Privacy policy

The data controller is the private individual operating this server, acting in a non-professional and non-commercial capacity. They decide what is stored and are reachable at the address below for any request concerning your data.

Contact: contact@arenareborn.com

Hosted by: IONOS SARL, 7 place de la Gare, BP 70109, 57200 Sarreguemines Cedex, France

As little as the game needs in order to work:

• Your account name, and a bcrypt hash of your password. The password itself is never stored. We do not ask for an email address or your real name.
• Your in-game data: your coach, fighters, cards, teams, friend and ignore lists, mail, guild membership and match record.
• Your IP address, held briefly in memory to rate-limit sign-ups and sign-in attempts. It is not written to the database and is not used to build a profile.
• If you send a bug report from inside the game, the text you wrote and the screenshot the client attached to it.

We run no advertising, sell nothing, and operate no analytics or tracking of our own. Every page, font and image is served from this server rather than from a third party. Your data is never sold, rented or traded. The one exception we do not control is described below: this site is delivered through a CDN, which necessarily sees your connection.

Nobody receives your account or game data. Two providers unavoidably handle your connection in order to deliver the site at all:

• Cloudflare, Inc. — this site is served through Cloudflare, which sees the IP address and browser details of every request in order to route and protect it. Cloudflare also injects its own analytics script into pages; this site's Content-Security-Policy forbids scripts, so it does not execute, but the request to Cloudflare has already happened by then. See cloudflare.com/privacypolicy.
• Our hosting provider, named in the legal notice, which operates the machine the server and its database run on.
• Nobody else — unless we are compelled by a lawful order, or you ask us to.

Passwords are hashed with bcrypt and never stored in readable form. The site is served over HTTPS. Administrative access is restricted to the operator. The database is not reachable from the internet. Bug-report screenshots are written to disk rather than into the database, so they stay out of every backup.

Account and game data are processed to provide the service you asked for when you registered. IP-based rate limiting rests on our legitimate interest in keeping the server available and resistant to abuse.

Your account and game data are kept until you delete your account, which erases them. Rate-limiting records live in memory only and expire within the hour. Bug reports are kept until an operator resolves and removes them.

Three cookies, all strictly necessary and all first-party: a signed session cookie once you sign in, a CSRF token protecting forms against cross-site submission, and one remembering your chosen language. No tracking or advertising cookies are set, which is why this site has no cookie banner.

Under the GDPR you can:

• Access (art. 15) — see everything we hold about you. Your account page already lists all of it, in full, at any time.
• Rectification (art. 16) — have inaccurate data corrected. Write to us and we will fix it.
• Erasure (art. 17) — the delete button on your account page erases your account and every record attached to it, immediately and permanently.
• Restriction (art. 18) — ask us to stop processing your data while a dispute about it is resolved.
• Portability (art. 20) — ask for a machine-readable copy of the data you gave us.
• Objection (art. 21) — object to processing we base on our legitimate interest, such as IP-based rate limiting.
• Complaint (art. 77) — complain to your national data-protection authority (in France, the CNIL) if you believe your data has been mishandled.

Write to the address below to exercise any of these. We will answer within one month, as the GDPR requires.

This policy may change. The version and date at the foot of this page always identify the text currently in force, and any substantive change will be announced on the site. If you disagree with a new version, you can delete your account from your account page at any time.

contact@arenareborn.com