Privacy Policy.

Effective date: 5 October 2026. Last updated: 6 October 2026.

This policy covers UNDERDOGS at underdogsbattles.com. The service operator determines the purposes and means of the processing described here. Our published contact information is on Contact / Legal. Send privacy requests to business@underdogsbattles.com. Third-party services have their own privacy notices.

You supply your username, email, date of birth, account choices, country/region, optional city and currency preference, and any profile image, text or links you choose to provide. We store account identifiers, verification and Terms-acceptance records, timestamps, sessions and hashed passwords for email/password accounts. We process your password to authenticate you, but do not store it in plain text. Transactional emails support verification, password recovery and account deletion.

Date of birth is private account data used to check the minimum age of 14, administer account eligibility and age-related service rules, and handle corrections or age reviews. It is not shown on public profiles or returned in public APIs. We do not add it to recommendation snapshots, commercial music insights, advertising, affiliate or sponsor analytics. It is set once through registration or account completion; contact our privacy address to correct a mistake. We do not request your birthday from Google or treat missing information as proof of adulthood.

Country, city and currency settings are private account preferences, not verified tax residence. Localized FIRES pricing can use Cloudflare's approximate request country when you have not provided a usable preference or country. This does not use GPS or save the inferred country as your selected account country.

Information can also come from connected providers, public YouTube metadata, administrators, reports and other users interacting with your content. Public artist records can exist before an artist claims them. Contact us to correct an attribution or request review.

Google Sign-In supplies identity information such as Google account ID, email, verification state, name and profile image to authenticate your UNDERDOGS account. It is separate from connecting YouTube. The Google account used for a YouTube connection may differ from the one used to sign in.

UNDERDOGS uses YouTube API Services. A channel connection requests the youtube.readonly scope, which provides read-only YouTube access to verify control of the exact channel, discover uploads and validate selected imports or Snippets. We access channel ID, title, avatar and uploads playlist, and video IDs, titles, publication information, thumbnails and eligibility or availability metadata. We keep connection information and encrypted access/refresh credentials while connected. We do not receive your Google or YouTube password or upload, edit or delete videos on your behalf.

Selected public music and published Snippets are displayed through official YouTube players only after optional Media consent. Change or withdraw Media, Preferences and Analytics choices on our Cookie Policy page. Withdrawal removes active players and stops future optional browser initialization, but cannot undo earlier disclosures or clear third-party storage. Ordinary catalog images may load before consent. Video files are not copied into our storage. Unlisted Snippets become accessible through their published link. YouTube can receive network, device, referrer and playback information when its player or images load, and can serve its own content or advertising. See the Google Privacy Policy and our Cookie Policy.

Disconnect YouTube in Account to remove the local connection credentials and initiate token revocation. You can also revoke access through Google Account connections. Disconnecting alone does not erase imported song or artist records. Contact our privacy address to request removal of stored YouTube-related data as well. Removing data from UNDERDOGS does not delete a video or account on YouTube. Google API data use is subject to the Google API Services User Data Policy, including applicable Limited Use restrictions.

UNDERDOGS does not sell Google user data. We do not share or transfer Google user data to advertising platforms, data brokers or information resellers, and we do not use it for personalized advertising, retargeting or interest-based advertising. We use Google Sign-In information and authorized YouTube data only to provide or improve the user-facing features described in this policy, subject to the Google API Services User Data Policy and applicable Limited Use requirements.

Cloudflare processes this information as needed to host, store, deliver and secure UNDERDOGS. Google/YouTube receives the authorization and API requests needed for the connection you request. If your UNDERDOGS account email or name came from Google Sign-In, necessary account details may also be sent to Resend to deliver account emails and to Stripe when you request payment services; these services do not receive your YouTube access or refresh tokens. Public profile information and music metadata you choose to publish are visible to visitors as described above. Provider roles and international processing are explained in section 11.

Operational transfers are limited to what is necessary for these visible, user-requested features and any consent required by Google policy. We may disclose necessary Google user data to authorized service providers, security responders or competent authorities to investigate security incidents, fraud or abuse, or comply with applicable law, only within the Google API Services User Data Policy. This is not permission for unrelated commercial sharing. Human access is restricted to authorized personnel and permitted purposes, including your affirmative agreement where required, necessary security investigations or legal obligations.

UNDERDOGS uses HTTPS/TLS for production connections and Google/YouTube API communications. YouTube connection access and refresh credentials are encrypted at rest using AES-GCM before being stored. Encryption keys and OAuth client secrets remain in server-side configuration, outside client-side application code. This application-level encryption statement concerns the separate YouTube connection credentials, not every Google Sign-In record.

