1. Overview
This Privacy Policy describes how FN1v1 (operated by Concentric Digital Solutions Limited, a company incorporated in New Zealand, “we”, “us”, or “our”) collects, uses, stores, and shares your personal information when you use the FN1v1 website and platform (the “Service”).
By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.
Important disclaimer: FN1v1 is an independent, community-built competitive platform. We are not affiliated with, endorsed by, or sponsored by Epic Games, Inc. Fortnite and the Epic Games name and logo are trademarks or registered trademarks of Epic Games, Inc. Our use of Epic Games' authentication services is governed by Epic Games' Developer Agreement and their own Privacy Policy, which is separate from this document.
2. Who We Are
The data controller for personal information collected through FN1v1 is:
We are subject to the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). Where we serve users in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR / UK GDPR) also applies. Where we serve users in California, the California Consumer Privacy Act (CCPA) as amended by the CPRA applies.
3. Information We Collect
We collect information you provide directly, information we receive from third-party platforms during authentication, and limited technical information generated when you use the Service.
| Category | Examples | Purpose |
|---|---|---|
| Account identity | Epic Games account ID, Epic display name; Discord user ID, Discord username; Twitch/YouTube/TikTok user ID and username (creators only) | Creating and managing your FN1v1 account; recognising you when you sign in |
| Platform data | Which third-party platforms you have linked to your account, link timestamps | Enforcing sign-in rules (a linked Discord account is required for ranked play); enabling creator accounts |
| Gameplay & rankings | Competitive rating and rating history, win/loss record, match history, queue and ready-up records, preferred region, game mode, team memberships, event entries and invitations | Operating matchmaking, leaderboards, teams and events |
| Match reports & screenshots | Scores you report for a match, and screenshots of the end-of-match scoreboard you post in a match thread during a dispute | Settling matches and deciding disputes |
| Strikes & appeals | Strikes recorded for matches you did not report or post a screenshot for, any queue block, and the text of an appeal you send, including any technical details in it | Keeping matchmaking fair and reviewing queue blocks |
| Referrals | Your referral code, who referred you and whom you referred, and whether the referral has completed | Running the referral programme and granting its rewards |
| Stored Discord tokens | Your Discord OAuth access and refresh tokens and their expiry time, stored encrypted | Sending your rating and win/loss record to Discord for linked roles |
| Session data | Signed JWT session token stored in an HttpOnly, Secure, SameSite=Lax cookie; a short-lived sign-in state cookie during sign-in | Keeping you authenticated between page loads |
| Subscription data | Stripe customer ID, Stripe subscription ID, subscription status and billing period dates; for event entries: payment status and reference, amount paid and refunded, refund state, the checkout reference and link and when a held place expires, and the status and reason of any dispute; whether your account may charge entry fees; copies of the notifications Stripe sends us about your payments, which can include the email address, name and billing details you gave Stripe | Managing paid features; Stripe processes and stores full payment card details - we never handle raw card numbers |
| First-party usage records | A record linked to your account, with the time, each time you sign up, link Discord, join a queue, complete a match, start a checkout, or start a subscription | Measuring sign-ups, activity and retention; only our administrators can see this, as totals |
| Operational telemetry | Traces of requests to our API and Discord bot: address requested (which can contain your public profile ID or Discord user ID), browser type, approximate country, network provider, timing and result. Sign-in codes and tokens in addresses are redacted | Finding faults and performance problems |
| Technical & usage data | Page views, referring URL, browser type, approximate country (via Cloudflare - cookieless, aggregated) | Understanding platform usage; improving the Service |
We do not ask for your email address, phone number, real name, physical address, or precise geolocation as part of normal platform use. If you pay through Stripe, Stripe collects your email address and billing details, and its notifications to us can include them. Discord tokens are stored encrypted. Tokens from other platforms are used once during sign-in and are not stored.
4. Third-Party Platform Data
FN1v1 uses OAuth 2.0 to allow you to authenticate via third-party platforms. When you connect a platform, that platform's authorisation server issues us an access token limited to the scopes we request. Those scopes, and what we read and keep, are described below.
Epic Games
We request the following scopes from Epic Games: basic_profile, friends_list, country and presence. We read only your account ID and display name, from the token Epic issues when you sign in. We do not currently read your friends list, country or presence, and we do not store them or the token.
