The current policy for the SCCORE website, account area and related interfaces.
Policy on the processing of SCCORE users’ personal data
Version date: 27.09.2026
Published at: https://sccore.ru/privacy
This Policy on the processing of SCCORE users’ personal data sets out the procedures for processing and protecting the personal data of users of https://sccore.ru, the account area and other related SCCORE interfaces.
SCCORE is an independent analytics service for users of STALZONE (formerly STALCRAFT: X) and is not an official EXBO product. References to the game, EXBO, in-game items, the auction, game characters and other game data are used solely to describe the service’s features.
1. Personal data controller
1.1. The personal data controller is:
Mikhnenko Egor Mikhailovich
Taxpayer identification number: 507460962853
Status: an individual applying the special Professional Income Tax regime
Email for personal data inquiries: veonard0@yandex.ru
Support email: veonard0@yandex.ru
Website: https://sccore.ru
1.2. The Controller independently determines the purposes of personal data processing, the categories of personal data processed and the operations performed on those data.
1.3. Users may send personal data processing inquiries to the email address specified in this Policy.
2. Key definitions
2.1. Personal data means any information relating directly or indirectly to an identified or identifiable individual.
2.2. Personal data processing means any operation or set of operations involving personal data, including collection, recording, organization, accumulation, storage, clarification, use, transfer, blocking, deletion and destruction.
2.3. User means an individual using the website, account area or SCCORE features.
2.4. SCCORE Service means the website, account area, API, analytics modules, paid and free features related to analyzing game data, the auction, items, builds, reputation, crafting, progression and other mechanics of STALZONE.
3. Personal data processed
3.1. The Controller may process the following user data:
username;
display name, whether identical to the username or specified separately;
internal SCCORE user identifier;
password as a hash, without storing the password in plain text;
user role;
information about the user’s plan;
access period;
subscription or access status;
information about promo codes used;
information about account suspension, if applicable;
account creation date;
last sign-in date;
technical authentication and session data;
data about user actions within the service needed for its features, analytics, limits and abuse prevention.
3.2. When paid access is purchased, the Controller may process:
internal user identifier;
selected plan;
payment amount;
payment currency;
payment status;
payment identifier in the payment system;
payment creation date and time;
successful payment date and time;
paid access expiry date;
information needed to record payments and issue receipts;
refund information, if a refund was made.
3.3. Users may provide an email address, telephone number or other contact details for issuing and delivering a receipt where necessary for the Controller to fulfill obligations as a Professional Income Tax payer.
3.4. The Controller may process technical data:
IP address;
user-agent;
cookies;
session ID;
request URLs;
request dates and times;
server response codes;
error information;
information about use of service features;
information about limits and protective mechanisms being triggered;
technical security logs.
3.5. When users contact support, the Controller may process:
the user’s email address;
username or another user identifier;
request contents;
screenshots, files and other materials attached by the user;
information needed to resolve the request.
3.6. The Controller does not process special categories of personal data, including racial or ethnic origin, political views, religious or philosophical beliefs, health, intimate life, or biometric personal data.
3.7. The Controller does not request or store users’ bank card details, including the full card number, expiry date, CVC/CVV code or other payment details.
3.8. When Yandex Advertising Network advertisements load, the browser contacts advertising network servers. These requests allow the network to receive the IP address, HTTP headers, browser and device information, and request date and time. Advertising technologies may also process the address of the page visited, cookies and browser identifiers, and information about ad impressions and interactions. In addition to cookies, advertising code may read and write technical information in browser storage, including localStorage. The exact data depend on the advertising technology, browser settings and Yandex terms. These data are not automatically deemed anonymous.
SCCORE does not add usernames, SCCORE account identifiers, passwords, payment information, OAuth tokens, form contents or precise user coordinates to ad-unit request parameters. This restriction on integration parameters does not mean that third-party advertising code does not independently receive technical information.
4. EXBO / STALZONE data
4.1. SCCORE may allow users to voluntarily link an EXBO/STALZONE account using OAuth authentication.
4.2. Linking an EXBO/STALZONE account is not required to register with SCCORE, but may be necessary for certain service features.
