Privacy policy

1. Controller

2. Website visits and technical delivery

When the service is opened, technically necessary connection data is processed, including IP address, date and time, requested page, and browser or app information. This processing is necessary to provide the service securely under Art. 6(1)(f) GDPR. Server and security logs are retained only as long as needed for troubleshooting and abuse prevention.

Overseer does not use analytics cookies. Advertising cookies on the website are only set with your consent (see section 6). A locally stored value may only remember whether the notice for the current Dota version was dismissed. The native Overwolf app also stores a session identifier locally so that you can stay signed in. These values remain on your device and can be removed through browser/app data or by signing out.

3. Dota and Steam data

To display game statistics, we process public Dota and Steam profile data, such as Steam ID or account ID, display name, avatar, match, and rank data. When you search, the entered Steam ID, friend code, or player name is sent to the respective data sources. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is providing the requested game analysis.

Steam OpenID is used for Steam sign-in. We store the Steam ID, derived account ID, account creation and last sign-in time, and a random session identifier. Sessions expire after 30 days or can be ended through “Logout”. We do not receive your Steam account credentials.

4. Account, public profile, and LFG

If you voluntarily provide profile details, we process your Discord username and links to Twitch, X, and Reddit. Before saving, we explain that these details are publicly available on your Overseer profile. An optional Twitch link may be shown publicly with the live status you choose. You can remove these details at any time.

LFG posts contain the region, language, roles, party size, microphone preference, and message you enter, together with your public display name, avatar, and rank. They are visible to other signed-in users and are automatically deleted after no more than three hours.

Optional email addresses are stored only after confirmation. Confirmation links are single-use and valid for 30 minutes. Processing is carried out to provide the relevant function under Art. 6(1)(b) GDPR or on the basis of your consent under Art. 6(1)(a) GDPR.

5. Recipients, external content, and platform

Depending on the function used, data is sent to external providers: Valve/Steam, OpenDota, Liquipedia/Dota sources, and, where applicable, Resend for confirmation emails. Dota images and symbols may be supplied directly by Steam CDN services, including Cloudflare Steamstatic. These providers receive at least your IP address and technically required request data.

The native application runs on the Overwolf platform. Overwolf may process data as an independent platform provider under its own privacy policy. The respective providers’ privacy policies also apply. Transfers to countries outside the EEA may occur only where the relevant provider provides an appropriate legal basis.

6. Advertising (Google AdSense)

The website (not the Overwolf app) shows advertising through Google AdSense, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may use cookies and similar technologies to deliver ads, limit how often they are shown, measure their performance, and prevent fraud, and it receives your IP address and browser information for this purpose.

When you first visit the website, a consent dialog provided by Google (a certified consent management platform) asks whether you agree. Cookies and device access for advertising are only used with your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG; without consent, only non-personalised ads may be shown to the extent permitted. You can change or withdraw your choice at any time through the privacy settings link shown on the website. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. More information: policies.google.com/technologies/partner-sites.

7. Hosting and security

The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in the EU. Requests are passed through Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) for secure delivery over HTTPS and protection against attacks; Cloudflare processes connection data such as your IP address for this purpose and is certified under the EU-U.S. Data Privacy Framework. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and reliable service. Data processing agreements are in place with both providers. The desktop version uses a local service on the device.

We use technical safeguards such as access controls, security headers, and protected sessions; complete security of Internet transmission cannot be guaranteed.

7a. Contact form and reports

If you use the contact form (bug report, feedback, account help, or a report of illegal content), we store your message, the selected topic, your email address if you provide one, your browser identification, and, if you are signed in, your Steam ID and display name. We use this only to answer and handle your request and to prevent abuse (the number of messages per sender is limited). The legal basis is Art. 6(1)(b) and (f) GDPR. Messages are deleted when they are no longer needed, at the latest after twelve months.

Reports of illegal content (for example in public profiles) are reviewed promptly under the EU Digital Services Act; you will receive a response if you leave an email address.

8. Retention and deletion

Account data is retained until you request deletion or it is no longer needed. “Delete my account and data” lets you delete the account, stored profile details, and an active LFG post. Sessions are deleted after 30 days, unconfirmed email verifications after 30 minutes, and LFG posts after three hours. Statutory retention duties remain unaffected.

9. Your rights

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. You may withdraw granted consent at any time with effect for the future. Contact [email protected].

You also have the right to lodge a complaint with a data-protection supervisory authority. The competent authority is generally the Baden-Württemberg Commissioner for Data Protection and Freedom of Information.

Last updated: September 27, 2026