Privacy policy

Sentinel is run by Sentinel (“we”, “us”). We are the controller for the personal data described in this policy.

For anything about your data, email sentinelpriv@outlook.com or open a support ticket on our Discord server.

Tournament organizers choose to use Sentinel in their tournaments, and they can see and export their players’ data. What an organizer does with that data themselves, such as deciding to disqualify a player or keeping an exported copy, is their responsibility.

When you register and use a sentinelpriv.com account, we store:

• the username and password you choose. The password is stored only as a bcrypt hash, never as the password itself.
• your role, your license expiry date, and records of the license keys you bought, redeemed, were given or created. Together with your username, a license key from your account lets you reset your password. If you registered with an invite key before we stopped using them, we still store it, and it works the same way.
• the enterprise you belong to, if any, and that enterprise’s audit log of actions such as adding members or redeeming licenses.
• your Discord user ID, if you link your Discord account.
• your account status: whether your access has been revoked, the reason, and a history of such actions.

We don’t ask for your name, email address or any other contact details.

We use this data to provide your account and license (Art. 6(1)(b) GDPR). You can’t have an account without a username and password.

Payments

Licenses are paid for through Stripe. We send Stripe your username and the length of the license, so the payment can be matched to your account. Stripe collects your payment details and email address on its own checkout page, and we never see your card details. Afterwards we store the license together with the username that bought it (Art. 6(1)(b) GDPR). Stripe handles payment data under its own privacy policy.

Licenses are personal, and our Terms of service don’t allow account sharing. To enforce that:

• An account can only be signed in in one place at a time. Signing in signs out every other session.
• Signing in sets a cookie with a random ID for your browser. We store a hash of it with your account, for up to your 10 most recent browsers. If your account has a verified email and you sign in from a browser it has not used before, we email you a code to enter.
• We record the IP address of each sign-in, with the time and browser ID. This history is deleted after 30 days.
• If an account signs in from 4 or more different browsers within 24 hours, we flag it for review. We then send the IP address to ip-api.com (Artia International S.R.L., Romania) to look up its approximate location: country, region, city, internet provider, network (AS number), and whether the address belongs to a proxy or hosting service. A person reviews the flag. Nothing is revoked automatically.

Staff with the Director role can see these addresses and locations, including in a private view in our Discord server when an account is flagged. Director accounts and accounts we have whitelisted are exempt from these checks.

We also use IP addresses to limit repeated requests, such as too many sign-in, registration or password reset attempts, or too many failed attempts to open a tournament or player page. These counters are deleted after at most 15 minutes.

Legal basis: our legitimate interest in enforcing license terms and protecting accounts and the service (Art. 6(1)(f) GDPR).

Sentinel R6 is the Windows program a tournament organizer can ask you to run while you play. You don’t need a Sentinel account to use it. It doesn’t install anything, it stops completely when you close it, and it only connects to sentinelpriv.com, over HTTPS.

Before you connect

• It checks on your PC whether Secure Boot, a TPM, Virtualization-Based Security and Kernel DMA Protection are turned on. It won’t start monitoring without Secure Boot and a TPM.
• If your PC has a Rainbow Six Siege profile folder (Documents\My Games\Rainbow Six - Siege), it reads the Ubisoft profile ID from the folder’s name and sends it to our server. Our server asks Ubisoft for the matching username, through the ScraperAPI proxy service, and fills it in as your player name. We keep the ID and username together in a lookup cache so the same ID resolves faster next time, and refresh the entry after 7 days.

When you connect

It sends your player name and the tournament PIN. Your organizer can then see that you’re connected, and a notice with your player name, team and tournament is posted to a private staff channel on our Discord server.

