Privacy Policy

Last updated: October 2, 2026

Who controls this data

heliana is run by the operator of Heliana. For any question about this policy, including a request under the GDPR, write tosupport@heliana.gg — it is the single point of contact for any request that the Account page does not cover.

Your admin account

Signing in through Discord stores your Discord id, display name, email, and avatar, plus the OAuth access and refresh tokens heliana needs to keep that sign-in working. No password of yours is ever stored — Discord is the only identity provider.

Sessions and cookies

A session record holds its token, the IP address and user agent it was created from, its expiry, and which organization is active in it. Cookies are limited to what sign-in needs: the session cookie itself and a short-lived cookie that holds Discord OAuth state during sign-in. There is no analytics or advertising cookie, and so no cookie banner.

Data about players on connected servers

When your organization connects a Squad server, heliana reads what that server's log and RCON expose about the players on it: nickname, platform identifiers (Steam, EOS), and the links between identities that follow from those identifiers. A player's IP address is never stored raw — it is kept as an HMAC token plus its country and network (ASN), resolved from a local geo database with no data sent to an outside service. IP tokens age out 730 days after the last time that address was observed; nicknames are kept indefinitely, since moderation needs to recognize a returning player. Server log events, including chat, are kept 180 days; player session records 730 days; match statistics are kept without a time limit. Moderator notes and bans your organization records are kept as long as the organization exists.

Who else sees this data

Errors are reported to Sentry with default personal-data scrubbing on. heliana runs on Fly.io in the Frankfurt (fra) region, sits behind Cloudflare (which also serves this page from Cloudflare Pages), and backs its databases up to Tigris, where each backup is kept for 30 days. Discord is the sign-in provider described above. Paddle is the merchant of record for subscription payments and receives the payment details you give it at checkout. Resend delivers transactional email, such as an invitation to join an organization, and receives the recipient address and the message text. None of this data is sold, and none of it is shared for advertising.

Your rights

You can export your account data and delete your account yourself, from the Account page in the admin console. Any other request, including one under the GDPR, goes tosupport@heliana.gg.

Changes

This policy may change as what heliana collects changes. The date at the top of this page is the last time it did.