We do not request your Epic Games email address, payment information, or purchase history. Epic Games' own Privacy Policy governs what information Epic collects about you during and after authentication. Please review it at epicgames.com/site/en-US/privacypolicy.
New player accounts are created by signing in with Epic Games. Creators can instead create an account by signing in with Twitch, YouTube or TikTok. You cannot register with an email and password.
Discord
After creating your account, linking a Discord account is mandatory to participate in ranked matches. We request the identify scope, from which we read your Discord user ID, username and display name, and the role_connections.write scope, which lets us send your rating, wins and losses to Discord for linked roles when a match finishes. We do not request access to read your messages, servers, or friends list. Once linked, you may use Discord to sign in directly on return visits.
Our Discord bot receives your Discord user ID and Epic display name to run matches and shows them to your opponent, and it assigns roles in our Discord server. If you have not joined the server yet, it keeps your Discord user ID on our server until you do.
Twitch, YouTube, TikTok (Creators)
Creator accounts may authenticate via Twitch, YouTube, or TikTok to verify creator status. We request these scopes: user:read:email (Twitch), youtube.readonly (YouTube), and user.info.basic and user.info.profile (TikTok). We read and keep only your platform user ID and display name. We do not read your Twitch email address, even though that scope would allow it. These platforms' own privacy policies govern their data practices independently of this policy.
Access token storage
Your Discord access and refresh tokens are stored in our database encrypted with AES-256-GCM, using a key held separately as a server-side secret. They are used only to send your linked-role data to Discord and to renew themselves, and are sent to no one but Discord. Tokens from Epic Games, Twitch, YouTube and TikTok are used only to confirm who you are during sign-in, and we do not store them.
5. How We Use Your Information
We use the information we collect to:
- Provide and operate the Service - create and manage your account, authenticate you, run leaderboards, process match results, and calculate competitive ratings.
- Enforce platform rules - check that a Discord account is linked before ranked play, apply bans, and prevent abuse.
- Process subscriptions - coordinate with Stripe to manage subscriptions and paid event entries.
- Communicate with you - respond to support inquiries sent to support@fn1v1.com.
- Improve the platform - analyse our first-party usage records, which are linked to individual accounts, and aggregated statistics from Cloudflare to understand how the platform is used.
- Keep the Service running - use operational telemetry to find faults and performance problems.
- Comply with legal obligations - retain records as required by New Zealand law and respond to lawful requests from regulators or law enforcement.
We do not use your personal information to serve targeted advertising, build advertising profiles, or sell your data to any third party.
Legal bases (GDPR)
For users in the EEA or UK, our legal bases for processing are:
- Contract performance - processing necessary to provide the Service you signed up for (account creation, matchmaking, leaderboards).
- Legitimate interests - platform security, fraud prevention, first-party usage analytics, aggregated analytics, and operational telemetry, where these interests are not overridden by your rights.
- Legal obligation - compliance with applicable law.
- Consent - where we explicitly request it (e.g., optional communications).
7. Cookies & Analytics
Cookies we set
We set two first-party cookies. The session cookie contains a signed JSON Web Token (JWT) that keeps you authenticated and lasts up to 7 days. The oauth_state cookie protects the sign-in redirect and lasts up to 10 minutes. Both cookies are:
- HttpOnly - not accessible to JavaScript, mitigating XSS risks.
- Secure - transmitted only over HTTPS.
- SameSite=Lax - withheld from most cross-site requests, reducing CSRF exposure.
No advertising cookies, tracking pixels, or third-party cookies are set by FN1v1. Stripe's hosted checkout pages run on Stripe's own domain, under Stripe's own cookie practices.
First-party usage records
We keep our own usage records in our database. One record, linked to your account, is written when you sign up, link Discord, join a queue, complete a match, start a checkout, or start a subscription. Our administrators see these only as totals: daily, weekly and monthly active players, a sign-up funnel, and retention. This does not use cookies. The records are not sent to any third party other than our database host, and they are removed when your account is deleted.
Operational telemetry
Our API and Discord bot send traces of their activity to a telemetry server (SigNoz) that we run ourselves. A trace records the address requested, which can contain your public profile ID or Discord user ID, along with your browser type, approximate country, network provider, timing and the result. Sign-in codes and tokens in addresses are redacted. We use traces only to find faults and performance problems.
