Discord connected, we also post a welcome there with your gamertag and, if you've filled them in, your play style, platform and play schedule. Those posts are then also covered by Discord's or Slack's policies.

Search engines can index public pages. Anything you write in a public description or session title can be seen by anyone.

How we use your information

• To run the service: creating your account, showing and organizing sessions and groups, chat, and the features you choose to use.
• Matchmaking: when you sign up we automatically suggest or place you in a group and suggest sessions, based on your game, platform, play schedule, age range, play style and region. You can leave any group at any time.
• Notifications: emailing you, pushing to your phone, or posting in your group's Discord about sessions, groups, messages and reminders, according to your settings.
• Occasional emails from us about the100 itself, such as a digest of new sessions, a nudge to rebook a session that went well, or a note from the site owner if you've been away. Each type can be turned off (see your email and notification choices).
• Safety and abuse prevention: spam and bot checks, rate limits, player reports and blocks.
• Support: answering your questions and fixing the problems you report.
• Understanding and improving the site: page-view analytics, and statistics such as how many people joined sessions this week. Our internal statistics are counts and percentages, not profiles of individuals.
• Contributions: processing payments and providing supporter perks.
• Legal reasons: keeping records the law requires and responding to valid legal requests.

We don't make decisions about you that have legal or similarly significant effects based solely on automated processing.

Cookies and analytics

Cookies are small files your browser stores for a website. We set these ourselves:

• _pwntastic_session: keeps you signed in during a visit and holds security tokens (for example, the one that protects the Discord sign-in flow) and the shared-link token described above. The site needs it to work.
• auth_token: an encrypted cookie that keeps you signed in between visits until you log out.

Other services we use set or read their own cookies or similar technology:

• Google Analytics helps us measure how the site and app are used. It may set cookies such as _ga. You can block it with Google's opt-out browser add-on.
• Plausible Analytics and Cloudflare Web Analytics count page views without cookies.
• Google reCAPTCHA runs on the sign-up and new-session forms to tell people from bots.
• Cloudflare may set cookies to protect the site from bots and attacks.
• Stripe and PayPal on contribution pages, and Firebase on chat pages.
• YouTube videos embedded on some pages (for example our Discord bot and about pages, and videos groups add to their pages), and X (Twitter) when a chat message embeds a tweet. These load from YouTube or X, which may set their own cookies.

We don't use advertising cookies. You can set your browser to refuse cookies, but you won't be able to stay signed in without them.

Service providers

These companies process information on our behalf to run the100. They get what they need for the job listed, and their handling of it is also covered by their own terms and privacy policies.

Some pages also load fonts, icons or scripts from third-party networks (Google Fonts, Font Awesome and cdnjs), which see your IP address when your browser fetches them.

Other sharing, and what we don't do

We don't sell your personal information, and we don't share it for cross-context behavioral (targeted) advertising. We don't run ads on the100. Apart from what you choose to make public and the service providers above, we share personal information only:

• When the law requires it, for example in response to a valid court order or a request from a public authority.
• To protect people and the service: to prevent or investigate wrongdoing, protect the safety of our users or the public, defend our rights or property, or protect against legal liability.
• If the business changes hands. If Resonant Ventures, LLC is involved in a merger, acquisition or sale of assets, your information may be transferred. We'll post a notice on the site before your information is transferred and becomes subject to a different privacy policy.

Your email and notification choices

• Every email we send about sessions, groups or the100 itself has links at the bottom to turn off that type of email, manage all your email settings, or unsubscribe from everything. They work without logging in. Some email apps may also offer a one-click unsubscribe button for our emails.
• You can also change email and push settings, type by type, in your profile settings.
• Emails you need in order to use your account, such as password resets and account confirmation, are sent even if you've unsubscribed from everything.
• Our emails include our postal address: 14729 Shore Acres Dr, Bigfork, MT 59911, USA.
• You can turn push notifications off in your profile settings or in your phone's settings.

How long we keep things

• Your account and profile: until you delete your account.
• Email and push send log, and push delivery receipts: 180 days, then deleted automatically.
• Notifications in your notification list: 16 months.
• Player reports: 45 days.
• Activity feed items: about a month.
• Group memberships: many groups remove members who haven't been active for 45 days, after warning them by email.
• Server logs, error reports and performance data: for the limited period our hosting, error-reporting and monitoring providers keep them.
• Payment records: Stripe and PayPal keep their own records of payments, as financial laws require.

We may keep information longer when we need it to resolve a dispute, enforce our terms or meet a legal obligation.

Deleting your account

To delete your account, sign in on the website, open your profile settings (Edit Profile), and use Permanently Delete Account in the "Danger Zone" at the bottom. Deletion is immediate and can't be undone.

What it deletes: your profile, email address, password, platform IDs, the gaming accounts imported from Discord, your Bungie link, group memberships, session sign-ups, friendships, karma you've received, notifications, private messages you sent that are stored in our database, push delivery receipts, your contribution history and supporter status. Shared-link visits stop being linked to you. Your uploaded profile and header images are removed from the site; copies of some older uploads may remain in our file storage for a period.