While monitoring is on

Monitoring starts when you press Start monitoring and ends when you press Stop and save session or close Sentinel R6. During that time it collects:

• Screenshots of your entire screen, across all monitors: one when monitoring starts, then one at a random moment in every minute, and one each time you press Print Screen. Everything visible at that moment is captured, so close or hide anything private, such as messages, email or notifications, before you start.
• Hardware identifiers: a hardware ID calculated from your motherboard’s firmware data and your network adapter’s MAC address, plus the firmware identifier and MAC address themselves.
• Devices: the name and vendor and product ID of every connected mouse, keyboard, controller and other input device. PCI devices and storage drives are reported only if they match known cheat hardware or look spoofed. Drive serial numbers are checked on your PC but never sent.
• System details: installed antivirus products and whether they’re active, your CPU clock speed, your display refresh rate and any change to it, the security settings listed above, whether Sentinel R6 is running in a virtual machine or under a debugger, whether Windows event logs or program usage records have recently been cleared or turned off, and fingerprints (SHA-256 hashes) of Sentinel R6 itself and of certain games while they run.
• Programs and files: it checks the programs running on your PC and may report their names. It also looks through Windows’ records of recently run programs (Prefetch, BAM, Amcache, SRUM and ShimCache), and for program files created in the last 7 days in your Downloads, Desktop and temporary folders and in ProgramData and Windows\Temp. It reports the full path of programs that aren’t digitally signed and are running, or ran or appeared in the last 7 days. These paths usually include your Windows user name. It also reports known cheat drivers installed in the last 24 hours, network ports used by cheat hardware if they’re open, whether Logitech G HUB or Razer Synapse is installed, and the path and time of any Logitech G HUB script changed that day. Program files are examined on your PC, and their contents are never uploaded.
• Input: it watches the timing of key presses, mouse clicks, mouse movement and controller thumbstick movement across your whole system, to detect macros, auto-clickers, aimbots and emulated input. The timing is analyzed in memory. Sentinel R6 doesn’t save or send which keys you press or what you type. It sends only what it detects, for example “auto-clicker detected” with the timing it measured, and a note each time you press Print Screen.

Most checks run on your PC, and only their results are sent. We don’t upload file contents or your keystrokes. The results go to our server as an event log, about once a second while there’s something new. Each entry has your PC’s local time, a category and a severity, and is sent with your player name and tournament PIN.

On your PC

When you stop monitoring or close Sentinel R6, it saves the session’s event log (without screenshots) as a ZIP file named after the date, in the same folder as the program. The file isn’t encrypted or uploaded, and you can delete it at any time.

If your copy is out of date when you connect, it downloads the latest version from sentinelpriv.com and restarts.

Who sees it

• The organizer of your tournament and their team see your player name, team, connection status, full event log and screenshots in the Sentinel dashboard. After the tournament they can export all of it as a ZIP file.
• Anyone the organizer shares the tournament’s spectator link with can see the same without signing in.
• Our staff.
• When a finding is severe, an alert with your player name, team PIN and the finding is posted to a private staff channel on our Discord server.

Why, and your right to object

We process this data for our and the tournament organizer’s legitimate interest in fair competition: detecting cheat software and hardware, and giving organizers the evidence to act on it (Art. 6(1)(f) GDPR). Sentinel R6 doesn’t decide anything about you by itself; see section 11.

You can object to this processing at any time (Art. 21 GDPR), and you can stop monitoring whenever you like. Organizers can make Sentinel R6 a condition of entry, so objecting or stopping may mean you can’t take part in that tournament.

We don’t intend to collect sensitive information such as health or religious data, but a screenshot captures whatever is on your screens at the time.

Sentinel FiveM is for FiveM servers. A server owner adds their server on our website and installs our resource on it, which connects the server to sentinelpriv.com over HTTPS.

If you run a server

We store the name you give the server and a one-way hash of its key; the key itself is shown to you once and not kept. Every 30 seconds the resource sends us the server’s hostname, how many players are connected, its player limit and the resource version. That report contains nothing about individual players.

If you type /identify in game

The server you’re playing on sends us your in-game name, the identifiers FiveM gave it for you (your Rockstar license and, where you have them, your Steam, Discord, Cfx.re, Xbox Live and Microsoft account IDs) and your FiveM player tokens, which are identifiers FiveM derives from your PC’s hardware. Your IP address is not included. We hold these with a 6-character PIN for 5 minutes, and the server shows the PIN only to you. If you don’t use the PIN, they are deleted and nothing is saved to any account.

If you enter the PIN on our website

• Those identifiers and tokens, your in-game name and the server that issued the PIN are saved to the Sentinel account you’re signed in to. A game account can be linked to one Sentinel account at a time.
• The tokens are kept so that Sentinel can recognise the same PC across game accounts when servers check for ban evasion.
• To stop PINs being guessed, we count incorrect entries per account and per IP address for 15 minutes.