4.3. When an EXBO/STALZONE account is linked, the Controller may process:
EXBO account identifier;
in-game nicknames;
character identifiers;
region, server, faction, clan and other game information, if available through the official API;
other data available through the official EXBO/STALZONE API within the permissions granted by the user;
access token and other technical OAuth authentication data where needed for features requested by the user.
4.4. The Controller does not receive, request or store the password to the user’s EXBO/STALZONE account.
4.5. OAuth tokens, where used, are used only to access the EXBO/STALZONE API to provide SCCORE features requested by the user.
4.6. Users may unlink an EXBO/STALZONE account through SCCORE features or EXBO settings. After unlinking, the Controller stops using access tokens unless further retention of certain information is required by law, for service security or to resolve disputes.
4.7. The Controller does not sell or distribute users’ personal data associated with an EXBO/STALZONE account.
5. Purposes of personal data processing
The Controller processes personal data for the following purposes:
5.1. registering users with SCCORE;
5.2. authenticating users and providing access to the account area;
5.3. providing free and paid service features;
5.4. verifying payments and granting, extending, restricting or terminating access to paid features;
5.5. applying promo codes, trial access, beta access and other special terms;
5.6. managing plans, access periods, limits and user permissions;
5.7. fulfilling obligations to users under the user agreement, public offer or other contract;
5.8. issuing and delivering receipts to users where required by Professional Income Tax legislation;
5.9. contacting users about service operation, payment, access recovery, security and support;
5.10. handling support requests;
5.11. protecting the service against unauthorized access, automated attacks, abuse, circumvention of limits, artificial request inflation and other improper conduct;
5.12. maintaining technical logs, diagnosing errors and ensuring service stability and security;
5.13. collecting internal service-feature usage analytics without disclosing those analytics to third parties for advertising purposes;
5.14. fulfilling obligations under the laws of the Russian Federation;
5.15. improving service quality using anonymized or aggregated data.
5.16. collecting visit statistics and studying interface usability using Yandex Metrica and Webvisor only after a separate user choice in the analytics settings dialog.
5.17. displaying and measuring Yandex Advertising Network advertisements, combating invalid impressions and helping fund the service’s free operation. Yandex Advertising Network operates separately from SCCORE’s internal analytics and Yandex Metrica and Webvisor settings.
6. Legal grounds for processing
6.1. The Controller processes personal data on the following legal grounds:
the user’s consent to personal data processing;
processing necessary to enter into and perform a contract with the user;
compliance with obligations imposed by the laws of the Russian Federation;
protection of the Controller’s rights and legitimate interests, including service security, abuse prevention and defense against attacks;
other grounds provided for by the laws of the Russian Federation.
6.2. Users may withdraw their consent to personal data processing where processing is based on consent.
6.3. Withdrawal does not affect the lawfulness of processing performed before withdrawal and does not prevent further processing where the Controller has another lawful basis.
6.4. For the processing of technical data necessary to operate and measure advertising, the Controller considers the basis provided in point 7 of part 1 of Article 6 of Federal Law No. 152-FZ: exercising the rights and legitimate interests of the Controller or third parties, provided that the user’s rights and freedoms are not infringed. This basis applies only to the extent necessary and proportionate; it does not automatically authorize any profiling, data combination or additional advertising purposes. Where processing requires consent or another independent basis, that basis must be established separately.
6.5. Visiting a public page, displaying an advertisement or reading this Policy does not constitute consent to personal data processing. This Policy provides information about processing but does not replace the basis required by law.
6.6. The Controller’s interest in displaying advertisements is to fund SCCORE’s free operation, servers, game-data storage and Service support. When assessing the applicability of point 7 of part 1 of Article 6 of Federal Law No. 152-FZ, the necessity of specific data, processing scope and impact on user rights are considered. Service expenses alone do not justify every advertising-network operation. SCCORE does not include usernames, email addresses, account identifiers, payment information, form contents or precise geolocation in advertising-call parameters. The SDK may nevertheless independently receive the technical information described in clause 3.8.
