PRIVACY POLICY

Roshan Awards ("we", "us", "our") operates the website roshawards.com. This privacy policy explains what personal data we collect, why we collect it, how it is used, and your rights regarding that data.

We are a fan-run, non-commercial initiative. We collect the minimum data necessary to operate a fair community voting system and do not sell, rent, or share personal data with third parties for commercial purposes.

If you have any questions about this policy, contact us at d2ra-main@roshawards.com.

Community voters (Steam or Reddit login)

When you sign in to vote, we receive a small amount of profile data from the authentication provider you choose. The table below explains exactly what is collected and why:

We do not access your Steam game library, friends list, inventory, playtime, purchase history, or any account settings beyond what is listed above. We do not access your Reddit post history, subscriptions, votes, messages, or any account activity. Your password is never shared with us under any circumstances - authentication is handled entirely by Steam and Reddit on their own platforms.

Personality voters (ballot link)

Personalities invited to vote receive a private one-time ballot link generated by our admin. We store the name and role label provided by the admin when generating the link (e.g. "Sheever, Host"). We also store a hashed IP address at the time the ballot is submitted, for abuse prevention purposes. No other personal data is collected through the ballot system.

Contact form submissions

If you submit a message via our contact page, we store your name, email address (if provided), the subject category you selected, and your message. This data is used solely to respond to your enquiry. We also store a hashed IP address to prevent spam abuse. Contact form submissions are only accessible to authorised administrators.

Votes

Vote records are stored in our database linked to your account ID (hashed). This allows us to enforce the one-vote-per-account rule. Individual votes are never publicly displayed and are not linked to your username in any public-facing output. Only aggregate scores are shown on the results page.

We use Steam OpenID 2.0 for authentication. When you click "Sign in with Steam", you are redirected to Steam's own login page. We never see or handle your Steam password. Steam confirms your identity to us via an OpenID token, from which we extract your SteamID64 (a permanent public identifier), your username, and your account creation date.

Dota 2 ownership may be verified via the Steam Web API using your SteamID64 to confirm you own the game. This is a read-only check and no game data, inventory, or other account information is accessed or stored.

Steam's own privacy policy applies to data held by Valve. You can read it at store.steampowered.com/privacy_agreement.

We use Reddit OAuth 2.0 for authentication as a fallback to Steam. When you click "Sign in with Reddit", you are redirected to Reddit's authorisation page. We request the identity scope only, which provides your username, account ID, account creation date, and profile image.

We cannot and do not post, comment, vote, send messages, subscribe, or take any action on Reddit on your behalf. The access token received from Reddit is used for a single profile lookup and is discarded immediately afterwards - it is never stored.

Reddit's own privacy policy applies to data held by Reddit. You can read it at reddit.com/policies/privacy-policy.

All data is stored in a managed PostgreSQL database hosted on Supabase, with servers located within the European Union. Access to the database is restricted by role-based permissions. Sensitive identifiers such as account IDs and IP addresses are stored as one-way SHA-256 hashes - they cannot be reversed to recover the original value.

Our website is served over HTTPS. Admin access requires authenticated sessions with short-lived signed tokens. All admin actions are recorded in an audit log.

We take reasonable technical measures to protect your data, but no system is entirely immune to security risks. In the event of a breach affecting personal data, we will notify affected users as required by applicable law.

Voter records and vote data are retained for the duration of the award season and archived for historical record-keeping purposes thereafter. Contact form submissions are retained until resolved and may be deleted by administrators at any time. We do not retain data beyond what is necessary for the operation of the platform.

You may request deletion of your personal data at any time by contacting us at d2ra-main@roshawards.com. Because account IDs are stored as one-way hashes, we cannot identify your record from your username alone - please include the authentication method you used (Steam or Reddit) and your username so we can locate and remove your data.

We use a single session cookie to keep you logged in while voting. This cookie contains a signed token and is set as httpOnly and secure. It expires after 7 days or when you close your browser session. We do not use advertising cookies or any third-party behavioural tracking. We may use privacy-respecting analytics to measure aggregate page traffic, which does not identify individual users and does not use cookies or persistent browser identifiers.

We use the following third-party services to operate the platform. Each has its own privacy policy:

• Vercel - Web hosting and deployment
• Supabase - Database hosting
• Steam (Valve) - Authentication provider
• OpenDota - Pro player data (public API, no personal data)
• Reddit - Authentication provider (fallback)

Depending on your location, you may have the following rights regarding your personal data:

• The right to access the personal data we hold about you
• The right to request correction of inaccurate data
• The right to request deletion of your data
• The right to object to processing of your data
• The right to data portability

To exercise any of these rights, contact us at d2ra-main@roshawards.com. We will respond within 30 days.

We may update this privacy policy from time to time. The date at the top of this page reflects when it was last revised. Continued use of the platform after changes are posted constitutes acceptance of the updated policy. For material changes we will make reasonable efforts to notify users.

For any privacy-related questions or requests, please contact: d2ra-main@roshawards.com

For general enquiries, use our contact page.