Privacy Policy

Last updated: 20 October 2026

This privacy policy is a translation of the German original. In case of discrepancies, the German version shall prevail.

1. Data Controller

Mick Gottschalk
An der Hermannshöhe 7
58640 Iserlohn, Germany
Email: mick.gottsch@gmail.com

2. Data We Collect

2.1 Desktop App (Fortiq)

The desktop app processes all data exclusively on your local PC:

• Match analyses and replay data
• Performance scores and statistics
• Biometric data (opt-in only; not stored persistently)
• Chat history with the coaching assistant

This data is not transmitted to any server.

2.2 Web App & Website

When you visit our website, we collect:

• Landing page: no third-party analytics. The landing page and the info pages embed no third-party service — no third-party analytics, no fonts from foreign servers, no CDN. Simply opening them does not make your browser leave our own delivery. Audience measurement runs on our own server, see 2.7.
• Usage measurement (web app, our own server): Only with your explicit consent via the consent banner. It runs without an analytics provider — the events go to our own server and do not leave it. PostHog used to be embedded here; that has been removed.
  Per event we transmit: an event name (e.g. verdict_read), a random identifier for the current browser tab, the app version, a timestamp and a few figures from a fixed allowlist (such as how long a report was open). For events from a match report this includes the identifier of the analysed match; while your account exists it can be linked to your account through our database (pseudonymous), after account deletion it no longer can. No username, no email address, no Epic ID, no IP address, no visited address, no autocapture. Anything not on the allowlist is discarded on the server. With the same consent, heatmaps and session recordings run on our own Umami, with all text and input masked (see 2.7).
  The tab identifier lives in sessionStorage and disappears when you close the tab. You can withdraw your consent at any time; measurement then stops immediately. Without consent nothing is sent.
• Error reports (Sentry): If the web app or the backend crashes, we send a technical error report to Sentry: error message, stack trace, the kind of page you were on (the route pattern, e.g. /matches/:id — never the concrete address), program version, and a correlation ID.
  What is not included: no IP address, no user identifier, no session replay, no recording of your clicks or input, no browser identifier (User-Agent), no address bar and no parameters from it. As long as nothing crashes, Sentry is not contacted at all — merely loading a page triggers no transmission. Sentry stores nothing on your device: no cookie, no entry in your browser's storage.
  The backend is configured with send_default_pii=false and therefore sends no user data. Legal basis is our legitimate interest in a working application (Art. 6(1)(f) GDPR); because nothing is stored on or read from your device, no consent under § 25 TDDDG is required for it. You may object to this processing under Art. 21 GDPR.
• Account Creation: Email, username, hashed password. Together with the account we store which campaign (utm_source, utm_medium, utm_campaign, utm_content) or which other website brought you on your first visit within the 30 days before you registered — without IP address and without browser identifier, so we can see which channels bring new players.

2.3 Backend Services

Once you register an account and use the web app, we store on our server:

• Account data: email, username, password hash (bcrypt), and optionally display name, bio, avatar URL, Epic ID, Fortnite name and time zone, plus your tier status
• Match results: match ID, playlist, duration, placement, kills, assists, damage, and the scores derived from them
• Match detail: where your analysis provides it, we additionally store position tracks, fight locations, weapon identifiers and information about your team-mates in a match. This is raw data, not merely aggregates.
• Usage telemetry: event type, a pseudonymous session hash, app version and an operating-system identifier. Any properties sent along are filtered server-side against a fixed allow-list — anything not on that list is discarded and never stored. Free text is not on the list.
• Feedback and NPS ratings
• Chat ratings: if you rate a coach answer with thumbs up or down, we store your question in full, an excerpt of the answer, and your comment. This rating is stored without a link to your account.
• Consent records (category, timestamp, version) as evidence

2.4 Uploaded replay files

When you upload a .replay file in the web app, it is transferred to our server for analysis (50 MB maximum). The file is processed in memory only and is not stored persistently; it is discarded once the analysis completes. Only the result is stored (see 2.3).

