Privacy — WE-NEO

Who we are

WE-NEO is a speedrun leaderboard for the Neo Geo AES+, operated at we-neo.com by WE-NEO LLC, a Kentucky limited liability company in the United States. That company is the controller of the personal data described here. For anything on this page — a question, a correction, or a deletion request — use the support page or write to support@we-neo.com.

Signing in

WE-NEO has no password login. You sign in with Discord, Twitch or Google, and we never receive, see or store a password. From the provider you chose we receive your account ID, username, avatar and email address. The username and avatar appear on your public profile as a verified link — that verified link is what stops someone claiming to be you on the boards. You can hide it or unlink the provider in account settings.

What we store

Your profile: the handle you choose, optional Twitch and YouTube links, whether you own an AES+, and your Founding Member status. This is public.
Your runs: game, category, time or score, the video link, your notes, and the moderation record — who verified or rejected the run and why. Public by design; a leaderboard nobody can check is worthless.
Community activity: forum threads and posts (public), who you follow, and any run reports you file. Reports are visible only to moderators, not to the runner you reported.
Notifications: if you turn on browser notifications we store the push endpoint your browser issues and its encryption keys. Turning notifications off deletes them.
Forms you fill in: Founding Member signup (email, optional handle, AES+ ownership), homebrew developer intake (name, email, game, link), partner and press requests (name, organisation, email, message), and support requests (email, topic, message).

What we collect automatically

Two things, and both are deliberately blunt. First, your browser's preferred language, plus a rough country hint, counted into an aggregate tally so we know which languages to translate the site into. No IP address is stored and there is no per-visit record — just a running count per language. Second, aggregate page analytics via Vercel Web Analytics: page views and referrers, counted without cookies and without a profile of you — it tells us which pages get read, not who read them. Our hosting provider also keeps standard server logs for security and troubleshooting, as every host does.

Cookies

We set three kinds, and none is for advertising.

Sign-in cookies (sb-…) — essential. They are what keeps you signed in; without them the site cannot have accounts.
wn_lang_tracked — a 30-day flag so the language tally counts you once a month rather than on every page load.
wn_attrib — a 30-day note of how you first arrived (a campaign tag from the link you clicked, or the site that referred you). If you then join the Founding Member list, it tells us which campaign worked. It contains no identity and we read it only at signup.

We run no advertising cookies and no cross-site tracking, and we do not sell or share personal information for advertising. The only analytics is the aggregate, cookie-less kind described above.

Email and unsubscribing

Two kinds of email leave this site. Service email — your run was verified, your support request got an answer — is part of running the boards. News and launch email is optional, and every such message carries an unsubscribe link plus the one-click unsubscribe header your mail app understands. Unsubscribing puts your address on our do-not-email list, which we keep on purpose: that entry is what stops future sends, so it survives your other data. We also keep a log of what we send — which address, which template, whether it went through — because "stop emailing me" is a promise we have to be able to prove we kept.

Who else sees your data

Only the companies that run the site for us, each doing one job, none of them permitted to use your data for their own purposes:

Supabase — the database and the sign-in system.
Vercel — hosting and delivery.
Resend — sending email.
Discord, Twitch or Google — whichever you chose to sign in with.
Your browser's push service (Apple, Google or Mozilla) — only if you turned notifications on.

These providers are US-based, so your data is processed in the United States. Run videos stay on YouTube or Twitch — we store only the link, and watching one happens under that platform's own privacy policy, not ours.

Why we are allowed to hold it

If you are in the EEA or UK: we process your account and run data to provide the service you signed up for; we process moderation records and reports under our legitimate interest in keeping the boards honest and the site secure; and we rely on your consent for browser notifications and launch emails, which you can withdraw at any time.

How long we keep it

Runs and forum posts: as long as the boards exist. They are the public record.
Founding Member signups: until you unsubscribe or ask us to remove you.
Support and partner requests: kept while we work on them and for a reasonable period after, so we have the history if you write again.
Language counts: kept indefinitely — they are aggregate numbers and are not personal data.

Deleting your account

You can delete your account yourself in account settings. Here is exactly what happens, because the honest version matters more than the reassuring one:

Your handle is replaced with an anonymous placeholder, and your Twitch and YouTube links are removed.
Your Discord, Twitch and Google links are severed — the provider username and avatar we held are deleted, and that provider account is free to start fresh.
Everyone you follow and everyone following you is unlinked.
Your sign-in email is overwritten so the account cannot be recovered or signed into again.
Your verified runs stay on the boards, attributed to the anonymised profile — including the video link you submitted.

That last point is a deliberate choice. Removing a verified record would silently rewrite leaderboard history for every runner who was ranked against it. The video itself is on YouTube or Twitch and remains entirely under your control there — take it down and the link goes dead. If you need a run removed rather than anonymised, ask us and we'll talk it through.

Your rights

Wherever you live, you can ask us for a copy of what we hold, ask us to correct it, or ask us to delete it. If you are in the EEA or UK you can also object to processing, ask for portability, and complain to your data protection authority. If you are in California, you have the right to know, delete and correct — and note we do not sell or share personal information, so there is nothing to opt out of. Ask via the support page; we'll respond within 30 days.

Children

WE-NEO is not directed at children under 13, and Discord, Twitch and Google each enforce their own minimum age before you can sign in at all. If you believe a child under 13 has an account here, tell us and we'll remove it.

How it is protected

Every table in our database enforces row-level security, and the sensitive columns — suspensions, founding status — are additionally guarded so that not even your own account can rewrite them: access is decided by the database itself rather than by the app asking nicely. We store no passwords at all. Administrator accounts require multi-factor authentication, and the whole site is served over HTTPS. Sensitive actions — a role granted, an account deleted, a moderation decision — leave an internal audit record that administrators cannot quietly erase. No system is perfect, and we won't pretend otherwise — but those are the floors.

Changes to this policy

We'll update the date at the top when this changes, and if the change is material — new data collected, a new company involved — we'll say so on the site rather than quietly editing the page. See also our Terms of Service.

What we collect, and why