This policy explains how FOBDROP (“we”, “us”) handles personal data on fobdrop.com and its services. It takes effect on 26 October 2026. We are the controller of the personal data described here, except for what you give Stripe at checkout, which Stripe controls (see Payments and Stripe).
Our approach
The short version
You can browse FOBDROP without signing in. Hosting and security providers process connection and request details to deliver and protect the site.
- No tracking. No advertising or analytics cookies, no cross-site tracking and no fingerprinting.
- Nothing sold. We don’t sell your personal data or share it for advertising.
- Account sign-in. You sign in on Discord’s own site and link Steam, if you want to, on Steam’s own site. We never receive either password, and Discord sign-in does not request your email address. During sign-in, FOBDROP briefly uses a Discord OAuth access token to request the approved profile fields, then attempts to revoke it. That token is not retained in our database. Stripe handles checkout payment details and email addresses.
- Your data, your call. See it, export it or delete it whenever you like.
What we collect
Member preferences and saved setups
Airdrop members can save their selected site theme, a current loadout and artillery setup to their FOBDROP account for use on other devices. Server-finder preferences sync for every signed-in player without a membership. Members can also cast one vote for the next tool. FOBDROP stores that choice and its update time; published vote totals do not show voter identities. Your own saved setups and vote are included in your account data download and can be removed on your account page. If membership ends, existing member setups remain available to view, restore, download and delete; creating or updating member cloud saves and casting votes require active membership. Deleting your account removes these preferences, saves and votes.
Optional WARDOGS connection
If you choose to connect Steam and WARDOGS on your account page, one Steam sign-in supplies a fresh ownership assertion to WARDOGS’ Pragma service for validation. FOBDROP keeps the resulting game session encrypted on its server to request your own game data. Session credentials are never sent to other visitors or stored in your browser, and FOBDROP does not keep the Steam assertion. The same proof is not verified a second time by FOBDROP. We keep verified class levels, cumulative XP for each class, the observed season number, named cash and gold-bar balances, and their check time. XP, season metadata and wallet balances are included in your account data download. They appear on public player views only when Steam/game-stat sharing is enabled in your profile settings; existing hidden choices stay hidden. You can turn sharing off from your account page. Connection status, retry times and the names and types of observed data fields may also be kept; this diagnostic metadata contains no raw game values. Visits request a refresh when the verified snapshot is at least one hour old; you can manually refresh every five minutes, subject to provider retry limits. Disconnecting WARDOGS, unlinking or changing Steam, or deleting your FOBDROP account removes the stored game session, verified progression and wallet balances. Combat stats, bank balance and lifetime earnings are not currently available; we do not infer earnings from balance changes. Public Steam hours and achievements work independently.
The short version
What FOBDROP processes depends on how you use it. Browsing is available without an account; hosting and security request data still applies.
