Legal

Privacy Policy

BrawlPilot keeps as little about you as it can get away with: an address to sign you in, and a count of how many picks you have left today. This page says exactly what that means, who else sees it, and how to make us delete it.

Last updated 31 July 2026

Who is responsible

BrawlPilot is run by The operator of BrawlPilot, who is the data controller for the personal data described here and is established in Spain. This site is therefore governed by the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).

For anything on this page, including requests to see or delete your data, write to brawl.pilot.drafter@gmail.com.

What we collect, and why

You can browse the whole site, including every tierlist, without an account. We only store personal data once you sign in, because a pick allowance has to belong to someone.

Data	Why we have it
Email address	Identifies your account. It is the account key, so signing in with Google and with a code using the same address reaches the same account and the same Energy Drinks.
Name and profile picture	Only if you sign in with Google, and only to show who is signed in. Never shown to anyone else.
Sign-in method	Records whether the account was created with Google or with an email code.
Account timestamps	When the account was created and last used, so dormant accounts can be cleared out.
Energy Drink counters	How many picks you have left today, how many reward videos you have watched, and the current date. This is what enforces the daily allowance.
Login codes	If you sign in by email, a six-digit code, its expiry and the number of attempts. The code is stored hashed, never in readable form, and is overwritten on the next request.

We do not collect your Brawl Stars account, your player tag, your in game statistics, your location, or your payment details. There is nothing to pay for, so there is no payment data to lose.

What the drafter sends when you ask for a pick

When you request a pick, the map, mode, bans and the brawlers already drafted are sent to an AI model provider to generate the recommendation. That request describes a Brawl Stars draft and nothing else. Your email address, your name and your account identifier are not included in it, so the model provider cannot connect a draft to a person.

Cookies

Two cookies are strictly necessary and are set whether or not you accept anything, because without them signing in cannot work. The advertising cookies are separate and are only set if you consent.

Cookie	Purpose
bp_session	Keeps you signed in. Signed so it cannot be tampered with, and marked httpOnly so page scripts cannot read it. Strictly necessary.
bp_oauth_state	A short-lived value that protects the Google sign-in round trip against cross-site request forgery. Deleted as soon as sign-in finishes. Strictly necessary.
Google advertising cookies	Set by Google to serve and measure ads. Only set once you have given consent through the banner, and removable by withdrawing that consent.

Advertising

BrawlPilot is free and is paid for by advertising. We use Google AdSense. Google is an independent controller for the data it collects through its ad tags, and it may set cookies or read device identifiers to serve and measure ads.

If you are in the European Economic Area, the United Kingdom or Switzerland, we ask for your consent before any advertising cookie is set, using a Google certified consent tool. You can change or withdraw that choice at any time from the privacy link in the page footer, and withdrawing it is as easy as giving it.

You can review and control how Google personalises ads to you at myadcenter.google.com, and read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.

Who else sees your data

We do not sell your data and we do not share it for anyone else’s marketing. These providers process it on our behalf, or alongside us, purely to make the site work:

Provider	Role
Vercel	Hosts the site and runs the server code.
Supabase	Stores accounts and Energy Drink counts.
Google	Provides Google sign-in, and serves advertising through AdSense.
Resend	Delivers the six-digit sign-in code, when email sign-in is enabled.
OpenRouter	Routes the draft request to the AI model that produces the pick. Receives no personal data.

Some of these providers operate outside the European Economic Area. Where data reaches a country without an EU adequacy decision, the transfer relies on the European Commission’s Standard Contractual Clauses.

We may also disclose data where the law requires it, or to investigate abuse of the service such as attempts to inflate the Energy Drink allowance.

Legal basis for using your data

Purpose	Basis
Running your account and the pick allowance	Performance of a contract, being the terms you accept by using the service.
Advertising cookies and ad personalisation	Your consent, given through the banner and withdrawable at any time.
Security and abuse prevention	Our legitimate interest in keeping the service usable and not paying for fraudulent traffic.

How long we keep it

Account data is kept while the account exists. Delete the account, or ask us to, and it is removed. An account that has not been used for 24 months may be deleted without notice. Sign-in codes expire within minutes and are overwritten on the next attempt. Energy Drink counters reset daily and carry no history.

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to processing based on legitimate interest. You can withdraw consent to advertising cookies at any time without affecting anything done before you withdrew it.

Write to brawl.pilot.drafter@gmail.com and we will answer within one month. If you think we have handled your data badly you can complain to your national data protection authority. In Spain that is the Agencia Española de Protección de Datos, www.aepd.es.

Children

You must be at least 14 to hold a BrawlPilot account. Where the law of your country sets a higher age for consenting to online services on your own, that higher age applies instead.

We do not knowingly collect data from anyone below that age, and we do not allow ads to be personalised on the basis of age for users we know to be minors. If you believe a child has created an account, tell us at brawl.pilot.drafter@gmail.com and we will delete it.

Changes

If this policy changes in a way that matters, the date at the top changes with it and the notice appears on the site. Continuing to use BrawlPilot after that means the updated policy applies.