Privacy notice
Version 2026-07-30. What we collect, why we collect it, and how long we keep it — in plain language.
Who is responsible
TODO(legal): registered entity name, TODO(legal): registered address, is the data controller for RPSA Arena. For any question about this notice or to exercise the rights described below, contact TODO(legal): privacy contact email.
What we collect, and why
We collect only what the platform needs to run a competition. Each item below is a field that actually exists in our database.
| Data | Why | Basis |
|---|---|---|
| Username, email address, password hash | To create and secure your account and to verify your email address | Contract |
| Display name | How you appear on leaderboards and in match history | Contract |
| What describes you (student, hobbyist, team, educator, other) and experience level | To point you at the right guides, SDK tier and season format | Legitimate interest |
| Optional: age range, school or university, field of work | Aggregate understanding of who uses the platform, so we build the right features. Always optional and skippable; the age range also lets us apply the protections that minors are entitled to. | Consent |
| Marketing opt-in flag | Whether to send you launch and season updates. Off means off. | Consent |
| Strategy source code you upload, match results, wallet and credit history | To run matches, score seasons and produce leaderboards and replays | Contract |
| Product analytics: pages visited, funnel steps, a random browser identifier, and one-way hashes of your IP address and browser user-agent | To see where signup and onboarding break, and to fix it | Legitimate interest |
We do not collect phone numbers or postal addresses, and we do not ask for your date of birth. If we ever ship a physical prize, we will ask the winner for a delivery address at that point and for that purpose only.
Analytics and storage on your device
To measure the signup funnel we store a random identifier in your browser (rpsa_anonymous_id in local storage and rpsa_session_id for the current tab). These are random values, not derived from anything about you.
Analytics records never contain your password, session tokens, raw email address, raw IP address, or your strategy source code. Your IP address and user-agent are stored only as salted one-way hashes, which we use to spot abuse and de-duplicate traffic. We use no third-party advertising or tracking services.
We also set one strictly necessary cookie to keep you signed in (rpsa_refresh).
Who else sees your data
We do not sell your data and we do not share it for advertising. We use service providers who process data only on our instructions: our cloud hosting provider, and an email delivery service used to send verification and account emails.
Leaderboards, match replays and public strategy listings are visible to other users — but only your display name and competition results appear there, never your email address or any of the optional demographics.
How long we keep it
Account data and competition history are kept while your account exists. If you delete your account, we delete your account data and the optional demographics; anonymised match results may remain in season records for the integrity of past competitions. Product analytics records are retained for up to 24 months.
Your rights
You can request access to your data, correction, deletion, a portable copy, or restriction of processing. Where we rely on consent — the optional demographics and marketing emails — you can withdraw it at any time, and withdrawing it does not affect your account or your ability to compete. You can also object to processing based on legitimate interest, and you have the right to complain to your local data protection authority.
Contact TODO(legal): privacy contact email to exercise any of these.
Children
RPSA Arena is not directed at children under 16. If you tell us you are under 18 we will not use your data for marketing. If you believe a child has given us personal data without the consent of a parent or guardian, contact TODO(legal): privacy contact email and we will delete it.
Changes
If we change this notice materially we will publish a new version and record which version you accepted. See also our terms of service and competition rules.