Privacy Policy

This policy describes what Arena stores and why. [Template: to be reviewed by legal counsel before launch.]

Who is responsible

[Company name, address and contact email to be inserted.]

Data we store

• Registered accounts: your email address, username, a salted password hash, your account role and status, whether and when you confirmed your email address, and when you last signed in. We also keep failed sign-in counters and a temporary lock time to protect your account against password guessing.
• Email codes and links: one-time verification codes are stored only as a keyed hash and expire after 10 minutes. Password reset links expire after 30 minutes.
• Legal acceptance: which version of these documents you accepted, when, a one-way hash of your network address and your browser name, so we can show what you agreed to.
• Gameplay data for registered accounts: game statistics linked to your account (player kills, deaths, mobs defeated, matches played, wins and your best survival wave, in total and per game mode) and the ability loadout you last used in team deathmatch. You can see your statistics on your profile page.
• Guests: nothing is stored on our servers. Your display name is only kept in the game server's memory for the duration of your session and in your own browser.
• Technical data: your IP address is processed by the web and game servers to run the service, to apply rate limits and to prevent abuse. Rate-limit counters are kept in memory only and expire within an hour. [Hosting provider and log retention period to be inserted.]

Email

We only send emails you trigger yourself: verification codes and password reset links. [Email delivery provider to be inserted.] We do not send newsletters or marketing.

Third parties

Arena loads no third-party fonts, analytics, advertising or tracking scripts. All fonts and game assets are served from our own servers.

Cookies and browser storage

• payload-token cookie (registered accounts only): keeps you signed in for up to 7 days or until you sign out.
• localStorage entries that never leave your device: arena_graphics_settings (graphics, gameplay and control settings), arena.guestName (your guest name) and arena.storageNoticeDismissed (that you dismissed the storage notice).

How long we keep data

Account data, statistics and saved loadouts are kept until you delete your account, which you can do yourself at any time on your profile page. Legal acceptance records are kept after deletion as evidence of what was agreed, without your email address or username. [Backup retention period to be inserted.]

Your rights

[Describe access, correction, deletion and portability rights and how to exercise them.]

Contact

[Privacy contact email to be inserted.]