Privacy policy
Last updated: November 8, 2026
This policy explains which personal data Airsoft Skirms collects, why we need it, who sees it, how long we keep it and what your rights are under the General Data Protection Regulation (GDPR).
Who is responsible
Airsoft Skirms, operated from the Netherlands, is responsible for your data (the controller). You reach us at info@airsoftskirms.app or through the contact page.
Browsing without an account
You can browse the site without an account. We then process:
Your IP address. Our servers receive it with every request, and our hosting provider and we keep it in server logs for a limited time, to keep the site secure and to find problems. We also send it to IPinfo, which estimates where you are, roughly at the level of a city, so the home page, the fields page and the map can show the fields nearest you and how far away they are. That estimate isn’t stored against you.
Your browser’s details (its user agent), in the same logs.
Your language, in a cookie, once you switch it. Your choice of light or dark mode stays in your browser’s local storage.
Your account
When you create an account, we store your email address, the username you choose, when you joined, the language you signed up in (we email you in it) and whether you’re an admin. You sign in with a one-time code we email you, valid for five minutes. If you sign in with Google, Discord, Microsoft or Facebook, or connect one of them in your settings, we receive your name, email address and profile picture from that provider and store the link between your account and theirs, with the provider’s sign-in tokens encrypted. We don’t get access to your contacts or posts there.
In your settings you can add more ways to sign in. A password is stored only as a salted hash, never as you typed it. A passkey stays on your device or in your password manager: we store its public key, its name and when you added it. With two-factor authentication on, we store your authenticator app’s secret and your backup codes encrypted, and whether you chose to trust a device.
Each sign-in creates a session with your IP address and browser details, so you stay signed in and we can recognize suspicious use. A session expires a week after it was last used; signing out ends it. To prevent abuse, we count sign-in and email attempts per IP address and email address for a quarter of an hour.
Your profile and location
Your profile holds what you add to it: an avatar, a bio, links to your social media and your primary team. It also holds your location, which starts as IPinfo’s estimate from your IP address when the account is created; you can move it on a map in your settings. We use it to find the fields near you and their distance. By default your profile shows nothing of it; you can choose to show its country, or its city and country. The pin itself is never public.
We also keep your reputation, your votes on posts, comments, fields and other players, the players you blocked, the proposals you made and their outcomes, and, if an admin banned you, the reason and how long the ban lasts.
When you upload an avatar, a photo or any other image, we remove its metadata, such as the camera used and the place a photo was taken, and store only the picture itself, at most 2,560 pixels on its longest side. The file you uploaded is deleted once that’s done.
What others can see
Your profile is public: your username, avatar, bio, social media links, reputation, teams, organisations, when you joined and, if you chose to show it, your country or city. So are the photos you add to fields, teams, organisations and your profile, the teams you create or join with their members, the organisations you run with their organisers, and the posts and comments you write in the community, with your username and their scores; how you vote isn’t shown to anyone. Search engines index public pages, and anyone can share links to them.
An organisation’s page is public too: its name, logo, description, address and its pin on a map, website, email address, phone number and social media links as its owner and organisers enter them, the fields it runs, its owner and its organisers. Enter only an address and contact details the organisation means to publish.
Your proposals are visible to admins, with your username, your comment and your photo. Once approved, the changes become part of the field’s listing without your name. Admins also see your account details, including your email address, to support you and to moderate the site. Nobody else sees your email address.
Your messages
A message you send another player is for the two of you: nobody else can read your conversation, admins included, unless one of you reports a message (below). A message stays as it was sent: neither of you can edit or delete it. You can delete a conversation for yourself, which takes what was sent so far out of your view; once neither of you has anything left in it, we delete it. The other player sees when you’ve read their messages, and the players of a chat see the reactions under its messages and whether they gave one themselves; your reactions go with the message or your account. You can block a player, after which neither of you can write in your conversation or start a new one. Messages aren’t translated, so they don’t go to Langbly, and search engines can’t see them.
A team’s chat is for the players in it: everyone in the team reads it, players who join later included, who see what was written before they joined. A player who leaves, or is removed or banned, no longer sees the chat; what they wrote stays in it. Such a chat has no read receipts, blocks don’t apply to it, and it’s deleted with the team.
When you report a message, the admins see what it said when you reported it, who wrote it, the kind of chat it’s in, your reason and comment, and who you are; nothing else of the chat. If they delete it, its author learns that a player reported it and why it was deleted, not who reported it. We delete a report 90 days after an admin decided it.
While you have a page open, our server tells your browser when something in your conversations changes, such as a new message, so the page can show it; the page then loads what changed like any other page.
Contacting us
The contact form emails your name, email address, subject and message to our mailbox. We keep the conversation as long as we need it to help you, and reply to your address.
Emails we send
We email you sign-in codes, a verification link when we need one, a code when you change your email address, a notice whenever how you sign in changes (to your old address too when you change it), the outcome of your proposals and claims, and the reason when an admin removes something of yours, deletes your team, organisation or account, takes a field away from your organisation, or bans you. These emails are part of the service; you can’t opt out of them while you have an account. When a message in one of your chats, but for an organisation’s, is still unread two hours after it came in, we email you its sender’s name and a link to the chat, never the message itself, at most once a day per chat; you turn these off under Messages in your settings. We don’t send newsletters or marketing emails. If we ever start, we’ll ask you first.
Our emails go through Resend, which keeps a log of the emails it sent for the period its own policy sets.
Why we may process your data
To provide what you signed up for: your account, profile, content, teams, organisations and proposals, and the emails about them (performance of a contract).
