Privacy policy
This page explains what fightelo collects, why, and what you can do about it. We've kept it short and specific to how the site actually works — if a section looks vague, that's a bug, please tell us.
What we collect
- Account info — your email, chosen username, a hashed password, an optional avatar, and the universes you've joined.
- Activity — votes you cast on matchups, posts and comments you publish, and the timestamps for each.
- Server logs — IP address and user-agent on each request, used for rate-limiting and abuse detection.
What we don't collect
- No payment data — fightelo is free and we don't process payments.
- No third-party advertising trackers, no behavioral profiling, no selling of data to anyone.
Cookies
We set a single session cookie containing a signed JWT. It is HttpOnly + SameSite=Lax (and Secure in production), used only to keep you signed in.
Service providers we use
These third parties process some of your data on our behalf, only for the purpose of running fightelo:
- Email delivery — for account verification and password reset.
- Hosting and database — for serving the site and storing your account.
- Object storage — for fighter and avatar images.
- Error monitoring — when an error happens we may capture the request path, browser, and stack trace; we don't intentionally include account data in those reports.
Public vs. private
Your username, avatar, vote totals, and any posts/comments you publish are visible to anyone. Your email is only used for account purposes and is never shown to other users.
Retention
- Account data is kept while your account is active. You can ask us to delete it at any time.
- When an account is deleted, the account record is removed and past votes/posts/comments are anonymized rather than removed (deleting them would distort historical ELO and threading).
- Server logs are kept for a short window (around 30 days) and then rotated out.
Your rights
- Access / correct — you can update your username, avatar, and posts from your profile page.
- Delete — email us and we'll delete your account (see contact below).
- Export — email us and we'll send you a copy of your account data.
- If you're in the EU/UK, you also have rights under GDPR/UK GDPR including the right to lodge a complaint with your local data protection authority.
Children
fightelo isn't for users under 13 (or under 16 in the EU). If we learn an account belongs to someone under that age, we'll remove it.
Changes
If we change this policy in a way that affects what we do with your data, we'll update the date at the top and surface the change in-app.
Contact
Questions or requests: hello@fightelo.com.