| Who | What FOBDROP collects |
|---|---|
| Every visitor | Anonymous usage counts: how often pages and tools are used, counted with no cookies, no stored IP address and no user ID, so a count can’t be linked to you. Security logs: Cloudflare, which hosts FOBDROP, processes your IP address, browser details and the pages you request in order to deliver the site and block attacks. Preferences: your theme, whether you’ve hidden the starter guide, and the choices you use in the tools, saved in your own browser’s localStorage. Local copies stay in your browser. The account preferences and cloud saves described above are also stored on FOBDROP when you use those account features. |
| Signed-in players | From Discord: your Discord user ID, username, display name and avatar. From you: the FOBDROP username you pick, your public profile (a short line, color, banner, picture choice, role, favorite map, team, region and whether you’re looking for a squad), the setups you save. From your connected game account: verified class levels, cumulative class XP, the observed season number, named cash and gold-bar balances, and their check time. Public sharing follows your Show my WARDOGS stats setting. Manually entered levels and level pictures are no longer accepted or used. Old player-supplied levels are not displayed as game data. From Steam, only if you link it: your SteamID, public persona name and avatar. From Discord, only if you press Link socials: the Twitch, YouTube, TikTok, X and Reddit accounts you’ve connected to Discord and Discord has verified: each one’s account id and public name. Nothing else Discord lists is kept. About your account: the dates you joined, last visited and last changed your username or custom URL, and, for each browser you’re signed in on, when the session started, was last used and expires. |
| Members | Your membership: plan, status (active, ended or refunded), when it started and the date it’s paid to. Your payments: Stripe customer, checkout, subscription, invoice and payment ids; the plan and advertised checkout price; payment status, funded-period dates and minimal event, refund and dispute records needed to apply or correct access. Card details, billing addresses, tax and receipts stay with Stripe. The members’ role on the FOBDROP Discord is linked through the Discord account you sign in with. |
| Sign-in limits | Account sign-in does not request passwords, email addresses, friends, messages, a full Steam library or inventory. FOBDROP does not retain Discord OAuth access tokens or Steam sign-in assertions in its account database. The optional encrypted WARDOGS session and public game data are handled as described above. |
FOBDROP collects its player-count history from Steam’s public API, not from you or another statistics site’s collection.
Support correspondence. If you email FOBDROP, we receive your email address and the message you send so we can handle your question or request. This is separate from Discord sign-in, which does not request your email address.
Your public profile. Your username has a public profile page at fobdrop.com/u/your-name/ that anyone can open, share and find in the player search. It shows your username, the picture you choose (your Discord avatar, your Steam avatar or just an initial), your profile choices, the month you joined, a member badge if you’re an Airdrop member, and the socials you leave switched on. Your verified class levels, WARDOG level, cumulative class XP, observed season, cash and gold-bar balances with their check times, your WARDOGS hours and achievements from Steam, and a link to your Steam profile show only when Show my WARDOGS stats is enabled. This setting is off for new accounts. Connecting Steam does not turn it on; choose it in your profile settings and save to share. Existing accounts keep their current sharing choice, and you can turn it off from your account page. Your Discord name and Discord ID are never shown. Your SteamID is public in the Steam profile link and the public game-profile API when you enable sharing. The API uses the same sharing controls as these pages. Profile pages ask search engines not to index them.
Looking up Steam players. Anyone can look up a Steam player’s WARDOGS hours and achievements on FOBDROP by SteamID or Steam profile link, including players who don’t use FOBDROP. That information comes from Steam’s official Web API and is only what the player’s own Steam privacy settings make public. These lookup results are not written to FOBDROP’s account database. Cloudflare caches each answer for up to 5 minutes. Linked account identities and authorized game snapshots are retained separately as described in this policy. To hide your WARDOGS details everywhere, set your Steam profile’s game details to private in Steam.
Cookies and local storage
The short version
FOBDROP sets no tracking cookies. Your preferences live in your own browser.
- Preferences (theme, starter guide hidden, Squad Up choices and ping estimates, and your choices in Best Loadouts and Level Up) are kept in your browser’s localStorage, not in cookies. Local preferences stay on your device, and clearing browser data removes that local copy. Signed-in players’ server-finder choices are also saved on their account for use across visits and devices; Reset in the finder replaces those saved choices with defaults, and deleting the account removes them. We do not create a hidden profile from unrelated browsing or personal information.
- Signing in uses two strictly necessary cookies. One holds a random, signed session id (not your Discord or Steam details) and ends when you sign out, or after 30 days without a visit. The other holds only “1”, so pages know to show your account. While you sign in or link Steam, a third cookie protects that step against forgery and expires after 10 minutes.
- Security. Cloudflare may set a strictly necessary cookie to tell people from bots.
- Checkout. Stripe’s pages use their own cookies for payments and fraud prevention, under Stripe’s policies.
