Privacy Policy

ArenaCoach.gg ("we", "us", "our") provides automated arena coaching tools for World of Warcraft PvP players. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

1. Data We Collect

Account Data

• Battle.net ID and BattleTag (via Blizzard OAuth, scope: wow.profile)
• Twitch account ID and username (optional, if you link your Twitch account)

Combat Log Data

When you upload combat log files (.txt), we store and process that data to provide match analysis, mistake detection, and performance insights. Combat log data is stored in our database and associated with your account.

Cookies

We use only two functional cookies:

• connect.sid -- Session cookie for authentication
• XSRF-TOKEN -- CSRF protection token

We do not use any third-party tracking or advertising cookies.

Analytics

We use Umami, a self-hosted analytics platform (analytics.arenacoach.gg), to collect anonymous page view and event data. Umami does not use cookies and does not collect personal data.

Error Tracking

We use Sentry for error monitoring. When an error occurs, Sentry may capture error details and your user ID (if you are logged in) to help us diagnose and fix issues.

IP Addresses

IP addresses are used for rate limiting, security logging, and freemium usage quota tracking. For rate limiting, IP addresses are held in memory and are not persisted to our database. For freemium usage quotas, IP addresses are hashed with a salt before storage -- raw IP addresses are not stored in our database.

2. What We Do NOT Collect

• Email addresses (except optional Twitch email if you link Twitch)
• Real names or phone numbers
• Persistent device identifiers or fingerprints
• Third-party marketing or advertising data

3. How We Use Your Data

• Authenticate you via Battle.net OAuth
• Analyze your combat logs to detect mistakes and provide coaching insights
• Display your match history, performance analytics, and builds
• Look up character data through the Blizzard API
• Monitor errors and improve service reliability (Sentry)
• Understand aggregate usage patterns (Umami analytics)
• Protect against abuse via rate limiting

4. Third-Party Services

We share data with the following services as necessary to operate ArenaCoach.gg:

• Blizzard / Battle.net -- OAuth authentication and character data lookups
• Cloudflare -- CDN and DDoS protection
• Sentry -- Error monitoring and diagnostics
• Umami -- Self-hosted analytics (no data leaves our infrastructure)
• Wowhead / WoWDB -- Game tooltip data and images

5. Security

• OAuth tokens are encrypted at rest
• HTTPS enforced with HSTS preload
• Session cookies use the httpOnly flag
• CSRF protection on all state-changing requests
• Rate limiting on API endpoints

6. Data Retention

We retain your data for as long as your account is active. If you request account deletion:

• Your account data and associated combat logs are deleted
• Anonymized, aggregated analytics data may be retained

7. Your Rights

Under applicable data protection laws (including GDPR), you have the right to:

• Access -- Request a copy of the personal data we hold about you
• Deletion -- Request deletion of your account and associated data
• Portability -- Request your data in a portable format
• Rectification -- Request correction of inaccurate data
• Objection -- Object to certain processing of your data

To exercise any of these rights, contact us at [email protected].

8. Children's Privacy

ArenaCoach.gg is not intended for use by anyone under the age of 13, consistent with Blizzard Entertainment's Terms of Service. We do not knowingly collect data from children under 13. If we become aware that we have collected data from a child under 13, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised effective date. Your continued use of ArenaCoach.gg after changes are posted constitutes acceptance of the updated policy.

10. Contact

If you have questions about this Privacy Policy or your data, contact us at [email protected].