Cloudflare
Cloudflare, which hosts the platform, may also give us aggregated web analytics. Cloudflare describes this product as not using cookies, not fingerprinting individual users, and not tracking users across sites. You can review Cloudflare's privacy practices at cloudflare.com/privacypolicy/.
No consent banner required
Because the only cookies we set are the two strictly necessary ones above, a cookie consent banner is not required under GDPR/ePD for our setup. If this changes in the future, we will update this policy and implement appropriate consent mechanisms.
8. Data Retention
We retain your personal information for as long as your account is active or as needed to provide you the Service. Specific retention periods are:
| Data type | Retention period |
|---|---|
| Account & identity data | Until your deletion request is completed |
| Ratings, rating history & rankings | Until your deletion request is completed |
| Match results | Kept indefinitely so that opponents' histories stay accurate; anonymised when your deletion request is completed |
| Discord tokens | Until replaced by a new token or your deletion request is completed. Tokens from other platforms are not stored |
| Cookies | Session cookie: up to 7 days, or until you sign out. Sign-in state cookie: up to 10 minutes |
| First-party usage records | Until your deletion request is completed |
| Operational telemetry | Until it expires under the retention setting on our telemetry server. It is not removed early when an account is deleted |
| Subscription and payment records | At least 7 tax years, for tax and accounting compliance under New Zealand law, and up to 3 years longer if Inland Revenue requires it. This includes your Stripe customer record. After account deletion our own copy holds Stripe identifiers, plan and dates, tied to the anonymised account |
| Match screenshots | Removed once the dispute is decided |
| Strikes & queue blocks | Kept while a strike counts toward a block, then removed |
| Stripe notifications | No fixed period. Their contents are erased when your deletion request is completed, leaving only the event ID and type |
| Deletion request records | Kept as a record of the request, its outcome and date, tied to the anonymised account |
| Support correspondence | Up to 3 years from last interaction, or as required by law |
| Aggregated analytics | Indefinitely (not linked to individuals) |
How account deletion works
You can request deletion from the Settings page or by emailing us (see Section 9). An administrator reviews each request, and we aim to complete it within 30 days. We cannot complete a request while you have a match in progress, and we may decline one with a recorded reason, for example if we cannot confirm that it came from the account holder.
When a request is completed:
- Any Stripe subscription is cancelled immediately, any open checkout is closed, and any saved card is removed. If Stripe cannot do this, your request stays pending and nothing is deleted until it can.
- We remove your linked platform accounts and all stored tokens, your ratings, rating history and rankings, your premium status, your team memberships, your queue entries, your event invitations, any held place and unpaid event entries, your first-party usage records, and referrals you made or had not yet completed.
- Your display name becomes “Deleted player”, your profile page is removed, your public ID and referral code are replaced, and your region and account flags are cleared. Copies of Stripe notifications about you are emptied.
- You can no longer sign in to the account, and any existing session stops working. Signing in later with the same platform creates a new, unconnected account.
What we keep, tied only to the anonymised account:
- Your match results, so your opponents' history still loads. They appear against “Deleted player”.
- Subscription and payment records for tax and accounting purposes, including paid event entries, which are hidden and marked withdrawn, and the record of each entry fee with its refund and any dispute. A refund already due is still issued.
- Events you created, which stay listed with “Deleted player” as the creator, including the name and description you gave them. A paid event of yours that has not started is cancelled and its entrants refunded.
- A completed referral in which you were the referred player, so that the player who referred you keeps their record.
- The date your account was created and the deletion request record.
Your Stripe customer record is not deleted, because we must keep it for tax and accounting purposes (see the table above). It still holds the email address, name and billing details you gave Stripe, your invoices and payments, and your FN1v1 account number, so it can still identify you. We use it only for those purposes, and no further payments are taken.
Apart from the steps above, deletion does not reach outside our database. Operational telemetry expires on its own schedule (see the table above). Roles in our Discord server, a pending role assignment held by our bot, and linked-role data held by Discord are not changed automatically: to have those removed too, email us. You can also remove our application from your Discord account's authorised apps at any time.
9. Your Privacy Rights
Depending on where you are located, you have the following rights regarding your personal information:
New Zealand (Privacy Act 2020 - all users)
- Right of access - request a copy of the personal information we hold about you.
- Right of correction - request that we correct any personal information that is inaccurate or misleading.
- Right to complain - make a complaint to the New Zealand Privacy Commissioner at privacy.org.nz.