Strictly necessary cookies and storage don’t need consent. FOBDROP shows no ads today, and members never see ads. If it ever shows ads to non-members, we’ll update this policy first and ask for your consent before setting any advertising cookies, wherever the law requires it.
Why we use it
The short version
Only to run FOBDROP, keep it safe, deliver what you paid for, and learn in aggregate what to build next.
Under the GDPR and UK GDPR, each use needs a legal basis. These are ours.
| What we do, and with which data | Legal basis |
|---|---|
| Deliver the site and keep it secure, using security logs | Legitimate interests: keeping FOBDROP fast, available and safe |
| Learn which pages and tools are used, using anonymous counts | Not personal data. Where it could be, legitimate interests |
| Remember your preferences, using localStorage on your device | Strictly necessary for a feature you chose |
| Sign you in and keep your username, saved setups and class levels, using your Discord profile, authorized game data and what you save | Contract: providing the account you asked for |
| Link Steam, using your SteamID and public Steam profile, only if you link it | Contract: a feature you chose. Unlink at any time |
| Show your public profile and verified socials, using your profile choices and the socials you leave on | Contract: the profile you set up. Hide or remove any part at any time |
| Answer Steam lookups, using public Steam data, not stored | Legitimate interests: letting players see public game stats; Steam’s own privacy settings apply |
| Keep names and profiles clean, by checking usernames, custom URLs and profile lines against a word filter | Legitimate interests: protecting players, many of them teenagers |
| Moderate and keep staff accountable, using account details, your FOBDROP Discord roles and the staff log | Legitimate interests: a safe community, and a record of every staff action |
| Provide your membership and perks, using membership records and your Discord account | Contract |
| Keep tax and accounting records, using payment records | Legal obligation |
| Prevent fraud and abuse, and enforce our terms, using relevant account records | Legitimate interests: protecting players and the service |
We don’t make decisions about you by automated means that have legal or similarly significant effects, and we don’t build advertising profiles.
Payments and Stripe
The short version
Stripe sells memberships as merchant of record and handles your card, email address and receipts. We only get what we need to switch your perks on.
Memberships are sold through Stripe Managed Payments. Stripe acts as merchant of record (reseller) and, as an independent controller, is responsible for the data you give at checkout, such as card details, email address, billing address and fraud-prevention signals. Stripe’s privacy policy applies to the checkout.
After a payment, Stripe sends FOBDROP a signed notification. From it, we keep only what’s listed under Members in What we collect. We never see or store your full card number. Receipts and payment emails come from Stripe.
Who else sees data
The short version
Only the services that run FOBDROP, and only what they need. We don’t sell your data or share it for advertising.
- Cloudflare, Inc. (United States) hosts the site, its database and its security, and processes data on our behalf.
- Stripe sells memberships as merchant of record and handles payments, tax and receipts, as an independent controller.
- FOBDROP staff. Staff are the people the FOBDROP Discord gives a staff role. They use a staff console to keep the site safe. They can see account details (your FOBDROP and Discord names, Discord ID, SteamID if linked, dates, membership and how many devices you’re signed in on) and, only within their role, clear rule-breaking profile text, rename a rule-breaking username, sign an account out, suspend it, manage memberships or delete an account. Every staff action is logged with who did it and why, and kept for 2 years.
- The FOBDROP Discord bot. To know who is staff, keep your Discord name and avatar current and give members their Airdrop role, FOBDROP’s own bot reads your roles in the FOBDROP Discord server, if you’re in it. Your Airdrop perks on fobdrop.com follow a paid membership or the Airdrop role there: holding the role turns them on, losing it turns them off, and paying members get the role automatically. Staff can give or take that role. The bot reads nothing else: no messages and no other servers.