Other players' data: a Fortnite replay inherently also contains information about your team-mates and opponents, such as their player names. These people have not consented to the processing. We evaluate this information solely to analyse your play, do not pass it on, and do not use it to build profiles about those people. Affected persons may object at the address given in section 1.

Analysis without an account (guest account): if you drop a replay before signing up, we create a guest account for it. It stores no email address and no password, only the analysed matches (at most three) and the sign-in cookie in your browser. To limit misuse, your IP address is counted for one hour when the guest account is created and not stored beyond that. If you add your email to keep the report, the guest account becomes a normal account. Otherwise it is deleted with all its data after 7 days.

2.5 AI coach

When you ask the coach a question, your input is passed to a language model together with the context of your match. Depending on the deployment this happens on our own infrastructure (a local model) or — when no local model is reachable — at an external AI provider (primarily OpenRouter, Inc., USA, which forwards the request to a language model — we only allow model providers that do not retain inputs; otherwise OpenAI — contracting entity OpenAI Ireland Ltd., processing also in the USA — or Anthropic PBC, USA). In that case your question leaves the EU. Please do not enter anything into the coach chat that you would not want transferred to a US provider. We do not store the conversation on our server (exception: the chat rating in 2.3).

2.6 Stats pre-fill during onboarding

If you supply your Epic name during onboarding, we use it to request publicly available Fortnite statistics from fortnite-api.com in order to pre-fill your dashboard. Only the player name you entered and the platform are transmitted.

2.7 Website audience measurement (Umami)

To understand which pages are read and which links bring visitors to us, we use Umami on the website and in the web app. Umami is open-source analytics software that we run ourselves (at Render Services, Inc., data centre in Frankfurt am Main). No analytics provider receives the data. The script and the measurement requests are served from our own domain.

• No cookies, nothing stored on your device: Umami sets no cookies and stores nothing in your browser's storage.
• Collected per page view: the address of our page including campaign parameters (utm_source, utm_campaign etc.), the page title, the referring page (referrer), time, browser, operating system, device type, screen size, language, and the country, region and city derived from the IP address.
• IP address hashed only: The IP address is not stored. A one-way identifier is computed from the IP address and the browser identifier (user agent) together with a salt that changes daily. It counts visitors within one day; on the next day the same visitor can no longer be recognised.
• No cross-site tracking: Measurement is limited to our own pages and is not combined with any other data, including your user account.
• Do Not Track: If your browser sends “Do Not Track” or “Global Privacy Control”, the script is not loaded at all.
• No disclosure to third parties: The data are kept on our own Umami server in Frankfurt and shared with no one. Requests reach it through our hosting (Vercel, see section 4). Render and Vercel are US companies; for the legal basis of the transfer see section 4.1.

The legal basis is our legitimate interest in anonymous audience measurement, to improve the website and to see which channels work (Art. 6(1)(f) GDPR). You can object to this processing under Art. 21 GDPR, most simply through your browser's “Do Not Track” setting.

Load times, heatmaps and session recordings

• Load times: With every page view Umami measures how fast the page loads and responds (Core Web Vitals: LCP, INP, CLS, FCP, TTFB). These are technical measurements with no reference to you as a person.
• Only with your consent: If you have accepted analytics in the web app's consent banner, Umami also records where you click on a page and how far you scroll (heatmap), and a replay of your session (mouse movements, clicks, scrolling, page changes). All text and all input is masked: the recording shows where something is, not what it says. Pages whose address carries an access token (e.g. password reset) are never recorded.
• Storage and purpose: These data, too, are kept only on our own Umami server in Frankfurt. We use them to see where the website or the app is unclear or gets stuck.
• Legal basis and withdrawal: Your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with the analytics switch in the web app's footer; from the next page view nothing is recorded any more.

2.8 Sign in with Epic Games

Instead of a password you can sign in with your Epic Games account, or connect it to your Fortiq account from your profile. Fortiq sends you to Epic Games for this; we never see your Epic password. After you agree on Epic's page we receive only your Epic account ID and your display name. We do not request stats, friends lists, payment or contact details. Because Epic does not share e-mail addresses, we ask for yours once, on your first sign-in.

