Privacy Policy

The short version

• We collect what we need to run your account and show your tier lists. We do not sell personal data.
• We do not run advertising or third-party analytics trackers.
• We never store your IP address in plain form; abuse controls use a keyed hash of it.
• You can delete your account, and with it your templates, lists and uploads, at any time.

What we collect

Account details

Your username, email address, and a password hash (we use Argon2id and never store the password itself). If you sign in with Discord, Twitch or Google we store that account's id, its avatar link, and its email address only when the provider says it is verified. We also record when you accepted these terms, signed up and last logged in.

What you make

Templates, items, images you upload, tier lists, likes, API keys (stored as hashes), verified domains and apps or agents you connect.

Security and abuse signals

When you sign in or submit certain forms we keep a keyed hash of your IP address (never the address itself), together with your browser's user agent and, for sign-ins, the approximate country the request came from. These appear in your session history and in copyright notices. Rate limits count requests per IP address without writing it to our database. Sign-up, password reset and some other forms use Cloudflare Turnstile to tell people from bots.

Images

Uploads are converted to WebP, and the conversion strips embedded metadata (EXIF, XMP and color profiles), so location and camera data do not end up on tiero. An image whose converted file still carries metadata is rejected.

How we use it

• to run your account, sign you in and keep it secure;
• to store, show, embed and export your templates and lists;
• to compute rankings across public lists for a template;
• to send account email (verification, password reset, security notices) and replies to your messages;
• to enforce the Terms and Content Policy, handle reports and copyright notices, and prevent abuse;
• to keep the service reliable, using error reports with secrets and tokens removed.

Where a legal basis is required, we rely on performing our agreement with you, our legitimate interest in keeping tiero safe and working, and legal obligations.

What is public

Your username, avatar, and public templates and lists can be seen by anyone, and public pages may appear in search engines. Unlisted templates and lists are visible to anyone with the link. Private templates and lists are visible only to you, but uploaded images can be opened by anyone with the image link, as the Terms explain.

Cookies

tiero uses only the cookies it needs to work. There are no advertising or tracking cookies.

session

Keeps you signed in. HttpOnly, ends after 30 days without use or 90 days at most.

t_ui

Tells the page you are signed in so it can draw the right header. Same lifetime as session.

t_theme

Remembers your light or dark theme choice for a year.

oauth_*

Short-lived (15 minutes or less) cookies that protect a Discord, Twitch or Google sign-in.

Service providers

We share data only with providers that help us run tiero, and only what each one needs:

• Cloudflare: hosting, database, image storage and processing, Turnstile and rate limiting.
• Mailgun: sending account email.
• Discord, Twitch and Google: only when you choose to sign in with them.
• Telegram: internal error alerts to our team, with secrets and tokens removed.

We may also disclose data when the law requires it, to answer a valid legal request, or to protect people from harm. A copyright notice is shared with the affected uploader without the sender's phone number or postal address.

Retention and deletion

When you delete your account we sign you out everywhere, revoke your API keys, embed tokens and connected apps, and replace your email address straight away. Your templates, lists and uploaded images are then removed in batches by a background job. Your old username stays reserved so it cannot be used to impersonate you. Records we must keep for legal reasons, such as copyright notices and strikes, may be kept after deletion.

Your choices and rights

You can change your email, username and password, disconnect sign-in providers and delete your account from your account settings. Depending on where you live you may also have the right to access, correct, export or restrict the use of your data, and to complain to a data protection authority. To make a request, email us from the address on your account.

Changes and contact

We will post changes to this policy here and update the date above. For a significant change we will also tell you on the site or by email. Privacy questions: support@tiero.io.