Data Handling
How data moves from IOSoccer's servers to your browser - and what stays on ours.
Request to page in 4 steps
1
You load a page. Your browser sends a request to this site's PHP API bridge at
/api. Nothing goes directly to IOSoccer from your browser.2
Bridge fetches and filters. The PHP layer requests public IOSoccer JSON, strips out fields the UI doesn't need, and normalizes the shape.
3
Cache check. Responses are cached on the server for short periods. Live match data refreshes faster than historical stats or ratings.
4
Fallback if needed. If IOSoccer is slow or down, stale cache is served. You'll see what was last known - not an error, but potentially outdated.
What Discord login stores
Stored locally on this server
Discord user ID, display name, avatar hash
Active session token and login timestamps
Colosseum team memberships, invites, and roles
Admin-issued team creation tokens (if applicable)
Never stored
Discord password or OAuth tokens beyond session
Private messages or DM content
Steam credentials or any payment data
Anything outside what login requires
Session cookies are HTTP-only - JavaScript running on this page cannot read them. Logout removes the session record and clears the cookie immediately.
Server-side details
Keep this in mind
Cache reduces repeated upstream calls - it's a performance layer, not data collection.
api/hub-config.php holds OAuth credentials. It must stay private and blocked from web access.data/hub/ is the local Colosseum storage directory. It's protected from direct browser access.This project never writes to or modifies IOSoccer source data. Read-only throughout.