We use the account ID and display name to sign you in and to match your games to you (Art. 6(1)(b) GDPR). You can disconnect at any time from your profile; deleting your account deletes both. Epic Games' privacy policy applies to the sign-in at Epic.

2.9 YouTube API Services

Fortiq uses the YouTube API Services, only for our own YouTube channel @fortiqapp: we upload our own videos through them and read the number of views, likes and comments of exactly those videos (not the comment texts). In our internal project storage we keep only details of our own posts: video ID, link, title, upload status and these figures, to see which topics help players. The access token for the channel is kept in a protected secrets store. The additional YouTube Analytics permission is intended for later reading the total watch time of our own videos; we do not store data about individual viewers. We do not retrieve data about other YouTube users or our visitors through the API, and players cannot sign in with Google. We do not sell or share this data and do not use it for advertising. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

By using YouTube content you are bound by the YouTube Terms of Service, and the Google Privacy Policy applies. Only the channel owner granted access; it can be revoked at any time in the Google Account security settings.

3. Legal Basis

• Art. 6(1)(b) GDPR (performance of contract) for the account, match analysis, coach and billing
• Art. 6(1)(a) GDPR (consent) for usage measurement in the web app, heatmaps and session recordings (sections 2.2 and 2.7) and local storage of the chat history
• Art. 6(1)(f) GDPR (legitimate interest) for error reports, abuse prevention and IT security
• Art. 6(1)(c) GDPR (legal obligation) for tax retention duties

4. Recipients and processors

We do not sell your data and do not pass it on for purposes of our own choosing. We use the following service providers to operate the product:

• Vercel Inc. (web app hosting) — servers in EU/US
• Render Services, Inc. (API hosting) — instance in the Frankfurt region; under the data processing agreement processing also takes place in the US
• Databricks, Inc. (Neon) (database hosting) — holds account, match and consent data. Servers in US
• Functional Software, Inc. (Sentry) (error reports) — only in case of an error, scope as described in section 2.2
• Brevo (Sendinblue) (email delivery) — receives your email address and the content of the message (verification, password reset, and on your request the upload link to your PC). Privacy Policy
• Lemon Squeezy (Sold through Link, LLC) (payment processing, merchant of record) — not currently in use. During the open beta we offer no paid tiers, there is no checkout, and no data is transferred to Lemon Squeezy. Lemon Squeezy will only be used once paid tiers are introduced; we will inform you of this in advance. At checkout, your email address will then be passed on; we neither collect nor process payment details ourselves.
• OpenRouter, Inc., OpenAI Ireland Ltd. or Anthropic PBC (the coach's language model) — see section 2.5
• fortnite-api.com (public game statistics) — see section 2.6

4.1 Transfers to third countries

Some of these providers are based in, or process data in, the United States. This constitutes a transfer to a third country within the meaning of Art. 44 et seq. GDPR.

The basis differs by recipient:

• Adequacy decision (Art. 45 GDPR): Vercel Inc., Render Services, Inc., Functional Software, Inc. (Sentry) and Databricks, Inc. with Neon, LLC as a covered entity are certified under the EU-US Data Privacy Framework. For them the European Commission's decision of 10 July 2023 carries the transfer.
• Standard Contractual Clauses (Art. 46(2)(c) GDPR, Implementing Decision (EU) 2021/914): OpenRouter, OpenAI, Anthropic PBC and Lemon Squeezy are not certified. Their data processing terms incorporate the Standard Contractual Clauses, which are the basis of the transfer.

We last checked the certification status on 28 August 2026 against the public list at dataprivacyframework.gov. A certification can lapse or be withdrawn; if that happens, the Standard Contractual Clauses apply to the recipient concerned and we update this section.