Monthly contributions: deleting your account cancels any monthly contribution with Stripe automatically. If that ever fails, we're alerted and cancel it by hand.

What it doesn't delete automatically:

• Sessions and groups you created stay up for the people who joined them, without your profile attached.
• Chat messages you posted in group, session or private chat (stored in Firebase), and the record of who your private conversations were with.
• Ideas you posted on the feature request board stay up, no longer linked to you.
• Support requests you sent us.
• Our email and push send log, which identifies you only by an internal number and is deleted after 180 days.
• Posts our bot already made in Discord or Slack servers.
• Records kept by Stripe and PayPal, and copies in database backups, which expire on their own schedule.

If you want any of those removed too, or you can't sign in to delete your account yourself, email [email protected] from the address on your account and we'll take care of it.

Your rights

Wherever you live, you can ask us to:

• Access the personal information we hold about you, and get a copy of it in a common machine-readable format. There's no self-serve export yet, so ask us and we'll send it.
• Correct it. You can change most of it yourself in your profile settings.
• Delete it (see deleting your account).
• Object to or restrict how we use it, or withdraw consent you gave us, for example by disconnecting your Discord connections or your Bungie account.

Send requests to [email protected] or through our support page. To protect your account, we may ask you to confirm the request from the email address on your account. We'll respond within the time the law requires (usually 30 to 45 days). We won't treat you differently for using these rights.

If you're in the European Economic Area, the UK or Switzerland

Our legal bases for using your information under the GDPR (and the UK GDPR) are:

• Performing our contract with you: running your account, matchmaking, sessions, groups, chat, the notifications that are part of the service, and processing contributions.
• Our legitimate interests, where they aren't overridden by your rights: keeping the site secure and free of spam and abuse, understanding how it's used, improving matchmaking, and sending occasional emails about the100 that you can turn off at any time.
• Your consent: importing Discord connections, linking Bungie.net, push notifications (which your phone asks you to allow) and optional profile fields such as gender. You can withdraw consent at any time; that doesn't affect what we did before.
• Legal obligations: keeping payment records and responding to lawful requests.

You also have the right to data portability and the right to complain to your local data protection authority. We'd appreciate the chance to sort things out first, so please contact us.

If you're in California or another US state with a privacy law

In the past 12 months we collected the categories of personal information described under what we collect: identifiers (such as email, gamertag, platform IDs and IP address), characteristics you choose to give (age range, gender), commercial information (contributions), internet activity (pages and features used), and the preferences on your profile. We use them for the purposes under how we use your information and disclose them only as described under service providers and other sharing.

• You have the rights to know, access, correct, delete and port your information, as above.
• We don't sell or share personal information (as California law defines those terms), we don't use it for targeted advertising, and we don't profile people in ways that produce legal or similarly significant effects, so there's nothing to opt out of. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
• We use account login details only to provide the service, not to infer things about you.
• You can use an authorized agent to make a request; we may ask them for proof that you authorized them.
• If we decline your request, you can appeal by replying to our answer. If you're still not satisfied, you can contact your state's attorney general.

Do Not Track and Global Privacy Control

The site doesn't change its behavior in response to browser "Do Not Track" signals, because there's no agreed standard for them. Since we don't sell or share personal information for advertising, a Global Privacy Control signal has nothing more to opt you out of.

Children and teens

the100 isn't directed at children. You must be at least 13 to use it, and if you're under 18 (or under the age of majority where you live), our Terms of Service require a parent or guardian to review and agree to them for you. We don't knowingly collect personal information from children under 13. If you're a parent or guardian and believe a child under 13 has given us information, contact us and we'll delete the account and its information.

Where your information is stored

We're based in the United States, and our database, file storage and most of our providers are in the United States. If you use the100 from elsewhere, your information is transferred to and processed in the US, where data protection law may differ from yours. Where the law requires a transfer safeguard, we rely on our providers' standard data-protection terms.

Security

The site is served only over encrypted HTTPS connections, passwords are stored as one-way hashes, card details never touch our servers, and access to our admin tools and database is limited to the people who run the site. No method of transmitting or storing data is 100% secure, so we can't guarantee absolute security. If a breach affects your personal information, we'll notify you as the law requires. To report a security problem, see our security policy.

Other sites and services

the100 links to and works alongside services we don't control, such as Discord, Xbox, PlayStation, Steam, Bungie.net and Reddit, and members post their own links. Those services have their own privacy policies, and we're not responsible for their content or practices.

Changes to this policy

When we change this policy we'll post the new version on this page and update the effective date at the top. If we make a significant change, we'll also post a notice on the site before it takes effect. The previous version of this policy was dated October 18, 2019.

Contact us

Questions or requests about your privacy:

• Email: [email protected]
• Our support page (help articles and a contact form)
• Mail: Resonant Ventures, LLC, 14729 Shore Acres Dr, Bigfork, MT 59911, USA

Terms of Service · Community Guidelines · Connected gaming accounts · Security policy