6.7. The existing cookie settings dialog offers independent Metrica and Webvisor settings and separate voluntary consent to Yandex Advertising Network’s advertising-related processing: https://sccore.ru/advertising-data-consent. Viewing a page or allowing analytics does not constitute consent to advertising-related processing or acceptance of the User Agreement. Acceptance of the agreement when creating an account is recorded separately. Advertising consent is confirmed by a separate checkbox and the “Save choices” button; the checkbox is initially off.
7. Data processing during payment
7.1. Paid access to SCCORE features is purchased through YooKassa or another payment service specified on the website.
7.2. Users may be redirected to the payment service’s payment form.
7.3. The Controller does not receive or store users’ bank card details. Payment details are entered and processed by the payment service.
7.4. To confirm payment and grant access, the Controller may receive and retain payment metadata, including:
payment identifier;
order identifier;
payment amount and currency;
payment status;
transaction date and time;
selected plan;
access period granted;
refund information, if applicable;
technical notification data from the payment service.
7.5. Access to a paid feature is granted after the Controller receives confirmation of successful payment from the payment service or otherwise verifies payment.
7.6. As an individual applying the special Professional Income Tax regime, the Controller issues receipts in accordance with the laws of the Russian Federation.
7.7. To deliver a receipt, the Controller may use email, telephone, a QR code, a receipt link or another method permitted by applicable law and available to the Controller.
8. Cookies and technical data
8.1. SCCORE uses essential cookies and similar technologies for:
user authentication;
maintaining user sessions;
navigation between website sections and tabs;
retaining user preferences;
protection against CSRF attacks and other security threats;
error diagnosis;
preventing abuse and automated attacks.
8.2. SCCORE’s internal analytics process the normalized page path without query parameters or fragments, event type, module, success status, and anonymized timing and load metrics. Passwords, usernames, field contents, user text, full build compositions and links containing access tokens are not included.
8.3. Yandex Metrica and Webvisor are enabled together only after separate informed consent and a successful server-side record. Until then, the counter code does not load, including the technical viewing iframe. This consent does not control SCCORE’s internal analytics and is not advertising consent.
8.4. Consent is given through the “Allow analytics” button in a small floating notice. Separate document: https://sccore.ru/analytics-data-consent. The notice does not block the website or intercept actions. Consent can be withdrawn through “Analytics settings” in the footer or profile. An earlier refusal is retained; permission for Metrica alone does not constitute permission for Webvisor.
8.5. When Webvisor is enabled, input fields, registration, sign-in, account, payment and account-deletion forms, and administrative data are masked. SCCORE does not send internal account identifiers, usernames, form contents, query parameters or share tokens to Metrica goals.
8.6. The choice is recorded using a random browser-preference ID, document version, permissions and server time; when authenticated, the user ID is also recorded. IP address and User-Agent are not added to this record. New analytics are not enabled without server confirmation. Upon withdrawal, collection stops immediately even if the server fails; recording the withdrawal can be retried.
8.7. Users may restrict or disable essential cookies in their browser. Authentication, saved data and certain SCCORE features may then function incorrectly or become unavailable.
8.8. The Controller does not disclose internal analytics data to third parties for advertising purposes.
8.9. Yandex Advertising Network is disabled by default through a configuration flag. Advertising SDKs, requests and units are absent; advertising consent is not requested in the main interface. The code and separate document at https://sccore.ru/advertising-data-consent are retained. If enabled in the future, advertising may be displayed only after separate advertising permission, on eligible public pages, on wide desktop screens and without a paid plan. The advertising SDK does not load before consent. Refusal does not restrict SCCORE features.
8.10. Metrica and Webvisor settings do not control Yandex Advertising Network units. If the flag is enabled, a separate choice is made on the advertising-consent page and retained for no more than one year. Withdrawal is available on that page. An already-loaded advertising SDK is stopped by reloading the page. Advertising cookies are not needed to sign in. For previously transferred data, users may contact Yandex; https://yandex.ru/tune/adv controls personalization but does not prohibit every advertising request.
