Privacy policy

Last updated: 5 November 2026 · applies to ftc-embeds.com, its widgets and the avatar maker

• 1 · Who we are
• 2 · What we collect, and why
• 3 · Legal basis
• 4 · Who else is involved
• 5 · How long we keep it
• 6 · Cookies and browser storage
• 7 · Your rights
• 8 · Children and teams
• 9 · Changes
• 10 · Contact

01Who we are

ftc-embeds is a free, open-source project made for the FIRST Tech Challenge community by mmathijs, who runs ftc-embeds.com and its servers and is responsible for the data described here (the "controller" under the GDPR). It is not affiliated with FIRST®.

This policy covers the website ftc-embeds.com, the widgets other websites embed from it (as an iframe, an HTML element or the ftc-embeds npm package), the embeds API those widgets use (ftcscout-api.mmathijs.nl), and the avatar maker at /avatars.

02What we collect, and why

Visiting the website, or a page with a widget

When your browser loads a page, a widget or the library from ftc-embeds.com, or a widget asks the embeds API for a team's or event's data, the servers receive the usual technical details of that request:

• your IP address, the date and time, the address requested, and the response;
• the page you came from (the "referrer"), which for a widget is usually the website it is on;
• your browser and system (the "user agent"), as your browser sends them.

These go into the servers' access logs. We use them to deliver the site, to keep it secure (spotting abuse and attacks) and to fix problems. We don't use them to profile you, and we don't combine them with other data.

Embed statistics

To see which websites use the widgets, we keep a separate log of widget and library loads with only the time, the address requested and the website it was loaded on. IP addresses, browser details and other headers are left out. The totals per website are public on the statistics page. Embeds API calls are counted per website the same way, from the API's access log, without IP addresses in the result.

The avatar maker

• Your logo: the logo you upload is sent once to the avatar service, processed in memory to make your options, and dropped as soon as the answer is sent back. It is not saved to disk, not kept and not used for anything else. The same goes for the request the editor makes to get the logo's layers.
• Your team number: used to look up your team's name and current avatar on FTCScout, to name the files and show your current avatar. That is public team information.
• The service's log: one line per request: the time, which options were made and how long it took. No images, no IP addresses.
• Your IP address is held in the service's memory for at most 10 minutes, to limit how many logos one visitor can upload at a time (so the service stays available for everyone). It is not written down.

Only upload a logo your team owns and may use. The page asks you to confirm that.

What we don't collect

No accounts, names, email addresses or payment details. No cookies, advertising, analytics or tracking scripts, and no fingerprinting. The site's fonts are served from ftc-embeds.com itself, so loading a page doesn't contact Google or other font services.

03Legal basis

Under the General Data Protection Regulation (GDPR), we process the data above because of our legitimate interests (Article 6(1)(f)): delivering the website and the widgets, keeping them secure and available, and knowing which websites use them. Making avatar options from your logo is done because you ask for it, to provide that service to you (Article 6(1)(b)). We keep the data to the minimum that needs, as described in this policy.

04Who else is involved

We don't sell or rent data, and we don't share it with anyone for their own purposes. A few services are involved in delivering the site:

Links on the site and in the widgets lead to other websites (FTCScout, FIRST, GitHub, npm). Their own privacy policies apply there. A website that embeds a widget is responsible for its own page and its own privacy policy; the widget only loads data from us as described above.

Some of these services may process data outside the European Economic Area. Where they do, they rely on the safeguards the GDPR requires, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

05How long we keep it

• Access logs (with IP addresses): rotated automatically and deleted after at most 90 days.
• Embed statistics log (without IP addresses): rotated by size; older entries are deleted as new ones come in. The public statistics only contain totals per website.
• Uploaded logos: not kept at all; dropped once your options are sent back.
• The avatar service's upload limit: your IP address stays in memory for at most 10 minutes.

Logs may be kept longer only when needed to investigate a specific security problem.

06Cookies and browser storage

ftc-embeds.com and the widgets don't set cookies. Two tools save things in your own browser, so you can come back to them. That data never leaves your device:

• The avatar editor saves your projects and their versions in your browser (IndexedDB), listed on the avatar page under "Saved in this browser". Delete them there, or by clearing this site's data in your browser.
• The setup wizard saves the setups you keep as templates in your browser (localStorage). Clearing this site's data removes them.

Project files you download from the editor (.ftcavatar) are files on your own computer; we never see them.

07Your rights

Under the GDPR you can ask us for access to the personal data we hold about you, to correct or delete it, to restrict or object to how we use it, and for a copy of it. Because we keep so little (no accounts, logs without names), we may need details from you to find your data in the logs, such as your IP address and the time of your visit.

If you think we handle your data wrongly, please contact us first. You can also complain to a data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens, or the authority where you live.

08Children and teams

Many people in FIRST Tech Challenge are students under 18. We don't ask anyone for personal data, and the site works without it. The widgets show public team information (team numbers and names, results and awards) from FTCScout and FIRST, not information about individual students. Avatar logos should be the team's own artwork; please don't upload photos of people.

09Changes

If we change what the site does with data, we update this page and the date at the top. The history of this page is public in the project's source code.

10Contact

Questions about privacy, or a request about your data: open an issue on GitHub (public), or contact mmathijs through GitHub for anything you'd rather not post in public.