4a. Retention

• Account, match and consent data: until you delete your account. Deleting the account removes them immediately and completely.
• Uploaded replay files: for the duration of the analysis only, then discarded.
• Usage telemetry: events linked to an account are deleted with the account. Events without an account link cannot be attributed to a person and remain in the analysis.
• Data of our YouTube channel (section 2.9): for as long as we run the channel. We delete it earlier on request.
• Chat ratings: stored without an account link and therefore not covered by account deletion.
• Invoicing and accounting data: statutory retention periods remain unaffected.

For events without an account link, expired sign-in tokens and accounts that have gone unused for a longer period, no automatic deletion runs at present. That data stays until you delete your account or ask us to delete it. We will state a period here once it actually runs — not while it is merely planned.

The data of audience measurement, heatmaps and session recordings (Umami, section 2.7) are not linked to any account. Deleting your account therefore does not reach them, and we cannot attribute them to a person either. No automatic deletion runs for them at present; we will state the period here once it actually runs.

5. Your Rights

You have the right to:

• Access your stored data
• Rectification of inaccurate data
• Erasure of your data (“right to be forgotten”)
• Restriction of processing
• Data portability
• Object to processing
• Withdraw a consent you have given, with effect for the future (Art. 7(3) GDPR)
• Lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

Contact us by email for all requests: mick.gottsch@gmail.com

5.1 Competent supervisory authority

The authority at the controller's place of establishment is competent:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Postfach 20 04 44, 40102 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de

Under Art. 77(1) GDPR you may instead contact the supervisory authority of your place of residence or of your workplace.

5.2 Self-Service (Deletion & Data Export)

• Account Deletion: You can delete your account and all associated data (profile, sessions, subscription) at any time via your account settings. Deletion is immediate and irreversible. Statutory retention periods (e.g. invoicing data) remain unaffected.
• Data Export: You can export the data stored about you as a JSON file via your account settings (Art. 15, 20 GDPR). The export includes your profile data, match results, licence, consent and subscription information — but no passwords and no security-related fields. If the scope of the self-service export is not sufficient for you, request full access informally by email; we will provide it within the statutory deadline.

The coach's chat history is stored only locally in your browser and is therefore not part of the server export. You can clear it under Settings → Privacy.

6. Local Storage & Cookies

Our website and web app use localStorage and in-memory state for technically necessary functions:

• Language preference (coach_language)
• Consent decision per category (fortiq_analytics_consent, fortiq_consent_marketing, fortiq_consent_functional)
• Chat history (stored locally, only where functional consent has been given)
• UI preferences and session state (not persistent, in-memory only)

These entries are not transmitted to our servers and can be deleted at any time via your browser settings. If you consent to analytics, the web app creates a random identifier for the current tab in sessionStorage (fortiq_telemetry_session); it disappears when you close the tab. Umami stores nothing; it only reads whether you have opted out (umami.disabled). Sentry stores nothing — no cookie, no localStorage or sessionStorage entry.

For sign-in we set two technically necessary cookies:

• fortiq_refresh_token — HttpOnly and Secure, manages your login session, cannot be read by JavaScript, and is cleared on logout.
• fortiq_has_session — holds only the value 1 and is deliberately not HttpOnly, because the app has to read it to know whether a session can be restored. It contains no identifier and no token.

No authentication tokens are stored in localStorage.

7. Data Security

We use SSL/TLS encryption for all data transfers. Passwords are hashed with bcrypt. JWT tokens have a limited validity period.

8. B2B Data Export API

For users on the Pro or Team tier, we offer an optional B2B export API. The free beta tier does not include it.

• Activation: Only via explicit API key request (opt-in)
• Exported data: match summaries, aggregated performance statistics, and on request the full timeline of an individual match
• Scoped to your own account: an API key returns only matches belonging to the account it was issued for. Other users' data cannot be retrieved through this interface.
• Authentication: Access only with a valid API key (revocable)
• Legal basis: Art. 6(1)(b) GDPR (performance of contract) or Art. 6(1)(a) GDPR (consent)

9. Language Note

This privacy policy is a translation of the German original. In case of discrepancies between the translated version and the German version, the German version shall prevail.

10. Changes to This Policy

We reserve the right to update this privacy policy as needed. The current version is always available on this page.