Privacy policy
This page explains what WZY Coaching stores about you, why, how long it is kept and what you can ask for. It is written to meet the EU General Data Protection Regulation (GDPR), which applies here through the Norwegian Personal Data Act.
The short version
If you only look at the calendar, nothing about you is stored. No analytics, no advertising, no tracking, and no cookies. If you request a session, your Discord name and the few details you type in are kept so the session can happen, and they are deleted after three weeks.
1. Who is responsible
The data controller for this site is WZY Coaching, operating the site at wzy.centdevelopment.com. The site is built and hosted by CentDevelopment on WZY's behalf.
You can reach us about anything on this page:
- On Discord, in wzy's House, which is the fastest route
- By email at [email protected]
We are not required to appoint a data protection officer, so these contacts reach a person directly.
2. What we collect and why
When you request a session
The booking form asks for a small amount of information, and only the first item is required:
| Data | Why we need it | Legal basis |
|---|---|---|
| Discord username, and the numeric Discord ID it resolves to | To check you are a member of the Discord server, and to message you about the session | Art. 6(1)(b) — steps taken at your request before and during a service agreement |
| Chosen date, time and session type | To hold the slot and show it as taken | Art. 6(1)(b) |
| Rank and platform (optional) | To prepare a session that suits your level | Art. 6(1)(b) |
| What you want to work on (optional free text) | To prepare before the session starts | Art. 6(1)(b) |
| Time of the request | To order requests and to expire old ones | Art. 6(1)(b) |
Please do not put anything sensitive in the free-text field. It is there for notes about your gameplay, nothing more.
To keep the form from being abused
When you submit the form, your IP address is held in the server's memory only, for at most one hour, to count how many requests have come from that address. It is never written to disk and never linked to your booking. The legal basis is our legitimate interest in keeping the booking system usable (Art. 6(1)(f)).
When WZY signs in to the coach panel
Signing in uses Discord's OAuth2. We ask Discord only for the identify scope, and we store the resulting Discord ID, display name and avatar reference inside a signed session cookie in that browser. No password is involved and no Discord access token is kept after sign-in. This only applies to WZY, not to visitors.
3. Cookies and browser storage
This site sets no cookies for ordinary visitors. There is no analytics, no advertising network, no social media pixel, and nothing that follows you to other sites. That is also why you are not being asked to dismiss a cookie banner: under the ePrivacy rules, consent is needed for non-essential storage, and there is none here.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
wzy_admin | Cookie | Keeps WZY signed in to the coach panel. Only ever set on his browser. | 7 days |
wzy_oauth_state | Cookie | Protects the Discord sign-in against cross-site request forgery. | 10 minutes |
wzy_tz_v1 | Local storage | Remembers whether you chose to see times in CET or your own timezone. | Until you clear it |
All three are strictly necessary for functions you asked for, so they are exempt from the consent requirement. You can delete them at any time in your browser settings; the site will still work.
4. Fonts and third-party content
The typeface on this site is served from our own server. Nothing is loaded from Google Fonts, a CDN, or any other third party, so simply opening this page does not send your IP address to anyone but us and our hosting provider. The only external image is WZY's own Discord avatar in the coach panel, which loads from Discord and is not shown to visitors.
5. Who else sees your data
- Discord (Discord Netherlands B.V. / Discord Inc.) receives your username so we can look you up in the server and send you the confirmation messages. This happens because messaging you on Discord is the service you asked for. Discord is also subject to its own privacy policy. Where data reaches Discord Inc. in the United States, the transfer relies on the EU–US Data Privacy Framework and Discord's standard contractual clauses (GDPR Chapter V).
- Cloudflare carries the connection between your browser and our server, and terminates the HTTPS encryption. Cloudflare processes connection data, including your IP address, as part of that. See Cloudflare's privacy policy.
Nothing is sold, rented, or shared for advertising. There are no other recipients.
6. Server logs
Our web server keeps a standard access log of requests, rotated daily and kept for 14 days. Because traffic reaches the server through a private tunnel, the address recorded in that log is the tunnel's internal address, not yours. In other words, our own logs do not contain visitor IP addresses at all.
7. How long we keep things
- Booking details that identify you, meaning your Discord name, ID, rank, platform and notes, are removed three weeks after the week they belong to. What remains is an anonymous record that a session of a given type happened at a given time.
- Those anonymous records are deleted entirely after one year.
- Rate-limiting data disappears within an hour, and whenever the server restarts.
- The coach session cookie expires after 7 days, or immediately on sign-out.
8. Deleting your own data
Every confirmation message you receive contains a cancellation link. Opening it lets you cancel the session and, with the box ticked, erase your name and the notes you submitted straight away rather than waiting for the three-week deletion. You do not have to ask anyone or prove who you are, because the link itself is the proof.
If you have lost the link, message us on Discord and we will do it for you.
9. Your rights
Under the GDPR you have the right to:
- Ask what we hold about you and get a copy of it (Art. 15)
- Have inaccurate details corrected (Art. 16)
- Have your data deleted (Art. 17)
- Ask us to restrict what we do with it (Art. 18)
- Receive it in a portable, machine-readable form (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
Use either contact in section 1 and we will respond within one month, free of charge. Given how little is stored, most of these requests take a moment to handle.
If you think we have handled your data badly, you can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the supervisory authority in the EU or EEA country where you live.
10. Automated decisions and profiling
There are none. A person reads every booking request and decides whether to accept it. Nothing on this site profiles you or scores you automatically.
11. Children
Discord requires its users to be at least 13, and this site is only usable through a Discord account, so it is not directed at children below that age. If you are under 16, please ask a parent or guardian before booking a session.
12. Security
Traffic is encrypted with HTTPS. The coach panel is restricted to a single Discord account and every action that changes the schedule requires that sign-in. Session cookies are signed, marked HttpOnly and Secure, and cannot be read by scripts. Booking data lives on a server we control, not in a third-party database.
13. Changes to this policy
If what we do with your data changes, this page changes with it and the date at the top is updated. There is no mailing list to notify, because we do not keep one.