Privacy
Privacy policy Draft
Draft: this text describes how the website works today, but it has not been approved yet. Simon and Rickard (ideally together with someone who knows data protection law) must review it and fill in the parts in [brackets] before the site goes public. It does not claim that the site meets every legal requirement.
What the Battle Arena Masters website stores about you, why, and for how long. In short: no accounts, no email addresses, no tracking and no advertising.
Who is responsible
This website is run by Simon and Rickard, the two developers of Battle Arena Masters (BAM). Contact: [contact address to be added].
What we store, and why
You can read the whole site without giving us anything. Information is only stored when you send an idea, write a comment or vote.
| What | Why | How long |
|---|---|---|
| Ideas you send: title, category, description and the nickname you choose (optional). | To read your idea and, if we approve it, show it on the site so others can vote and comment. | Ideas waiting for review are kept until we have read them. Approved ideas stay until they are removed. Ideas we reject are deleted 30 days after we reject them (the next time we open the admin panel after that). [decide how long approved ideas are kept] |
| Comments: the nickname and comment text you write. | To show your comment after we have read it. | As for ideas: approved comments stay until removed, rejected ones are deleted 30 days after we reject them. |
| A scrambled code made from your IP address, saved with each idea and comment you send. | To stop spam and limit how often forms can be sent. We never store the IP address itself, only a keyed one-way hash of it. With the secret key it can still be linked to an address, so we treat it as personal data. | As long as the idea or comment it belongs to. |
| Votes: a separate scrambled code made from your IP address, the idea you voted for and the time. | So that each person can vote once per idea. | As long as the idea exists. |
| Rate-limit records: the scrambled code, the kind of action (idea, comment, vote, admin login) and the time. | To block floods of submissions and guessing of admin passwords. | Records older than 2 days are deleted automatically while the forms are in use. |
We do not ask for your email address, we have no user accounts, and we use no analytics, advertising or tracking. The site loads no fonts, scripts or images from other companies.
Cookies
The site uses one cookie, bam_sid. It is set when you open a page with a form or a vote button (for example the home page, Community ideas, an idea, a dev update and Suggest an idea). It holds a random session number that protects the forms against forgery and remembers your text if a form has to be corrected. It is not used for tracking and is deleted when you close your browser. Because the forms cannot work safely without it, it is a strictly necessary cookie.
Simon and Rickard use the same cookie to stay logged in to the admin panel. An admin session ends after 120 minutes without activity.
Videos
Videos from YouTube or Vimeo are only loaded when you press play. Until then, nothing is sent to those services. YouTube videos use youtube-nocookie.com. When you press play, the video service’s own privacy policy applies, and it may set cookies.
Donations
Donations are voluntary and never give anything in the game. Donations are not set up yet. When they are, the payment happens entirely at PayPal or in the Swish app: this website never sees or stores card, bank or account details. The payment service’s own privacy policy applies to the payment.
Server logs and backups
Like most websites, the web server can keep technical log files with IP addresses, times and the pages requested. What is logged and for how long depends on our hosting provider: [hosting provider, what it logs and for how long].
We keep backup copies of the website’s database so nothing is lost after a mistake or a server problem. Backups contain the same information as above. [where backups are kept and when old backups are deleted]
Who can see your information
Only Simon and Rickard can see submissions before they are approved, and the scrambled codes. Approved ideas, comments and nicknames are public on the site. We do not sell or share your information. [name the hosting provider that stores the data, and the country]
Legal basis
Ideas and comments: your consent when you tick the box or send the form. Scrambled IP codes, rate limits and the session cookie: our legitimate interest in keeping the site safe and free from spam. [confirm the legal basis with someone who knows data protection law]
Children
[decide whether there is a minimum age for sending ideas and comments, and what that means for consent]
Your rights
You can ask us to show, correct or delete what you have sent, or withdraw your consent at any time. Because we do not store email addresses or IP addresses, tell us the nickname, the title of the idea or the text of the comment so we can find it. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY).
Last updated: [date, set when the text is approved]