Who can see it

• You, on the link page. It shows your identifiers and how many tokens we hold, not the tokens themselves.
• Our directors and management staff, who can look up a link and remove it, for example when someone has lost the account their game account was linked to. Each removal is recorded with the staff member’s name and reason.
• Server owners can’t see your linked identifiers through Sentinel.

Why, and your choices

Linking is voluntary. We process this data for our and server owners’ legitimate interest in confirming that a player is who their Sentinel account says they are (Art. 6(1)(f) GDPR). You can unlink at any time from the link page, which deletes the identifiers and tokens, and you can object to this processing (Art. 21 GDPR). A server that requires Sentinel may not let you play without a linked account.

If you join the Sentinel Discord server, Discord processes your data under its own privacy policy. On top of that, our bot and staff process the following:

• Account linking: when you run /link with the code from your account page, we store your Discord user ID with your Sentinel account and give you roles to match it. If your access is revoked, the roles and the link are removed.
• Verification: reacting to the verification message gives you the verified role. We don’t store the reaction.
• Tickets: a support or purchase ticket is a private channel, named after your Discord username, that only you and our staff can see. When the ticket is closed, the channel and its messages are deleted. We don’t keep transcripts.
• Giveaways: entering stores your Discord user ID with the giveaway. Winners are drawn at random, announced in the server and sent their prize by direct message.
• Account lookups: staff can look up a linked member’s Sentinel username, role, status, license time, and any past sanctions. The result is shown in the channel where the command is used.
• Staff notifications: the website and bot post operational messages to private staff channels. These include license keys being created or used (with the username and key), purchases, account revocations and deletions, and tournament events.

Legal basis: providing your account and the services you ask for (Art. 6(1)(b) GDPR), and our legitimate interest in running our community and service securely (Art. 6(1)(f) GDPR).

We don’t use analytics, advertising or tracking cookies. Fonts are served from our own server. The site stores three things in your browser, all needed for features you use:

• sentinel_session (cookie) keeps you signed in. It lasts 24 hours, or 30 days if you tick “Remember me for 30 days”. Scripts on the page can’t read it, and it isn’t sent with requests from other websites.
• sentinel_device (cookie) is a random ID for your browser, used for the sign-in checks in section 3. It lasts 400 days and scripts on the page can’t read it.
• sentinel_live_tournaments (local storage) is where the tournament dashboard keeps your tournament list, including team names, PINs and player names, so it survives a reload. It stays until you clear your browser data.

Our home page and download page include videos from YouTube, embedded in YouTube’s privacy-enhanced mode (youtube-nocookie.com). The player loads with the page, so YouTube, which is run by Google, receives your IP address and information about your browser, and may store information in your browser. See Google’s privacy policy. Legal basis: our legitimate interest in showing how Sentinel works (Art. 6(1)(f) GDPR).

Our Cookie policy lists everything stored in your browser in one place.

The checkout pages are run by Stripe on its own website and use Stripe’s cookies. You don’t need an account to download Sentinel R6, and the website doesn’t record who downloads it.

• Tournament organizers and spectators, as described in section 4.
• Our staff, according to their role. Directors can see all account data, including sign-in IP addresses and locations.
• Services we use:
  • Stripe, for payments
  • Discord, for our community server, tickets and staff notifications
  • ip-api.com (Artia International S.R.L., Romania), for IP location lookups at sign-in. It keeps its request logs for up to 24 hours.
  • Ubisoft, to look up the username for a Rainbow Six Siege profile ID
  • ScraperAPI (United States), which relays those Ubisoft lookups and so sees the profile ID and the username returned
  • YouTube (Google), when you visit a page with an embedded video
• Authorities or courts, where the law requires it or we need to establish or defend legal claims.

We don’t sell personal data.

Stripe, Discord, Google and ScraperAPI are based in the United States, so data they process may be transferred there. These transfers rely on the EU-US Data Privacy Framework, which the European Commission recognized as providing adequate protection on 10 July 2023, and on the European Commission’s Standard Contractual Clauses. Contact us if you would like more detail.

