Legal

Privacy Policy

BrawlPilot keeps as little about you as it can get away with: an address to sign you in, a count of how many picks you have left today, and, if you pay for a plan, which plan it is. Your card is never one of those things. This page says exactly what that means, who else sees it, and how to make us delete it.

Last updated 10 September 2026

Who is responsible

BrawlPilot is run by The operator of BrawlPilot, who is the data controller for the personal data described here and is established in Spain. This site is therefore governed by the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).

For anything on this page, including requests to see or delete your data, write to brawl.pilot.drafter@gmail.com.

What we collect, and why

You can browse the whole site, including every tierlist, without an account. We only store personal data once you sign in, because a pick allowance has to belong to someone.

Data	Why we have it
Email address	Identifies your account. It is the account key, so signing in with Google and with a code using the same address reaches the same account and the same Energy Drinks.
Name and profile picture	Only if you sign in with Google, and only to show who is signed in. Never shown to anyone else.
Sign-in method	Records whether the account was created with Google or with an email code.
Account timestamps	When the account was created and last used, so dormant accounts can be cleared out.
Energy Drink counters	How many picks you have left today, how many reward videos you have watched, and the current date. This is what enforces the daily allowance.
Login codes	If you sign in by email, a six-digit code, its expiry and the number of attempts. The code is stored hashed, never in readable form, and is overwritten on the next request.
Subscription state	Only if you buy a paid plan: which plan it is, whether it is still active, when the paid period ends, and the two Stripe reference numbers that identify you to Stripe. This is what grants the larger daily allowance you paid for.

We do not collect your Brawl Stars account, your player tag, your in game statistics, or your location.

We never see your card. If you buy a paid plan, the payment happens on Stripe’s own pages. Your card number, its expiry and its security code go to Stripe and never reach BrawlPilot. What we store is a pair of reference numbers Stripe gives us, which let us ask Stripe whether your plan is paid up. Your billing address and any tax details you enter at checkout are held by Stripe, not by us.

What the drafter sends when you ask for a pick

When you request a pick, the map, mode, bans and the brawlers already drafted are sent to an AI model provider to generate the recommendation. That request describes a Brawl Stars draft and nothing else. Your email address, your name and your account identifier are not included in it, so the model provider cannot connect a draft to a person.

Cookies

Two cookies are strictly necessary and are set whether or not you accept anything, because without them signing in cannot work. The advertising cookies are separate and are only set if you consent.

Cookie	Purpose
bp_session	Keeps you signed in. Signed so it cannot be tampered with, and marked httpOnly so page scripts cannot read it. Strictly necessary.
bp_oauth_state	A short-lived value that protects the Google sign-in round trip against cross-site request forgery. Deleted as soon as sign-in finishes. Strictly necessary.
Google advertising cookies	Set by Google to serve and measure ads. Only set once you have given consent through the banner, and removable by withdrawing that consent.

Advertising

The free plan is paid for by advertising. We use Google AdSense. Google is an independent controller for the data it collects through its ad tags, and it may set cookies or read device identifiers to serve and measure ads.

If you are in the European Economic Area, the United Kingdom or Switzerland, we ask for your consent before any advertising cookie is set, using a Google certified consent tool. You can change or withdraw that choice at any time from the privacy link in the page footer, and withdrawing it is as easy as giving it.

You can review and control how Google personalises ads to you at myadcenter.google.com, and read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.

Who else sees your data

We do not sell your data and we do not share it for anyone else’s marketing. These providers process it on our behalf, or alongside us, purely to make the site work:

Provider	Role
Vercel	Hosts the site and runs the server code.
Supabase	Stores accounts and Energy Drink counts.
Google	Provides Google sign-in, and serves advertising through AdSense.
Resend	Delivers the six-digit sign-in code, when email sign-in is enabled.
OpenRouter	Routes the draft request to the AI model that produces the pick. Receives no personal data.
Stripe	Takes the payment if you buy a paid plan, and runs the portal where you manage or cancel it. Stripe receives your email address and whatever you enter at checkout, including your card and billing address, and is an independent controller for the fraud prevention and record keeping it does with it. Nobody on the free plan is passed to Stripe at all.

Some of these providers operate outside the European Economic Area. Where data reaches a country without an EU adequacy decision, the transfer relies on the European Commission’s Standard Contractual Clauses.

We may also disclose data where the law requires it, or to investigate abuse of the service such as attempts to inflate the Energy Drink allowance.

Legal basis for using your data

Purpose	Basis
Running your account and the pick allowance	Performance of a contract, being the terms you accept by using the service.
Advertising cookies and ad personalisation	Your consent, given through the banner and withdrawable at any time.
Taking payment and running a paid plan	Performance of a contract, being the plan you bought. Only applies once you subscribe.
Keeping records of what was sold	A legal obligation, being the tax and accounting rules that apply to a paid service.
Security and abuse prevention	Our legitimate interest in keeping the service usable and not paying for fraudulent traffic.

How long we keep it

Account data is kept while the account exists. Delete the account, or ask us to, and it is removed. An account that has not been used for 24 months may be deleted without notice. Sign-in codes expire within minutes and are overwritten on the next attempt. Energy Drink counters reset daily and carry no history.

If you have ever paid for a plan, the record of that sale is a different matter. Stripe keeps the payment and invoice records for as long as tax and accounting law requires, and deleting your BrawlPilot account does not erase them. Ask us to delete an account with a plan still running and we will cancel the plan first, so that no further payment is taken.

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to processing based on legitimate interest. You can withdraw consent to advertising cookies at any time without affecting anything done before you withdrew it.

Write to brawl.pilot.drafter@gmail.com and we will answer within one month. If you think we have handled your data badly you can complain to your national data protection authority. In Spain that is the Agencia Española de Protección de Datos, www.aepd.es.

Children

You must be at least 14 to hold a BrawlPilot account. Where the law of your country sets a higher age for consenting to online services on your own, that higher age applies instead.

We do not knowingly collect data from anyone below that age, and we do not allow ads to be personalised on the basis of age for users we know to be minors. If you believe a child has created an account, tell us at brawl.pilot.drafter@gmail.com and we will delete it.

Changes

If this policy changes in a way that matters, the date at the top changes with it and the notice appears on the site. Continuing to use BrawlPilot after that means the updated policy applies.