Our legitimate interests: keeping the site secure and free of abuse, moderating content, showing nearby fields to visitors, understanding how the site is used from server logs, and handling your messages. You can object to this, see your rights below.
Your consent: showing your city or country on your profile, and using your browser’s location when you press a map’s location button to place a pin. You withdraw it in your settings, or by refusing your browser’s prompt.
Our legal obligations: keeping records we must keep, and answering lawful requests, including notices about illegal content.
Who we share it with
We don’t sell your data and don’t show ads. We share it only with providers that process it for us, under a contract, and only what each one needs:
Our hosting provider, which runs our servers, databases, search index and file storage.
Resend, which delivers our emails.
IPinfo, which estimates a location from an IP address.
Langbly, which translates the field descriptions, posts, comments, bios, and team and organisation descriptions you publish into the site’s other languages. It processes them in the EU, keeps them for at most an hour and doesn’t use them to train any model.
The sign-in provider you chose, which tells us who you are.
OpenFreeMap and jsDelivr: your browser loads map tiles and the map software from them, so they receive your IP address when a map loads.
YouTube, for the videos players post: your browser loads a video’s thumbnail from YouTube’s image server (i.ytimg.com), which receives your IP address, and only once you press play its privacy-enhanced player (youtube-nocookie.com), which YouTube says stores nothing about your visit until the video plays.
Google Maps, only when you click a field’s directions link.
Information about fields comes partly from our research agent, which reads fields’ public websites and other public pages about them and drafts listings for admins to review. The pages it reads can contain a field’s contact details. It sends their text and photos to an AI model (Anthropic’s Claude) to draft the listing and pick its photos, has that model search the web for what other pages say about a field, by its name, town and website, and sends a field’s address to OpenStreetMap’s Nominatim to place it on the map. We never send players’ data or content to these models.
Some of these providers are outside the European Economic Area, in particular in the United States. Where that’s the case, we rely on the safeguards the GDPR provides for, such as the European Commission’s adequacy decisions (including the EU–US Data Privacy Framework) and its standard contractual clauses.
We also disclose data when the law requires it, for example to a court or an authority, or to protect the rights and safety of players or others.
How long we keep it
Your account, profile, content, teams, organisations and proposals: as long as you have an account. A ban doesn’t delete the account; its data goes when the account does, apart from your posts, comments, photos and messages, which a ban deletes.
Sign-in codes: five minutes. A pending two-factor sign-in: ten minutes. Sessions: a week after they were last used. Trusted devices: thirty days after they were last used. Abuse counters: a quarter of an hour. Server logs: a limited time.
Messages: until you and the other player have both deleted your conversation; in a team’s chat, until the team is deleted. An admin deletes a reported message that breaks the rules, and a ban deletes the banned player’s messages.
Contact messages: as long as we need them to help you.
When you delete your account in your settings, or an admin deletes it, we delete your account, its password, passkeys, two-factor secret and connected accounts, your profile, location, avatar, photos, posts, comments, messages, votes, blocks, team memberships, your places as an organiser, the teams you’re alone in, the organisations only you run and your search entries. Field changes approved from your proposals stay, without your name, and so do teams and organisations you handed over, the fields of an organisation deleted with it (nobody runs them then), and the other players’ own messages in your conversations. Emails already sent stay in Resend’s log for the period its policy sets, and deleted data disappears from our backups within a limited time. The law may require us to keep some data longer.
Children
Airsoft Skirms isn’t meant for children under 16, the age at which you can agree to online services yourself in the Netherlands. We don’t knowingly create accounts for them, and we delete an account when we learn it belongs to a child. Parents and guardians can contact us.
Security
The site uses HTTPS, sign-in codes, optional passkeys and two-factor authentication, passwords stored only as salted hashes, and sessions that expire. Access to your data is limited to the admins who need it, and our providers work under data processing agreements. No system is perfectly secure, so tell us if you notice something that isn’t right.
Your rights
Under the GDPR you can:
Access the data we hold about you, and get a copy of it in a common format (data portability).
Correct it. Most of it you change yourself in your settings.
Delete it. Delete your account in your settings, or ask us.
Restrict or object to processing based on our legitimate interests.
Withdraw consent you gave, at any time, without affecting what was done before.
Complain to a supervisory authority: in the Netherlands the Autoriteit Persoonsgegevens, or the one in your own country.
Email us at info@airsoftskirms.app. We may ask you to confirm that the account is yours, and we answer within a month.
Automated decisions
We don’t make decisions about you by automated means with legal or similarly significant effects. Reputation is a plain sum of your approved proposals and the votes on your posts and comments, and the AI model only drafts field listings, never anything about players.
Cookies and local storage
We use no advertising, analytics or tracking cookies, and no cookie banner is needed: everything below is needed for the site to work or to remember a choice you made.
A session cookie (better-auth.session_token) keeps you signed in, and expires with the session.
While you sign in, short-lived cookies hold the step you’re at: a two-factor sign-in (better-auth.two_factor, ten minutes) or a passkey’s challenge (better-auth.better-auth-passkey, five minutes).
If you choose to trust a device when you pass two-factor authentication, a cookie (better-auth.trust_device) skips that step there for thirty days.
A cookie (better-auth.last_used_login_method) remembers how you last signed in on this browser, for thirty days, so the sign-in page can point it out.
A language cookie (NEXT_LOCALE) remembers the language you picked.
A cookie (sidebar_state) remembers whether you folded the sidebar in your settings or the admin dashboard.
Your browser’s local storage remembers your choice of light or dark mode.
Changes
When we change how we handle your data, we update this page and the date above. When a change matters to you, we tell you by email or with a notice on the site.