8.10.1. Advertising-decision history (random browser-preference identifier, separate-consent version, decision, confirmation method, server time and account ID during an active session) is retained on SCCORE’s server for managing withdrawals and demonstrating lawful processing for up to three years, with deletion during record maintenance. These data are not included in Yandex Advertising Network parameters. A new permission takes effect only after a successful server-side record; refusal applies even when the server is temporarily unavailable.
8.11. Processing by Yandex advertising technologies, including possible personalization and disclosure to its partners, is described in Yandex documents: https://yandex.ru/legal/confidential/ and https://yandex.ru/legal/cookies_policy/. Transfer and subsequent processing require the grounds described in section 6; a reference to these documents alone does not establish such grounds.
9. Personal data processing procedures and conditions
9.1. Personal data are processed using automated means, and without them where necessary for support, legal recordkeeping, tax accounting or fulfillment of the Controller’s obligations.
9.2. The Controller processes personal data lawfully and fairly.
9.3. The Controller limits processing to specific, predetermined and lawful purposes.
9.4. The Controller does not permit processing incompatible with the stated purposes.
9.5. The Controller does not collect personal data “just in case” and seeks to limit the data to what is necessary for SCCORE operation, security, payment, support and legal compliance.
9.6. The Controller does not sell users’ personal data to third parties.
10. Disclosure of personal data to third parties
10.1. The Controller may disclose personal data to third parties only where necessary for service operation, performance of the user contract, legal compliance or protection of the Controller’s rights and legitimate interests.
10.2. Such third parties may include:
hosting providers and data centers, including Timeweb;
payment services, including YooKassa;
YANDEX LLC, where the user has separately allowed Yandex Metrica and Webvisor, and when Yandex Advertising Network technologies operate under sections 3, 6 and 8;
email services used to receive user requests;
infrastructure protection services, including Cloudflare, if connected;
persons providing technical, legal or accounting support to the Controller;
public authorities in the cases provided for by the laws of the Russian Federation.
10.3. The Controller may provide links to external SCCORE communities on Telegram, VK, Discord and other services. Users follow such links voluntarily. Processing on external platforms is governed by those services’ rules.
10.4. When disclosing personal data to third parties, the Controller takes reasonable steps to limit the amount disclosed and ensure its protection.
10.5. Where a third party is entrusted with processing personal data, it must maintain confidentiality and ensure data security.
10.6. For Yandex Advertising Network, SCCORE and Yandex act as independent personal data controllers rather than as a principal and a processor acting on instructions. Disclosure and subsequent processing by Yandex, its affiliates and partners are governed by legislation and the Yandex Advertising Network agreement: https://yandex.ru/legal/yan_dpa_ch_ru/ru/. Users may contact the Controller about data transmitted through the SCCORE integration; inquiries about processing by Yandex may also be sent to Yandex using the channels in its privacy policy.
11. Data storage location and cross-border transfers
11.1. SCCORE’s main user database containing users’ personal data is located in the Russian Federation.
11.2. The backend handling authentication, payment and user data processing is located in the Russian Federation.
11.3. Users’ personal data, including email addresses, usernames, payment information, OAuth tokens and technical logs containing personal data, are not transferred to the overseas monitoring server.
11.4. The overseas monitoring server may be used only to process anonymized technical metrics that do not directly or indirectly identify a particular user.
11.5. If service operation requires cross-border personal data transfers in the future, the Controller undertakes to comply with Russian law and update this Policy where necessary.
11.6. Foreign technical services that may access users’ personal data may be used only on a lawful basis and subject to the laws of the Russian Federation.
11.7. Main account data are first recorded in SCCORE databases in the Russian Federation. SCCORE external analytics events are transmitted to Yandex Metrica only after separate user permission and within the settings described in section 8. Browser requests to Yandex Advertising Network are separate processing, subject to legal requirements, sections 3, 6 and 8 of this Policy and Yandex terms. SCCORE does not claim that every subsequent operation of the advertising network and its partners occurs exclusively in SCCORE’s own database in Russia.
12. Personal data retention periods
12.1. Personal data are retained no longer than needed to achieve processing purposes unless Russian law provides otherwise.
