Privacy Policy

PROJECT_NAME Holdings LLC is the controller of the personal data described here. Contact us at support@example.com for anything in this policy, including data requests.

Anonymous visitors — a randomly generated, signed device identifier in a cookie; the battles and sides you supported; and a salted one-way hash of your IP address. Legal basis: legitimate interests (running a fair contest and preventing abuse). We never store your raw IP against your activity, and we never store precise location.

Account holders — your email address, a username you choose, and your participation history. Legal basis: performance of a contract (providing the account you asked for).

Buyers — payment records (amount, status, provider references). Legal basis: performance of a contract and our legal obligation to keep financial records. Card details are handled entirely by Stripe and never reach our servers.

Optional analytics — aggregate product usage, only if you say yes to the cookie banner. Legal basis: consent, which you can withdraw at any time from the Cookies page.

Traffic measurement — for each page you open we record the path, the HOST of the site that linked you (never the full referring URL, which can contain search terms), any campaign tag in the link, a coarse device bucket (mobile, tablet or desktop), and a country code if our hosting platform supplies one. This is first-party, is never shared, and is deleted after 90 days. Legal basis: legitimate interests (knowing which pages work).

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We run no advertising trackers, no data brokers, and no fingerprinting beyond the signed identifier described above.

We do not use your data to make automated decisions with legal or similarly significant effects. Abuse scoring can block a single action, and a human reviews any account-level consequence.

Vercel (hosting and delivery). Supabase (database and authentication). Stripe (payments). Sentry (error monitoring, if configured). PostHog (product analytics, only with consent).

Each is bound by a data-processing agreement. Where data leaves your region we rely on Standard Contractual Clauses or an equivalent transfer mechanism.

Battle results and their support ledger: kept indefinitely as a public historical record, in aggregate form that does not identify you.

Abuse signals (hashed IP, suspicion scores): up to 12 months.

Analytics and traffic measurement: up to 90 days. Live visitor presence: one hour.

Payment records: as long as tax and accounting law requires, typically 7 years.

Account data: until you delete your account, then removed or irreversibly de-identified within 30 days.

You can access, export, correct, delete, restrict or object to our processing of your personal data, and withdraw consent at any time. If you are in the UK or EEA you may also complain to your local supervisory authority.

If you are in California, you have the rights to know, delete, correct and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, and we will not discriminate against you for exercising any right.

The fastest route is your profile page, which has one-click export and account deletion. You can also email support@example.com; we respond within 30 days.

Deleting your account removes your email, username and profile, detaches your identity from your participation records, and cancels your notifications. Aggregate scores stay, because other people’s results depend on them — they no longer point at you.

The service is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has given us personal data, email support@example.com and we will delete it. You must be 18 or over to buy anything.

Data is encrypted in transit. Identity cookies are signed and HTTP-only. Payment card data never touches our systems. See the Security page for how to report a vulnerability.

If we make a material change we will give notice in the product before it takes effect.