Transparency & Disclaimer
Exactly what the scKillboard desktop app reads, records, and sends — in plain terms. The client is open-source, so everything here is verifiable in the code.
scKillboard watches your Star Citizen Game.log for kill and death events, looks up the players involved on their public RSI profile pages, and sends that information to this site so it appears on the leaderboard and, optionally, in Discord. It does not read your game's memory, capture your network traffic, log your keystrokes, touch any file other than the game log and its own settings, or use your RSI password. It contacts exactly two websites, both listed at the bottom.
WHAT IT READS ON YOUR COMPUTER
Your Star Citizen Game.log — the plain-text log the game itself writes (default …\StarCitizen\LIVE\Game.log). It reads only lines added after you press start — it records the file's size at that moment and then reads only newly-appended text. It never reads your historical log, and it opens no other file on your disk.
Its own settings file — config.json in your AppData folder, holding your settings (below).
Whether Star Citizen is running — every couple of seconds it checks for the StarCitizen.exe process, only to show a "game detected" status and to refuse submitting kills when the game isn't actually open (this blocks fake kills from replaying an old log). It inspects no other program.
WHAT LOG LINES IT LOOKS FOR
Each new log line is checked against a fixed set of patterns. In plain terms, it watches for:
- Your identity — the login line the game writes at startup, which contains your handle. This is how it knows who "you" are.
- Kills you deal — the "Crime Committed" notification plus the matching victim line.
- Deaths you take — the "<player> committed <crime> against you" notification, so your death is credited to your killer.
- The weapon used — a corpse/recovery line that names the weapon.
- Bounty completions — the mission lines that mark a bounty kill.
- Vehicle destruction — both when you destroy a ship and when yours is destroyed.
- Context — the ship you're piloting, the weapon in your hands, and your location, so a kill can be tagged ship-vs-FPS and placed.
NPCs are ignored. Any victim with a "First Last" style name (the game's NPC naming) is treated as an NPC and never recorded — only real player handles are submitted.
HOW IT LOOKS UP PLAYER DATA
For each player in a kill, the app fetches their public RSI profile — the same pages anyone can view in a browser without logging in — and reads the avatar, org, enlisted date, and location from the public HTML. This happens on your machine, not on the server. The app never logs into RSI and never uses your RSI account or password; it only reads pages that are already public.
WHAT IT SENDS TO THIS SITE
On a kill or death, it sends the kill record (attacker, victim, crime, time, method, weapon, ship, location, bounty details) plus the public RSI profile fields above. It also sends account actions (log in / out) — your password is sent once, at login, over HTTPS, and after that only a session token is used. Every request is authenticated as you, so the server always knows which account submitted what.
WHAT IT STORES ON YOUR COMPUTER
In its config.json: your log-file path, your handle, an optional personal Discord channel, and your login session token (so you don't retype your password each launch). Your password is never stored — only the token the server returns. The file lives in your own user profile.
WHAT IT DOES NOT DO
- Read or modify Star Citizen's memory, or inject anything into the game (log-file reading only — nothing that risks your account)
- Capture or sniff network traffic
- Log keystrokes or capture your screen
- Read any file besides
Game.log and its own config.json
- Scan your other running programs (beyond the single "is Star Citizen open?" check)
- Use your RSI login or password, or access any private RSI data
- Send data anywhere except the two sites below
- Auto-download or auto-run updates (it only opens the download page in your browser if you choose to update)
- Collect analytics or telemetry beyond the kill/profile data described here
THE TWO WEBSITES IT TALKS TO
www.sckillboard.com — this site, to submit kills, sync profiles, and log in. (send & receive)
robertsspaceindustries.com — public RSI profile pages, to read avatars and orgs. (receive only)
Because the app self-reports kills from your own log, a determined user could submit crafted data as themselves — this is inherent to any log-based tracker, and is why every submission is tied to a verified account and validated server-side. If you spot anything in the client's behaviour that doesn't match this page, please let us know.