Privacy Policy

01Who is responsible

[Legal entity name and registered address — to be completed] (“BattleArc”, “we”) is responsible for the personal information described here. Contact: [privacy email — to be completed].

02What we collect

• Account: your email address, handle, display name, birth year (used for the minimum-age check and never shown on your profile), optional avatar, bio and country, the date you accepted our terms, and whether you want product emails.
• Sign-in: the sign-in methods connected to your account (for Google, Apple, Discord or Twitch: the account id, name, email and picture they share with us), whether two-step verification is on, and session records (time, IP address, browser). Passwords are stored only as salted hashes by our authentication provider.
• Competition activity: organizations and teams you belong to, event registrations and check-ins, matches, submitted results and disputes, standings, ratings, awards, follows, notifications and match-room messages.
• Technical data: security and error logs, and the checks that protect sign-in from bots and brute force (Cloudflare Turnstile, per-address attempt counters stored as one-way hashes).

03Why we use it

• To create your account, sign you in and keep it secure (performance of our contract with you, and our legitimate interest in security).
• To run events: registrations, brackets, results, standings and prizes, including showing handles and results publicly (contract; legitimate interest of organizers and players).
• To send the emails the service needs (sign-in codes, security alerts) and, only if you opted in, product news (consent, which you can withdraw).
• To prevent abuse and comply with the law (legitimate interest; legal obligation).

We do not sell personal information and we do not use it for third-party advertising.

04What is public

Your handle, display name, avatar, bio, country, teams, event participation, results, ratings and awards appear on public pages, brackets, overlays and embeds. Your email address and birth year are never shown.

05Service providers

We use these providers to run BattleArc; they process data on our behalf under contract:

• Supabase — database and authentication (sign-in, sessions, two-step verification), hosted in the United States (us-east-1).
• Vercel — application hosting and delivery.
• Files you upload are stored with Vercel in the US (iad1).
• Cloudflare — Turnstile bot protection on sign-in forms.
• Pusher — live updates of brackets, matches and notifications (ids and counts only).
• [Email delivery provider — to be completed] — sign-in codes and security emails.
• Google, Apple, Discord and Twitch — only when you choose to sign in with or connect them.

06International transfers

Our main systems are in the United States. Where the law requires it, transfers rely on appropriate safeguards such as the European Commission’s standard contractual clauses. [Transfer mechanism details — to be completed.]

07How long we keep it

• Your account data: while your account exists. After deletion, results you took part in stay in anonymized form so completed brackets and standings remain correct.
• Unfinished sign-ups: deleted after 48 hours (unconfirmed email) or 7 days (confirmed, but the account was never set up).
• Sign-in attempt counters: about one day. Security and audit logs: [retention period — to be completed].

08Cookies

BattleArc uses only cookies it needs to work: the sign-in session (arc-auth), short-lived sign-in flow cookies, the “This is a public computer” choice, and event invitation cookies. There are no advertising or cross-site tracking cookies.

09Your rights

You can see and correct most of your information in your profile and in Settings → Security. You can also ask us for a copy of your data, to delete your account, or to restrict or object to certain uses, by writing to [privacy email — to be completed]. Depending on where you live you may complain to your data protection authority.

10Children

BattleArc is not for children under 13, or under 16 in the EU, EEA, UK and Switzerland. We ask for a birth year at sign-up and do not create accounts below the minimum age. If you believe a child has an account, contact us and we will delete it.

11Changes

We publish every new version here with a new date (current: 2026-09-23) and ask you to review material changes the next time you use your account. See also our Terms of Service.