Authentication and artist-permission checks restrict access to connected-channel operations. Sensitive OAuth credentials are handled by authorized server-side components, not returned in ordinary Account or public Artist responses, and are not intentionally written to application logs. Our application error logging uses limited error information and redacts sensitive authentication paths. UNDERDOGS never receives or stores your Google or YouTube password; Google authenticates you in its own authorization flow.

On YouTube disconnect or completed account deletion, ordinary connection credentials are removed and authorized connection caches are cleaned up. If revocation cannot be confirmed immediately, an encrypted credential may remain in a separate, revocation-only retry queue: it cannot be used for new YouTube API access, is cleared after successful revocation, and becomes unusable by the retry process at its expiry deadline. Scheduled cleanup removes expired queue credentials; an infrastructure outage can delay physical cleanup. Required refresh, revalidation and deletion routines limit retention of YouTube API data. Native UNDERDOGS history is distinct from authorized YouTube data, and public metadata may be reacquired separately. See sections 12 and 13 for retention and account deletion. These safeguards reduce risk but do not guarantee absolute security.

Public artist/song metadata, artist links, event details, approved Snippets, comments and replies can be seen by other visitors. Your username, displayed avatar, artist verification and supporter tier may appear with public comments. The supporter tier is not a display of your exact purchase spend. Likes, votes and other interactions contribute to counts and results. Reports and account notifications are not public listings.

Favorites and playlists are private by default. If you enable a playlist sharing link, anyone with that link can view its name and eligible tracks without signing in; this also applies if you share Favorites. A recipient can forward the link. Discovery history and For You choices are not published as a public taste profile. Artist owners and authorized managers see the operational information needed to manage their artist, including relevant support messages and earnings information where permitted. Be careful not to place sensitive personal information in public content or gift messages.

For You uses saved music, explicit like/dislike choices and genre/language preferences to select discoveries. We store recommendation sets, progression and swipe events, including song/artist/genre/language snapshots, account and plan context, selection context and timestamps. These are interaction records, not proof that you listened to an entire video. They do not change Battle scoring.

Battle matching and Rankings use eligibility, filters and eligible competitive results. Artist dashboards use stored saves, Battle results, ranking history and aggregated profile visits. Campaign and tournament measurement includes impressions, decisions, participant/voter totals and sponsor-link clicks. Identifiers or temporary pseudonymous keys help prevent duplicate counting and abuse. Sponsors receive aggregate operational results rather than a list of listener emails or individual taste profiles.

These discovery and ranking features are not used to decide legal rights, creditworthiness or similarly significant matters. Automated security and financial controls can delay or restrict an action; contact us if you need a decision reviewed.

A separate, optional Account → Region & Currency choice permits future music-choice events and self-declared country/city information to contribute to aggregate music insights, including for commercial clients. It is off by default and does not authorize earlier events retrospectively. Refusing it does not prevent ordinary account use. Withdrawing it stops new authorized collection and removes geographic associations and commercial authorization from retained swipe events. The current feature does not provide commercial clients with individual-event exports or individual personal profiles. Operational recommendation records are separate; removing an account identifier does not automatically make all remaining data anonymous.

Friends sessions store room membership, choices, progress and results; participants see the names and session information needed to play together. An optional Twitch connection records channel/account ID, login/display name, profile image, encrypted tokens and connection state. Twitch chat events are processed to count A/B choices in the connected channel. We do not persist the chat message text or chatter display names for voting. Temporary per-round pseudonymous chatter keys prevent repeat choices; those rows are removed when a round is finalized. Event-delivery deduplication records expire after one day and are cleaned during round maintenance. Streamer session and aggregate round history remain until removed through the applicable account process. You can disconnect Twitch without deleting your UNDERDOGS account.

Stripe handles payment-card and payment-method information in its interfaces. UNDERDOGS stores transaction identifiers and status, customer/subscription/Checkout/payment references, amounts, currencies, package quantities, pricing versions, gifts and messages, earning allocations, payout references, refunds, disputes and recovery records. These records support access, accounting, fraud prevention, reconciliation and resolving claims. FIRES checkout and Connect payouts are currently test-mode integrations; test financial records are still handled as account data.

For artist payouts, Stripe Connect handles onboarding and financial/identity details requested by Stripe. We retain the connected-account ID, eligibility/onboarding status and transfer/payout information needed to administer earnings. Payout review can use purchase-to-gift and gift-to-payout records to identify affected funds. Subscription and Sponsored Track transactions use Managed Payments where shown in Checkout; FIRES checkout does not. Read the Stripe Privacy Policy for Stripe and Link processing.

We process request/network information, Cloudflare country metadata, verification results, pseudonymous visitor/network identifiers, rate-limit records, errors and administrative audit information to protect the service and investigate abuse. Cloudflare and Turnstile receive network/device information, and the Turnstile verification request can include your IP address. New application sessions do not retain raw IP addresses or user-agent strings in their session fields; this does not mean infrastructure providers never process them. Reports include the relevant content, reason, details, status and investigation records. Uploaded profile pictures and sponsor creative are stored through Cloudflare R2; public images can be cached by browsers and delivery networks.

