Privacy policy
Last updated: November 1, 2026
This policy explains which data we process when you use rankmysetup.com and why. Data controller: Fatih Türüdü, contact: iletisim@rankmysetup.com. For users in Turkey, this policy also serves as the information notice under Law No. 6698 on the Protection of Personal Data (KVKK).
At a glance: which data goes where
| Data | Why | Where it goes |
|---|---|---|
| Username, email address | Your account, sign-in, verification and password-reset emails, and one reminder if you haven’t scanned yet | Cloudflare (database); Resend only delivers the emails |
| Password | Signing in | Never sent in plain text: it is hashed in your browser and hashed again on the server. Nobody, including us, can see it. |
| Two-step verification key and backup codes | Two-step verification (optional) | Cloudflare (database); backup codes are stored only as hashes |
| Discord / Google account ID, display name, profile picture | Only if you sign in with Discord or Google | Discord / Google, under their own policies |
| Scan data (CPU, graphics card, RAM, drives, display, Windows version, power plan, Game Mode and GPU scheduling settings, mouse acceleration, background game recording and Memory Integrity settings, graphics driver date, hours since the last restart, BIOS version, connected mouse / keyboard / headset models, which of the games we support are installed (only the names of those games are sent; nothing about other programs), battery health on laptops, benchmark: CPU and memory speed, CPU load before the test, clock limit under load) | Score, report, FPS estimates, leaderboard, your PC’s performance history (visible only to you) | Cloudflare; for the expert comment the hardware list (never your name, username or email) goes to Google Gemini or Cloudflare AI |
| Comments, likes, profile images | Community features | Cloudflare (public) |
| IP address (signed-in users, kept 180 days) | Account security, preventing abuse | Cloudflare |
| Cookies: session, language, sign-in steps, your cookie choice | Keeping you signed in and remembering your language and choice | Only in your browser |
| Advertising cookies (only if you click “Accept”) | Google AdSense ads |
We never sell your data and never share it with anyone for advertising. Your computer name, Windows user name, files and serial numbers are never collected.
What we process
- Account data: username, email address and an irreversible hash of your password. If you sign in with Discord or Google, the account ID, display name and profile picture they share with us.
- Scan data: hardware information sent by RankMySetup Scanner (CPU, graphics card, RAM, motherboard, drives, display, Windows version and a short benchmark result). Your computer name, user name, files and serial numbers are never collected.
- Community content: comments, likes and reports you submit.
- Technical data: a session cookie, a record of failed sign-in attempts and, for signed-in users, the IP addresses used to access the account (kept for 180 days), used for security and abuse prevention.
- Visit statistics: anonymous page view counts, country, device type and referring site. We don’t store IP addresses for statistics; unique visitors are counted with a one-way code that changes every day.
Why we process it
To provide the service (scan reports, profiles, leaderboard, comments), keep your account secure, prevent abuse and cheating, and meet legal obligations.
Who we share it with
We use the following service providers, which may process data outside your country:
- Cloudflare: hosting, database, bot protection (Turnstile) and AI models for expert comments.
- Google: Gemini AI for expert comments (only your scan’s hardware data is sent, never your name, username or email), sign-in with Google, and AdSense ads.
- Discord: sign-in with Discord.
- Resend: sending verification, password-reset and the one-time scan reminder emails (your email address only).
The automatic product catalog searches the web with Tavily, Exa and Firecrawl using product names only; no personal data is sent to them. Your profile, scans and comments are public; your email address is never shown publicly.
Cookies and advertising
We use a necessary session cookie so you can stay signed in, and a cookie to remember your language. The site may show Google AdSense ads; advertising cookies are only used if you click “Accept” in the cookie banner (in the EU and UK, consent is collected by Google’s own consent screen). You can change your choice any time with the “Cookie preferences” link at the bottom of the page. Google and its partners may use cookies to serve ads based on your visits to this and other websites. You can turn off personalized ads in Google Ad Settings. See Google’s advertising policy for details.
How long we keep data
- Your account, scans, comments and likes: until you delete them or your account. When you delete your account you choose whether your scans are deleted or kept without any link to you.
- Scans made without an account: kept without any personal link, as part of the community statistics.
- The IP addresses you signed in from: deleted after 180 days without use, and immediately when you delete your account.
- Anonymous visitor counts: only a one-way hashed ID, deleted after 400 days.
Your rights
You can ask to access, correct or delete your data and object to its processing. You can download everything we hold about you from Settings → Download my data, and delete your account and all its data yourself from Settings → Delete account, or email iletisim@rankmysetup.com.