Last updated: August 2026
This policy is deliberately specific. Rather than saying "we may collect certain information," it lists the exact fields we read, the exact cookies we set, and the things we genuinely cannot see — so you can verify our claims against what the app actually does.
Mistfall Logs ("we", "us") is an unofficial, fan-made combat log tracker for the game Mistfall Hunter. It is not affiliated with, endorsed by, or sponsored by Bellring Games or Valve.
We use Steam OpenID. When you click sign in, your browser goes to Steam's own website, you authenticate there, and Steam redirects back telling us only that a particular Steam ID successfully logged in.
What we receive and store
That is the complete list. Our server reads it from Steam's public player-summary endpoint once, at sign-in.
What we never see, and could not see
What we cannot do with your account
You stay in control
You can revoke us at any time from your Steam account's connected-applications settings, and delete everything we hold from Settings → Delete Account.
When you upload a .log file, your browser compresses it and sends it over HTTPS to our server, where it is parsed in memory. We extract only the fields below and then discard the file.
Fields we extract and store
What we do not read, even though the file may contain it
Unreal Engine writes a great deal of diagnostic noise into these logs. Our parser only matches a fixed set of game-telemetry patterns; every other line is ignored and never leaves memory. Specifically, we do not extract or store:
C:\Users\…).Worth understanding before you upload
Although we discard it, the file you upload is transmitted to us in full so that it can be parsed. If that concerns you, open the log in a text editor first — it is plain text, and you can see exactly what it contains before sending it.
The raw log is never stored
It exists only for the duration of the request. There is no file storage, no bucket, and no copy retained anywhere — only the extracted fields listed above are written to the database.
Combat logs record everyone present in a match, not just you. If you upload a log, the in-game names and account identifiers of other players in that match are stored as community match records — even if those players never signed in here themselves. This is what makes shared match history and rosters work.
These records are not linked to any account until that player signs in with the matching Steam ID and claims them. If you are in our records and want them removed, contact us using the details below.
We set no advertising cookies, no third-party trackers, and no analytics cookies. The complete list:
Cookies
| Name | Purpose | Lifetime |
|---|---|---|
| next-auth.session-token | Keeps you signed in. Encrypted and HTTP-only, so page scripts cannot read it. | 30 days |
| next-auth.csrf-token | Blocks cross-site request forgery during sign-in. | Session |
| next-auth.callback-url | Remembers which page to return you to after Steam sign-in. | Session |
| mistlog_alpha_pass | Records that you entered the closed-alpha passphrase. | 90 days |
In production these carry Secure and SameSite=Lax flags, and the session and alpha-gate cookies are HttpOnly.
Local storage
Stored on your device only. These are never transmitted to our server.
| Key | Purpose | Lifetime |
|---|---|---|
| mistlog_sidebar_open | Whether you collapsed the sidebar. | Until cleared |
| mistlog_onboarded_<steamId> | Whether you finished first-run setup, so it is not shown again. | Until cleared |
We do not use session storage, fingerprinting, or any similar technique.
| Service | What it does | When |
|---|---|---|
| Valve / Steam | Authentication only. They see that you logged into this site. | At sign-in |
| Supabase | Hosts the PostgreSQL database holding accounts and match records. | Ongoing |
| Netlify | Hosting and CDN. Processes request logs in order to serve the site. | Ongoing |
| Sentry | Error monitoring, so crashes get found and fixed. | On error |
| Discord | Receives feedback you explicitly submit via the feedback button. | On submit |
How our error monitoring is configured
Sentry receives the error itself — the message, the code location, and the page it happened on.
Feedback goes to a private Discord channel
Whatever you type or attach is exactly what we see, so avoid including anything sensitive in a message or screenshot.
Solely to run the service: authenticating you, attributing uploaded matches to your account, computing your stats (K/D, extraction rate, class breakdown, rivals), and displaying community match history. We do not sell your data, share it with advertisers, or use it for profiling or automated decision-making.
Both are self-service from Settings, with no need to email anyone:
Why deletion unlinks rather than erases matches
Matches are shared records containing other real players. Deleting them outright would erase their history too. So we delete your account and unlink your characters and uploads from it — the match records themselves remain as unattributed community data, exactly as if they had never been claimed. If you want those specific records purged as well, contact us.
All traffic is served over HTTPS. Session and alpha-gate cookies are HTTP-only. Uploaded files are size- and type-checked, and every value parsed out of a log is sanitized before it reaches the database. Production credentials are never stored in the codebase.
This is a closed alpha
No service is perfectly secure, and this one is run by a small team. Please do not treat it as a vault for anything sensitive.
Account and match data is retained for as long as your account exists. Deleting your account removes it immediately, subject to the shared-record nuance in section 8. Raw uploaded logs are never retained at all.
This service is not directed at children under 13, and we do not knowingly collect data from them.
We may update this policy as the service changes. Material changes will be reflected by updating the date above.
Questions, data requests, or removal of your records: neuraallabs@protonmail.com.
Most requests don't need an email at all — export and deletion are self-service from Settings. Write to us if you appear in someone else's uploaded match and want those records removed, or for anything this policy doesn't answer.