• Account data: while your account exists. Customer accounts are deleted automatically 7 days after their Rainbow Six Siege license expires, together with the license key records they used, unless the account still has a license for another game, a linked FiveM game account or a FiveM server. An account that never had a license is kept until you ask us to delete it. You can ask us to delete your account at any time.
• Sign-in IP address and location: your first and most recent sign-in address are kept while your account exists. The sign-in history (address, time and browser ID) is kept for 30 days. The address and location from a flag stay with your account, and in its sanction history if your access was revoked.
• Sign-in session: 24 hours, or 30 days if you chose to be remembered.
• Password reset links: 15 minutes.
• Request-limiting counters (IP address, username, account, Rockstar license ID, or tournament PIN and player name): up to 15 minutes.
• License key records, and enterprise audit logs: kept as a record of who bought, received and used each key. There is no fixed deletion date.
• Tournament event logs and screenshots: deleted from our server 7 days after the last upload for that player. Organizers can delete a tournament and its data sooner.
• Tournament records (name, teams, PINs and player names): deleted automatically once a tournament has been ended for 7 days. Tournaments that are never ended stay until they are deleted.
• Messages in our staff Discord channels, including alerts about severe tournament findings: not deleted automatically.
• Ubisoft profile lookup cache (profile ID and username): kept, and refreshed with Ubisoft’s current username after 7 days. There is no fixed deletion date.
• Tournament exports: kept by the organizer who downloaded them.
• FiveM link PINs, with the identifiers and tokens sent for them: 5 minutes, or until the PIN is used.
• Linked FiveM game account (identifiers, player tokens and in-game name): until you unlink it or your Sentinel account is deleted.
• FiveM server records (name, key hash, hostname and player counts): while the owner’s account exists.
• FiveM server slot subscriptions (your account, the monthly amount, the Stripe customer and subscription references, and the billing dates): kept as a record of the subscription. There is no fixed deletion date.
• The record of staff removing a FiveM link: kept, with no fixed deletion date.
• The session ZIP file on your PC: until you delete it.
• Discord: giveaway entries are kept, and ticket channels until the ticket is closed.
• Server error logs, which can contain usernames or Discord user IDs: until the server rotates them out.

Account sharing. The checks described in section 3 never revoke an account on their own. A flagged account is reviewed by a person first. If your access is revoked, you can explain your side and contest the decision. Open a ticket on our Discord server or email sentinelpriv@outlook.com, and a Director will review it and can restore your access.

License expiry. In line with our Terms of service, access to the dashboard ends automatically when your license expires. You can still sign in to buy or redeem a new one.

Tournament findings. Sentinel R6 gives each finding a severity, and a player with a severe finding is marked “flagged” on the organizer’s dashboard. Sentinel doesn’t disqualify, kick or ban anyone. The tournament organizer decides what to do.

Under the GDPR, you have the right to:

• get a copy of the personal data we hold about you (Art. 15)
• have it corrected (Art. 16)
• have it deleted (Art. 17)
• have its use restricted (Art. 18)
• receive the data you gave us in a machine-readable format (Art. 20)
• object to processing based on our legitimate interests, including the sign-in checks and tournament monitoring (Art. 21)
• have an automated decision reviewed by a person (Art. 22)

To use any of them, email sentinelpriv@outlook.com or open a ticket on our Discord server. The website has no self-service option for this. We reply within one month. We may first ask you to show that the data is yours, for example by signing in or answering questions only the account holder could.

If you’re a tournament player without an account, include your player name, the tournament name or PIN, and roughly when you played. For data an organizer has exported, contact the organizer as well.

You can also complain to a data protection authority, in particular in the EU country where you live or work, or where you think your rights were infringed.

• Connections to sentinelpriv.com, including from Sentinel R6, use HTTPS.
• Passwords are stored as bcrypt hashes.
• The sign-in cookie can’t be read by scripts and isn’t sent with requests from other websites.
• Staff access to personal data depends on their role.

Tournament players can be under 18. Sentinel R6 handles every player’s data the same way. A parent or guardian can use the rights in section 12 on their child’s behalf.

When this policy changes, we will update this page and the date below. If a change significantly affects how we use your data, we will also announce it on our Discord server.