Privacy Policy

Last updated: March 6, 2026

Halo Record ("we", "us", or "our") operates the halorecord.com website and the Halo Record Uploader desktop application (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, and your choices regarding that information.

Halo Record is a community-built tool. We are not affiliated with, endorsed by, or connected to Microsoft Corporation, 343 Industries, or Xbox Game Studios. All trademarks belong to their respective owners.

We collect a limited set of publicly available gaming data. We do not collect personal information such as your real name, email address, physical address, or payment information.

Gaming Data

• Xbox Gamertag — Your public Xbox Live display name, used to identify your player profile.
• Xbox User ID (XUID) — A numeric identifier assigned by Xbox Live, used internally to link your data across sessions.
• Service Records — Aggregate gameplay statistics such as total kills, deaths, wins, losses, and time played across Halo MCC titles.
• Match History and Carnage Reports — Per-match data including scores, kills, deaths, assists, medals earned, weapon usage, team assignments, and match outcomes.
• TrueSkill Ratings — Skill rating values (mu, sigma, rating) for each playlist, as provided by the Halo MCC API.
• Medal Data — Specific medals earned per match and lifetime medal counts.

Session Data

• Session Cookies — We use a single session cookie to maintain your login state after Xbox Live authentication. This cookie contains an opaque session identifier and does not store personal information.

Data reaches Halo Record through two channels:

• Web Application — When you or another user searches for a gamertag, the server queries the unofficial Halo MCC API to retrieve service records, TrueSkill ratings, and recent match history. This data is then stored in our database for display and leaderboard calculations.
• Desktop Companion App (Halo Record Uploader) — The desktop application authenticates through Xbox Live using Microsoft's OAuth flow, obtaining Xbox tokens, a PlayFab session, and a Spartan authentication token. It then reads carnage report files generated locally by Halo MCC on your PC and uploads them to our server via an API key tied to your account. The companion app does not access any data outside of Halo MCC carnage reports.

• Display player profiles with gameplay statistics, match history, and medal summaries.
• Calculate and display TrueSkill rating deltas (changes between data refreshes).
• Generate season leaderboards and global rankings.
• Backfill match history beyond the limited window provided by the Halo MCC API.
• Improve the accuracy and completeness of the Service.

All gameplay data is stored in a PostgreSQL database hosted by Supabase, a third-party database platform. Data is transmitted over HTTPS and stored using Supabase's infrastructure security controls.

Session data is managed server-side using signed cookies. Session identifiers are cryptographically random and do not contain gameplay or personal data.

While we take reasonable measures to protect the data we store, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

The Service relies on the following third-party platforms. Each operates under its own privacy policy:

• Xbox Live / Microsoft Account — Authentication and gamertag resolution. (Microsoft Privacy Statement)
• PlayFab (Microsoft) — Token exchange during the companion app authentication flow. (PlayFab Privacy)
• Supabase — Database hosting and storage. (Supabase Privacy Policy)

We do not sell, rent, or share your data with any other third parties.

Halo Record uses a single essential cookie to maintain your authenticated session after signing in via Xbox Live. This cookie is:

• Strictly necessary — It is required for the Service to function and cannot be disabled.
• Session-scoped — It expires when you close your browser or after the server-side session times out.
• First-party only — We do not use third-party tracking cookies, analytics cookies, or advertising cookies.

Gameplay data (service records, match history, carnage reports, medals, and TrueSkill ratings) is retained indefinitely to maintain leaderboard integrity and historical match records.

If you wish to have your data removed from Halo Record, please contact us using the information below. We will delete your player profile, associated match data, and any session records within 30 days of a verified request. Note that removal of your data from our database does not affect data held by Microsoft, Xbox Live, or any other third party.

Halo Record is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. Because we collect only Xbox gamertags and gameplay data (not personal information such as names, emails, or ages), we have limited ability to determine a user's age.

If you believe a child under 13 has provided personal information through our Service, please contact us and we will take steps to delete that information.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or wish to request data deletion, you can reach us at: