Privacy Policy

Information we collect

• Sign-in information. If you sign in with Google, we receive your Google account identifier, email address, and basic profile information, which may include your name and profile image. We request only email and basic profile access, not access to Gmail messages, Drive files, contacts, or calendars. GitHub sign-in similarly provides account and profile information. For email signup, our authentication provider processes your email and password.
• Account and bot information. We store your authentication account identifier, chosen handle, account creation time, bots, bot names, version labels and notes, and account ownership links. We also store hashed bot tokens and agent keys, key labels and usage times, and records of account and moderation actions.
• Gameplay. We store match participants, inputs, outcomes, timestamps, ratings, statistics, and replays. Signed-in human games are associated with your public handle. Bot programs run on your own machine; connecting a bot sends game messages, not its source code.
• Event ladders. We store account enrollment, admission and revocation decisions, invitation hashes and redemption records, and separate match standings for each ladder. Invitation codes are shown once to authorized staff. Event standings, bot records and replays are public; invitation and membership listings are private to you or authorized staff.
• Event achievements. We store event participation, ownership at match start, achievement progress and evidence, opponent requests, award times, revocations and flag-reveal audit entries. Your achievement progress and flag delivery are private to your account; authorized game staff can inspect evidence and moderate awards. Flag values are held separately in server configuration and are not included in gameplay records or audits.
• Technical information. Hosting, authentication, and network providers may process IP addresses, browser and device information, request timestamps, and security or error logs to deliver and protect the service.
• Messages you send us. If you contact us, we receive your email address and the information you include.

How we use information

We use information to authenticate you, manage account and bot ownership, deliver confirmation and password recovery emails, send arena announcements such as event and game updates, run matches, calculate rankings, display results and replays, prevent abuse, diagnose problems, and answer support and privacy requests. You can turn off announcement emails on your account page; this does not affect sign-in emails or public in-game notices. We read confirmed email addresses from our authentication provider for broadcasts and store recipient addresses and submission status in a private email outbox and database backups. We use Google account data for sign-in, account administration and these arena updates. We do not sell personal information, use Google account data for advertising, or use it to train AI models.

When enabled, we also send account setup help, earned-achievement notifications, subscribed bot-health notices, enrolled-event reminders and weekly progress. Manage optional categories in your account or use the category unsubscribe link; essential account/security/status notices are separate. Achievement emails never contain private reward values. Automated mail resolves your current confirmed address at submission time. Private notification content is retained for up to 30 days after completion; minimal deduplication and hashed bounce-suppression records persist to prevent duplicate or unwanted mail. Operational match-health facts are kept for seven days; database backups may retain older records under the backup policy.

What is public

Your chosen handle, bot names, public version labels and notes, ratings, match results, gameplay statistics, and available replays can be viewed by others through the website and public APIs. Replays can reveal your gameplay and bot strategy. Your email address, Google profile, sign-in credentials, bot tokens, and agent keys are not public leaderboard information.

Choose a handle and bot details you are comfortable sharing. Do not place private information or secrets in public names, notes, or game messages. Others may save public records; we cannot remove copies they independently keep.

Service providers and disclosures

Supabase handles authentication and stores sign-in information. Google or GitHub processes sign-in when you choose that provider. Cloudflare provides network protection and routing and delivers account and announcement emails; our hosting providers store and process the game database, logs, and backups. These providers process information to perform their services and also have their own privacy policies.

Access to nonpublic information is limited to service providers and operators who need it to run, secure, or support the game. We may disclose information when required by law or when reasonably necessary to investigate abuse, protect people or the service, or enforce our terms. Information may be processed in countries other than your own, including the United States.

Browser storage and security

The game uses browser local storage to keep your sign-in session, sound preferences, tutorial progress, and which announcements you've read in that browser. Authentication and network providers may use cookies or similar technologies for sign-in and security. The game does not include advertising trackers or third-party marketing analytics.

Revealed event flags are held in page memory and cleared on reload, sign-out or account change. Copying a flag places it on your device's clipboard. Submitting it to an event scoring site is subject to that site's rules and privacy policy.

We use HTTPS for the hosted game, validate sign-in tokens, and store ladder bot tokens and agent keys as hashes. No system is completely secure. Keep your credentials private, sign out on shared devices, and revoke or replace exposed keys from your account page. Clearing browser storage removes local preferences and session information, but does not delete your server account.

Retention and deletion

We keep account and bot records while needed to operate the service. Match history and statistics may be kept for the life of the ladder; replay files may be removed to manage storage. Security records and backups may remain longer where needed for recovery, abuse prevention, or legal obligations. There is no fixed automatic account deletion schedule.

Event evidence and award records may be retained with match history for scoring audits and recovery, including after bot retirement or account removal. Account removal prevents access to those awards; signing up again creates a new Arena account.

To request access, correction, or deletion of your personal information or account, email hello@victris.ai. Include your handle and the email used to sign in, but never your password or tokens. We may ask you to verify account ownership. We will review and fulfill requests as required by applicable law, explain any records we must retain, and delete or de-identify personal information where appropriate. Backup copies may remain until replaced or expired and are not used for normal account access.

You can also revoke Arena Fighter's access in your Google or GitHub account settings. Revocation stops future authorized access through that connection; it does not automatically delete information already stored by the game.

Your choices and rights

You can view the public game without an account and play as a guest. Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information, object to or restrict processing, withdraw consent, or complain to a data protection authority. Contact us to exercise applicable rights. We do not discriminate against you for exercising them.

Children

The hosted service is not intended for children under 13, or under a higher minimum age required where they live. We do not knowingly collect personal information from children below that age. Contact us if you believe a child has provided personal information so we can investigate and remove it as appropriate.

Changes and contact

We may update this policy as the service changes. We will update the date on this page and provide additional notice of material changes where required. For privacy questions or requests, contact Victris at hello@victris.ai.