A draft, to be reviewed before the site opens: the words in [brackets] are filled in once the site has an operator.
Privacy
Inversus Arena keeps as little about you as it can, and nothing it does not need. [the operator's name] is responsible for it.
What is kept
| What | Why | How long |
|---|---|---|
| Your username, when you joined, your role | Your account; shown on your public page | Until you delete the account |
| Your password, as an Argon2id hash; your passkeys' public keys | Signing you in | Until you remove them or delete the account |
| Recovery codes, as hashes | Signing you in without a password | Until used or replaced |
| Sessions: when they started, when last seen, the browser's family (say "Firefox"), the last address | Your sessions list; stopping abuse | 30 days after the session's last use |
| Your bots: uploads, versions, notes, descriptions | Playing them | Until you delete the account |
| Matches: results, recordings, replays, each bot's log | The leaderboards, replays, your logs | Results for good; the files of rated matches a year, of test and qualification matches 30 days |
| Reports you make | Moderation | Until resolved, then in the audit log |
There is no e-mail, no real name, no analytics and no tracking. Addresses are counted for a short while to limit abuse (failed sign-ins, sign-ups, requests), in memory, and forgotten within a day.
Cookies
- A session cookie, when you sign in. It is what "signed in" means.
- When the site is under heavy load, a cookie that remembers your browser passed its check, for an hour.
Nothing else: no advertising or third-party cookies, and the pages load nothing from other sites.
What others see
Your username, your bots, their records and their matches are public: that is the point of a leaderboard. Your bots' code and logs are yours only.
Deleting
Deleting your account (on its page) removes your sign-in methods and sessions at once and retires your bots. Matches already played stay, for the other bots' records, under a placeholder name instead of yours.
Contact
For anything about your data: [a contact address].