Privacy Policy

ArenaCoach.gg ("we", "us", "our") provides automated arena coaching tools for World of Warcraft PvP players. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

1. Data We Collect

Account Data

• Battle.net ID and BattleTag (via Blizzard OAuth, scope: wow.profile)
• Twitch account ID and username (optional, if you link your Twitch account)

Combat Log Data

When you upload combat log files (.txt), we store and process that data to provide match analysis, mistake detection, and performance insights. Combat log data is stored in our database and associated with your account.

Cloud Recordings

If you upload recordings from the desktop app to cloud storage (a Premium feature), we store each recording's video, including any audio it captured such as voice chat, its thumbnail, and the match details shown with it. Cloud recordings are private to your account unless you share one: anyone with a shared recording's link can watch it and see the match details and mistakes shown with it, including other players' names and mistakes. Share links are not listed or indexed, and stop working when you stop sharing or delete the recording.

Payment Data

Premium subscriptions are processed through Stripe. We store your Stripe customer ID and subscription status. We never receive, store, or process your payment card details -- Stripe handles all card data directly.

Cookies

We use only functional cookies:

• connect.sid -- Session cookie for authentication
• XSRF-TOKEN -- CSRF protection token
• session_hint -- Whether you are signed in, so the page header shows your signed-in state as the page loads; it grants no access
• viewer_id -- A random anonymous ID, so a character page view is counted once per visitor

We do not use any third-party tracking or advertising cookies.

Analytics

We use Umami, a self-hosted analytics platform (analytics.arenacoach.gg), to collect anonymous page view and event data. Umami does not use cookies and does not collect personal data.

Error and Performance Diagnostics

We use Sentry for error and performance diagnostics. Our browser integration collects error details, page and route information, browser context, request metadata, and performance traces. Sentry also generates diagnostic session IDs for browser visits and navigation, including for logged-out visitors.

When you are logged in, the only account identifier our browser integration attaches as user context is our internal numeric account ID, not your BattleTag, so we can understand how many users are affected. The browser integration clears this account identity when you are logged out and does not create a persistent user identifier for logged-out visitors.

IP Addresses

IP addresses are used for rate limiting, security logging, and freemium usage quota tracking. For rate limiting, IP addresses are held in memory and are not persisted to our database. For freemium usage quotas, IP addresses are hashed with a salt before storage -- raw IP addresses are not stored in our database.

2. What We Do NOT Collect

• Email addresses (except the one you give Stripe at checkout, which Stripe holds, and optional Twitch email if you link Twitch)
• Real names or phone numbers
• Payment card details (handled entirely by Stripe)
• Persistent device identifiers or fingerprints
• Third-party marketing or advertising data

3. How We Use Your Data

• Authenticate you via Battle.net OAuth
• Analyze your combat logs to detect mistakes and provide coaching insights
• Display your match history, performance analytics, and builds
• Store your cloud recordings and play them back to you
• Process and manage premium subscriptions via Stripe
• Look up character data through the Blizzard API
• Monitor errors and performance to improve service reliability (Sentry)
• Understand aggregate usage patterns (Umami analytics)
• Protect against abuse via rate limiting

4. Third-Party Services

We share data with the following services as necessary to operate ArenaCoach.gg:

• Blizzard / Battle.net -- OAuth authentication and character data lookups
• Stripe -- Payment processing for premium subscriptions
• Cloudflare -- CDN and DDoS protection, and storage of uploaded combat log files and cloud recordings
• Sentry -- Error and performance diagnostics
• Umami -- Self-hosted analytics (no data leaves our infrastructure)
• Wowhead / WoWDB -- Game tooltip data and images

5. Security

• OAuth tokens are encrypted at rest
• HTTPS enforced with HSTS preload
• Session cookies use the httpOnly flag
• CSRF protection on all state-changing requests
• Rate limiting on API endpoints

6. Data Retention

We retain your data for as long as your account is active. Cloud recordings are kept until you delete them, or for 30 days after your Premium subscription ends. If you request account deletion:

• Your account data and cloud recordings are deleted
• Matches you played in remain, no longer linked to your account, as they are shared with the other players in them
• Stripe subscription data is handled per Stripe's retention policies
• Anonymized, aggregated analytics data may be retained

7. Your Rights

Under applicable data protection laws (including GDPR), you have the right to:

• Access -- Request a copy of the personal data we hold about you
• Deletion -- Request deletion of your account and associated data
• Portability -- Request your data in a portable format
• Rectification -- Request correction of inaccurate data
• Objection -- Object to certain processing of your data

To exercise any of these rights, contact us at [email protected].

8. Children's Privacy

ArenaCoach.gg is not intended for use by anyone under the age of 13, consistent with Blizzard Entertainment's Terms of Service. We do not knowingly collect data from children under 13. If we become aware that we have collected data from a child under 13, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised effective date. Your continued use of ArenaCoach.gg after changes are posted constitutes acceptance of the updated policy.

10. Contact

If you have questions about this Privacy Policy or your data, contact us at [email protected].