European Economic Area & United Kingdom (GDPR / UK GDPR)
If you are located in the EEA or UK, you additionally have the right to:
- Erasure - request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements.
- Data portability - receive your personal data in a structured, machine-readable format.
- Restriction of processing - request that we restrict processing in certain circumstances.
- Object to processing - object to processing based on legitimate interests.
- Withdraw consent - where processing is based on consent, withdraw it at any time without affecting lawfulness of prior processing.
- Lodge a complaint - with your local supervisory authority (e.g., the ICO in the UK or your national data protection authority in the EU).
California (CCPA / CPRA)
If you are a California resident, you additionally have the right to:
- Know what personal information is collected, used, shared, or sold.
- Delete personal information we have collected (with limited exceptions).
- Opt out of the sale or sharing of personal information - note: we do not sell or share personal information for advertising purposes.
- Non-discrimination for exercising your privacy rights.
How to exercise your rights
You can request account deletion from the Settings page. For any request, you can email support@fn1v1.com with the subject line “Privacy Request” and a description of your request. We will respond within 20 working days as required under the New Zealand Privacy Act 2020, or within 30 days under GDPR. We may need to verify your identity before fulfilling a request.
10. International Data Transfers
Concentric Digital Solutions Limited is based in New Zealand. Our service providers - including Cloudflare, Neon, and Stripe - are based in the United States and may process your data in other countries. We ensure that appropriate safeguards are in place for any cross-border transfers, including reliance on:
- New Zealand's status as a country with adequate data protection recognised by the European Commission (for transfers from the EEA).
- Standard Contractual Clauses (SCCs) with service providers where required.
- Service providers' own adequacy mechanisms (e.g., Cloudflare's EU Standard Contractual Clauses).
11. Children's Privacy
FN1v1 follows the same minimum age requirements as Epic Games and Fortnite. You must be at least 13 years old to use FN1v1. In jurisdictions where a higher minimum age applies (for example, 16 years in certain European countries under applicable data protection law), that higher age applies in your jurisdiction.
Player sign-up goes through Epic Games' authentication, so age verification is handled in the first instance by Epic Games in accordance with their Terms of Service and Privacy Policy. Creators who sign up through Twitch, YouTube or TikTok are subject to those platforms' own age rules. We rely on those platforms' verification and do not check age ourselves, but we additionally prohibit use of FN1v1 by anyone who does not meet Fortnite's age requirements.
If we become aware that a person under the applicable minimum age has provided us with personal information without appropriate parental consent, we will delete that information and terminate the associated account. If you believe we have inadvertently collected information from an underage user, please contact us at support@fn1v1.com.
12. Security
We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:
- All data transmitted between your browser and our servers is encrypted using TLS/HTTPS.
- Session cookies are set with HttpOnly, Secure, and SameSite=Lax flags.
- JWT session tokens are cryptographically signed using a secret key stored as a server-side environment variable.
- Discord OAuth tokens are stored encrypted in the database with AES-256-GCM. Tokens from other platforms are not stored.
- The Service reaches the database only through our Cloudflare Worker backend, with credentials held as server-side secrets. Authorised administrators may also connect directly for maintenance.
- API write endpoints (e.g., match ingestion) are protected with server-side API keys.
No method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the New Zealand Privacy Commissioner as required by the Privacy Act 2020, and relevant supervisory authorities where required by GDPR.
13. Third-Party Links & Platforms
The Service contains links to third-party websites and platforms including Discord, Twitch, YouTube, TikTok, and references to Epic Games. This Privacy Policy applies only to FN1v1. We are not responsible for the privacy practices of these third parties, and we encourage you to review their respective privacy policies before providing them with your information.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the “Last updated” date at the top of this page.
- Post a prominent notice on the FN1v1 website or, where appropriate, notify you via in-app notice.
Your continued use of the Service after the effective date of any updated policy constitutes your acceptance of the changes. If you do not agree with the updated policy, you should stop using the Service and may request account deletion as described in Section 8.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us:
Concentric Digital Solutions Limited
Operating as FN1v1
New Zealand
Email: support@fn1v1.com
Subject line: “Privacy Request” or “Privacy Complaint”
If you are not satisfied with our response, you have the right to lodge a complaint with the New Zealand Privacy Commissioner at privacy.org.nz, or with the relevant data protection authority in your jurisdiction.