Privacy notice

Controller: Lorenzo Massafra, independent operator of the FantaFort project, based in Italy. Privacy contact:

privacy@fantafort.com

Data we process

We process only what is needed to provide and secure the service.

• Account email and authentication records managed by Supabase; FantaFort never receives your password in readable form.
• Username, language, account status and game activity, including leagues, friends, virtual wallet entries, rosters and rewards.
• Limited technical and security information produced by Supabase, Vercel and application error logs.
• Messages you voluntarily send to support.

Purposes and legal bases

Account and game data is processed to provide the service you request. Security, abuse prevention, debugging and game-integrity checks rely on our legitimate interest in operating a safe and reliable alpha. Legal obligations apply where required. FantaFort does not use advertising, profiling or marketing analytics.

Providers and transfers

Supabase provides authentication and database services; Vercel hosts the application; GitHub Actions performs scheduled data synchronization; Osirion supplies public competitive results. These providers may process technical data outside the EEA under their applicable contractual safeguards. We do not sell personal data.

Professional players (data not obtained from you)

FantaFort also processes personal data about competitive Fortnite players who are not registered users, in order to build the game roster and calculate scores. This data is not collected from those players directly.

• Categories: in-game competitive handle, opaque Epic account identifier, competitive region, and public tournament placements and results. For a small number of well-known players we also show a date of birth, an earnings snapshot and a photograph.
• Sources: the public Osirion competitive API, and publicly published Liquipedia player pages for the curated subset.
• Legal basis: legitimate interest (art. 6(1)(f) GDPR) in operating a fantasy game built on published competitive sport results. No special categories of data are processed and no automated decision producing legal effects is taken about these players.
• Retention: for as long as the player remains eligible under the published methodology; inactive accounts are removed from the roster by the following synchronization cycles.
• Rights: any player may request access, rectification, erasure or object to the processing at the privacy address below. On objection we remove the player from the roster and keep the exclusion across future synchronizations, unless compelling legitimate grounds apply.

Aggregated statistics

FantaFort is a time-limited project run to measure interest in a Fortnite fantasy game. We compute aggregated, anonymous counts — for example registered accounts, weekly active players, leagues created and the language used — and may share them with Epic Games or other potential partners. These figures cannot identify you: no personal data, email address or username is shared.

End of the project

The public alpha is expected to run for about one year, until October 2027. When it closes, all accounts and personal data are deleted within 30 days; encrypted backups expire within the following 14 days. Only the aggregated anonymous statistics described above are kept. We will announce the closure date on the site and, where possible, by email at least 30 days in advance.

Retention

Account data is kept while the account is active and until a verified deletion request is completed. Security, audit and virtual-wallet records may be retained in pseudonymized form when necessary to preserve integrity, prevent fraud or meet legal obligations. Operational logs are kept only for as long as reasonably needed for security and debugging.

Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing. You may also complain to the Italian Data Protection Authority or your local supervisory authority. A machine-readable copy of your account data can be downloaded at any time from Account settings; for anything that export does not cover, write to the privacy address.

Children

The public alpha is intended for users aged 16 or older. Do not register if you do not meet this requirement. FantaFort does not knowingly request data from younger children.

Security and changes

We use access controls, row-level database policies, encrypted transport and security monitoring, but no online service can guarantee absolute security. Material changes will be dated on this page.

Privacy requests

Send privacy requests from the email registered to your account and include your username. Never send a password, recovery code or authentication token.

Request account deletion from Account settings or by email after leaving or closing open leagues. An in-app request immediately suspends access. We then verify the request and delete or anonymize data unless retention is required for security, ledger integrity or law. Requests are normally completed within 30 days.

Italian Data Protection Authority · Terms · Cookies