- Discord. Signing in happens on Discord’s own site. Discord tells FOBDROP only your public profile (its
identifypermission, which doesn’t include your email address), and your avatar image loads from Discord’s servers. If you press Link socials, Discord asks you once for itsconnectionspermission and tells FOBDROP which accounts you’ve connected to it; FOBDROP keeps only the verified Twitch, YouTube, TikTok, X and Reddit ones and drops the rest unread. Discord’s privacy policy applies there, and to the FOBDROP Discord. - Anyone who opens your profile sees what it shows (see What we collect).
- Valve (Steam). Only if you link Steam: you sign in on Steam’s own site, and your Steam avatar and public Steam statistics load from Steam’s services. Steam’s privacy policy applies there.
- WARDOGS’ Pragma service. Only if you connect Steam and WARDOGS: Pragma validates the fresh Steam ownership proof once and supplies the game session FOBDROP uses to read your own verified progression.
- Amazon Web Services (ping check). When Nearby — lowest ping is selected in the server finder, or you press Check my ping, your browser sends a few tiny requests to Amazon Web Services data centers in each server region and times them, to estimate your ping. Amazon receives an ordinary web request from your device, including your IP address. FOBDROP receives nothing; the estimates stay in your browser’s localStorage for 30 minutes.
- Authorities, when the law requires it, or to protect the rights, property or safety of players, FOBDROP or others.
- A successor, if FOBDROP is ever transferred to someone who keeps it running. This policy would keep protecting your data, and we’d tell you first.
We don’t sell personal data, and we don’t share it for cross-context behavioral advertising, as California law defines those terms.
International transfers
The short version
FOBDROP runs on US-based services, so your data may be processed outside your country, with legal safeguards in place.
Cloudflare and Stripe are based in the United States and process data around the world. When personal data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, the transfer is protected by the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent safeguard, such as the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for a copy of the relevant safeguards.
How long we keep it
The short version
Only as long as we need it. Delete your account and your data goes, except the payment records the law makes us keep.
| Data | How long |
|---|---|
| Anonymous usage counts | Kept as aggregate statistics. They don’t identify anyone. |
| Cloudflare security logs | A short period, under Cloudflare’s policies. FOBDROP doesn’t copy IP addresses into its own database. |
| Preferences in your browser | Until you clear them. |
| Account: Discord ID, Discord username, name and avatar, FOBDROP username, dates | Until you delete your account. Your Discord name and avatar refresh each time you sign in. |
| Staff log (which staff member did what to which account, and why) | 2 years, for accountability. It keeps the username at the time, even after the account is deleted. |
| Steam link: SteamID, persona name, avatar | Until you unlink Steam or delete your account. |
| WARDOGS connection: encrypted session, verified levels, private class XP, season, cash and gold-bar balances, and check times | Until you disconnect WARDOGS, unlink or change Steam, or delete your account. |
| Sign-in sessions | Until you sign out, or 30 days after your last visit. |
| Public profile and verified socials | Until you change or remove them, or delete your account. |
| Steam lookups of other players | Not stored. Cloudflare’s cache keeps each answer up to 5 minutes. |
| Saved setups | Until you delete them or your account. |
| Membership and payment records | While you’re a member, then as long as tax and accounting law requires, usually 6 to 10 years depending on the country. After account deletion, applicable payment records and the staff audit records described above may remain for their stated purposes. |
| Backups | Deleted data leaves our backups within 30 days. |
Your rights
The short version
You can see, export, correct or delete your data, and object to how we use it. Ask, and we’ll answer within a month.
Wherever you live, you can:
- See and export your account data and saved setups, in a portable format.
- Correct it. Your Discord name and avatar update when you next sign in. Edit your profile any time on your account page. Username changes are free for every account, with seven days between changes; your first pick does not use up a change. We’ll also change one that’s wrong or breaks the rules if you ask.
- Delete your account and everything tied to it, except the records the law makes us keep.
- Unlink Steam at any time, and its details go with it.