• Requested service: account access, music collections, artist tools, transactions and connected features use information needed to perform the relevant agreement or take requested pre-contract steps.
• Consent: optional commercial-insights processing and any processing that legally requires consent must have a separate appropriate choice. Withdrawal does not affect the lawfulness of earlier consent-based processing.
• Legitimate interests: checking our minimum-age policy and handling age-related account restrictions, with particular regard to children's rights, and service security, proportionate abuse prevention, operational measurement, moderation and maintaining accurate public music records, subject to your rights and the required balancing of interests.
• Legal obligations and claims: necessary financial records, lawful requests and establishment, exercise or defence of legal claims. This does not justify retaining every record indefinitely.

Cloudflare provides hosting, databases, image/file storage, delivery and security. Resend delivers account emails. Google/YouTube provides identity, channel access, metadata and media; Twitch provides the optional chat-voting integration; Stripe/Link provides payment services and Stripe Connect. Authorized staff use necessary information for support and moderation. Public content is visible to visitors and may be indexed by search engines. External artist, event or Deals links take you to the relevant operator, which then handles your visit under its own terms.

Provider roles depend on the service: a provider can process information on our instructions and also act independently for its own security, legal or payment obligations. Provider infrastructure can involve processing outside your country or the EEA. Applicable transfer rules require an appropriate basis and safeguards, such as an adequacy decision or contractual safeguards where applicable. Contact us for information about arrangements relevant to your data; this notice does not claim that all data stay in Europe.

Provider notices: Cloudflare, Resend and Twitch, alongside the Google and Stripe notices above.

Date of birth and any age-review flag are retained for account eligibility and administration while the account exists and are cleared on completed account deletion. They are not copied into financial records. Verified account information is retained while the account is active, subject to deletion and other applicable rights. Never-verified email/password registrations are eligible for deletion after 72 hours. Authentication and one-time security records expire according to their purpose and are removed by periodic cleanup. Current administrative audit records have a one-year cleanup period. Expiry and physical cleanup are not necessarily simultaneous.

Comments, artist/song history, interactions, reports, analytics and financial records do not all have an automatic final deletion date. Retention depends on the requested feature, unresolved disputes, necessary historical integrity and applicable legal/accounting duties. Financial records can remain after an account or test balance is closed. Archived Snippets can retain feedback for restoration; account deletion removes owned Snippets. Sponsor creative is scheduled for removal after the featured results period or cancellation. Browser and provider retention is described separately in the Cookie Policy.

For a specific record, contact us for its retention basis or request deletion. Public availability or a historical purpose is not by itself a blanket exemption from privacy rights or YouTube data requirements.

Request deletion in Account, then confirm using the emailed link within 24 hours. The confirmation page also lets you cancel the request. You do not have to accept newly updated Terms to use the deletion process. Unresolved FIRES payments or reversals can require support review rather than automatic completion.

Completed deletion removes sessions and linked credentials, account collections, notifications, memberships and private recommendation settings; identifying account fields are replaced. Comment text and attribution are removed, as are relevant likes and gift replies; gift messages are cleared. Swipe records lose the account and geographic/commercial associations. Sole-managed artist profiles can become unclaimed and their events are unpublished.

Canonical songs/artists, some historical interactions, minimized account references and necessary financial/moderation records can remain. Active subscriptions are canceled, and provider-token revocation is attempted. Disconnecting an integration is narrower than account deletion. Copies already received by other users, search engines or third-party services are not automatically erased by deleting your account. A financial review does not remove your right to request erasure of unrelated personal data.

Depending on applicable law, you can request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. You can withdraw geographic/commercial-insights consent in Account and optional browser-technology consent on our Cookie Policy page, or contact us. We may need proportionate information to verify a request, but do not send passwords or full payment credentials. GDPR requests normally receive a response within one month; a permitted extension must be explained.

You may complain to your competent supervisory authority, including the Italian Garante where applicable. Contacting us first is not a condition of that right.

UNDERDOGS accounts are for people aged 14 and over. We collect a self-declared date of birth and block account completion below 14; this is not independent verification of a person's age. Users aged 14–17 need permission from a parent or legal guardian to make purchases or use paid features, as stated in the Terms. We do not claim to verify that permission. If you are a parent or guardian concerned about a child's account or data, contact our privacy address. Event-specific restrictions and provider requirements may also apply.

We use access controls and other safeguards, but cannot promise absolute security. Material changes to processing require appropriate notice and any consent required by law. See our Terms for service rules and Contact / Legal for requests.