12.2. User accounts and related data are retained while users use the service. A confirmed deletion request starts a 7-day recovery period; the account is then anonymized, private saves are deleted, and public builds remain in the catalog without author information.
12.2.1. A temporary guest profile is deleted after 10 days of inactivity. Every successful use of the existing guest session extends this period.
12.3. Payment information is retained for as long as necessary for payment accounting, dispute resolution and compliance with tax and other mandatory requirements.
12.4. Technical logs are retained for as long as necessary for security, diagnosis, abuse prevention, incident investigation and service protection.
12.4.1. Detailed internal product-analytics records are retained by default for up to 90 days, and aggregated daily metrics for up to 395 days. Technical security-log retention may differ where needed to investigate an incident or comply with the law.
12.5. Support requests are retained for as long as necessary to handle them, resolve potential disputes and improve support quality.
12.5.1. SCCORE does not create a separate visitor advertising-profile database or set retention periods for data held by Yandex Advertising Network. Retention periods for advertising cookies and information processed by Yandex and its partners are determined by their documents and applicable law.
12.6. Once processing purposes have been achieved, personal data are deleted, anonymized or destroyed unless further retention is required by law or to protect the Controller’s rights and legitimate interests.
13. User rights
Users have the right to:
13.1. receive information about the processing of their personal data;
13.2. request clarification of personal data where incomplete, outdated, inaccurate or unlawfully obtained;
13.3. request blocking or destruction of personal data in the cases provided for by Russian law;
13.4. withdraw consent where processing is based on consent;
13.5. unlink an EXBO/STALZONE account where that feature is used and implemented in the service;
13.6. contact the Controller with personal data processing inquiries;
13.7. challenge the Controller’s actions or inaction before the authorized personal data rights protection authority or a court.
14. User inquiry procedures
14.1. Users may send personal data processing inquiries to: veonard0@yandex.ru
14.2. Inquiries should preferably include:
SCCORE username;
email or another contact method where needed for a reply;
the substance of the inquiry;
information linking the inquiry to a specific account.
14.3. The Controller may request additional information necessary to verify the requester’s identity and link the inquiry to a specific account.
14.4. Inquiries are answered within the periods provided for by Russian law.
15. Personal data protection measures
15.1. The Controller takes necessary and reasonable organizational and technical measures to protect personal data, including:
restricting access to personal data;
using accounts with individual access permissions;
storing user passwords only as hashes;
protecting servers and databases against unauthorized access;
using HTTPS;
maintaining security logs;
backing up data where necessary for reliable service operation;
separating user, payment and technical data where reasonable and technically feasible;
restricting access to payment and OAuth data;
deleting or anonymizing data once processing purposes have been achieved.
15.2. The Controller does not disclose technical details of personal data protection to third parties where doing so could reduce service security.
16. Legal capacity and use by minors
16.1. SCCORE’s free reference and calculation features are not subject to a general requirement that users be 18 years old.
16.2. Users assess whether they have the required legal capacity. Where the law requires a legal representative’s involvement, registration, provision of personal data and other legally significant actions require that representative’s consent.
16.3. Payment may be made by users with the required legal capacity or with a legal representative’s consent where required by Russian law.
17. Service notifications
17.1. The Controller may send service notifications concerning SCCORE operation, account security, payment, access periods, account status changes, access recovery and support replies.
17.2. The Controller does not send advertising or marketing messages without a separate lawful basis where Russian law requires one.
17.3. On-site notifications may be displayed in the account area or SCCORE interface.
18. Changes to the Policy
18.1. The Controller may amend this Policy.
18.2. A new version takes effect when published at https://sccore.ru unless the Policy specifies a different date.
18.3. The Controller updates this Policy when the contact email, data categories, processing purposes, third-party services used or other material terms change.
18.4. Users must review the current version of the Policy themselves. For significant changes, the Controller may additionally notify users by available means.
19. Controller contact details
Controller: Mikhnenko Egor Mikhailovich
Taxpayer identification number: 507460962853
Status: an individual applying the special Professional Income Tax regime
Email: veonard0@yandex.ru
Website: https://sccore.ru