In the EEA and the UK, under the GDPR and UK GDPR, you also have the right to restrict how we use your data, to data portability, to withdraw consent at any time where we rely on it, and to complain to a supervisory authority, such as the data protection authority where you live or work, or the Information Commissioner’s Office (ICO) in the UK. We’d appreciate the chance to put things right first.
In California and other US states with privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon), you have the right to know what personal data we collect, use and disclose; to access and get a copy of it; to correct it; to delete it; and to opt out of its sale, its sharing for cross-context behavioral advertising, and targeted advertising. FOBDROP does none of those three, so there’s nothing to opt out of, and we honor Global Privacy Control signals all the same. We won’t treat you differently for using your rights. You can use an authorized agent, and if we turn down a request, you can appeal by replying to our answer.
How to ask. Use the export and delete options on your account page, or email legal@fobdrop.com. To confirm the account is yours, we may ask you to sign in with Discord. Requests are free, and we answer within one month. If a request is complex, we may need up to two more months, and we’ll tell you why.
Security
The short version
We collect little, encrypt everything in transit and keep secrets out of our code.
- All traffic uses HTTPS.
- Sign-in uses Discord’s OAuth 2.0 with PKCE. Steam/game connections use one fresh Steam OpenID proof validated by WARDOGS’ Pragma service, with a one-use callback bound to your signed-in session. FOBDROP never receives your Discord or Steam password. Discord OAuth access tokens are used temporarily to read the approved fields and are not retained in our database; FOBDROP attempts to revoke them afterward. Steam assertions are processed for the connection and are not retained. The separately encrypted game session cannot be used to sign in to your Discord or Steam account.
- Session cookies are HttpOnly, Secure and signed, and FOBDROP’s database keeps only a one-way hash of each session id. Every account change must come from fobdrop.com itself and carry a token tied to your session.
- A Content Security Policy restricts which sources can provide scripts and other resources.
- Payment-provider and sign-in keys are stored as encrypted Cloudflare secrets, never in FOBDROP’s code.
- The owner administers the service. Authorized FOBDROP staff can access selected account information through the staff console within their permissions, as described above. Staff actions are logged.
- Card details never touch fobdrop.
No system is perfectly secure. If a breach affects your personal data, we’ll tell you and the relevant authorities as the law requires. To report a security issue, see Report a problem.
Children
The short version
You must be 13 or older to sign in. We don’t knowingly collect data from younger children.
Anyone can browse FOBDROP without an account. Hosting and security providers still process connection and request details to deliver and protect the site. To sign in, you must be at least 13, the same as Discord and Steam. Where the age of digital consent is higher (up to 16 in parts of the EU), a parent or guardian’s consent is needed until you reach it.
FOBDROP is not directed at children under 13. If we learn that we hold personal data from a child under 13, or from a younger teen without the consent the law requires, we’ll delete it. Parents and guardians can contact us at legal@fobdrop.com.
Changes to this policy
The short version
If we change how we use your data in a way that matters, we’ll tell you before it happens.
We’ll update this policy as FOBDROP changes, and each change updates the date at the top. For a change that matters, we’ll give notice on the site and the FOBDROP Discord at least 30 days before it applies, and ask for your consent first where the law requires it.
Contact
The short version
Questions about your data? Ask us.
- Controller: FOBDROP
- Email: legal@fobdrop.com
- Discord: discord.gg/MRGYwnQyMQ, for general questions. Please don’t post personal data in public channels.
Server community profiles
If you claim a community server, we keep its join code, your account and linked Steam identity, verification time and the public profile details you choose: a shareable server name, short description and optional banner. Temporary verification challenges expire after30 minutes and are bound to your session and server. Public profiles identify verified server control, not an endorsement or a guarantee of player experience. Deleting your account removes your claims and challenges. Server preferences and claims are included in your account data export.
Custom server banners load only from supported public image CDNs such as Discord, Steam and Imgur. Those services receive the normal image request from your browser, including its IP address; the request sends no FOBDROP session or game credentials and no referring-page URL.