Your data in the arena

Privacy Policy

You can play as a guest. Signing in saves your progression and enables account and social features. This page explains what the game processes in either case, what is visible to other players, and how to contact us about your data.

Draft last updated: 1 October 2026 · Effective date:

Draft for reviewThe operator details are intentionally empty. Hosting recipients, locations, transfer arrangements and operational retention schedules also need confirmation before this becomes the final published notice. This draft describes the current game implementation and identifies remaining gaps rather than promising controls that are not implemented.

1. Who is responsible

The operator of Elemental Clash at elementclash.io determines how the game uses personal information and is its data controller. “We”, “us” and “our” refer to that operator.

Legal name: Not yet provided
Country: Not yet provided
Postal address: Not yet provided
Privacy contact: [email protected]

2. Information we process

Guest play

Your browser holds a signed guest identifier and nickname. The server uses a temporary guest profile while you play, including the identifier, display name, current activity and connection address. Guest profiles and their live records are held in memory rather than saved as permanent account progression. Guest matches do not save account levels or mastery.

Registered accounts and sign-in

Google: a unique Google account identifier, verified email address and name returned during sign-in. Google sign-in requests the OpenID, email and profile scopes. The game stores the identifier and email, and uses the returned name to initialize your display name.
Discord: a unique Discord user ID, username and display name returned during sign-in. Sign-in requests the identify scope, without access to your email, server membership or private messages. A linked Discord username may also be refreshed for authorized staff account details.
Game account: a separate game account ID, display name, linked provider identifiers, account creation and last activity times, staff role where applicable, privacy preferences, session records, and account changes.

We do not receive your provider password. Provider tokens are used to verify sign-in; the game does not save Google or Discord access or refresh tokens as ongoing account credentials. A game session is represented by a random cookie, with a hashed reference stored on the server.

Gameplay and social features

We process your chosen champion, live movement and actions, match participation and results, and connection latency to run the arena. Registered account records include levels, mastery XP, unlocks, coins, scores, kills, deaths, assists, crowns, damage, playtime, match and session counts, ability statistics, last played champion and best-match records.

Friend requests, accepted friendships and block lists store the relevant game account IDs and timestamps. Presence records include whether you are online, your arena, champion, last activity and latency. Arena chat processes your message, display name, game identifier, role indicators and the time sent.

Connections, security and moderation

Servers receive your IP address and request metadata, such as browser user-agent information. When the public game is delivered through Cloudflare, Cloudflare also processes the connection and forwards the visitor address to our servers. Account records can include your latest IP address and an IP history with first and last observed times, last login time and playtime associated with an address. This helps investigate abuse and apply account or network restrictions.

Moderation and audit records can contain an account or IP restriction, its reason and duration, affected account IDs, the acting staff account and email where available, timestamps, and the values changed. Account login, provider linking and profile changes are also audited. If you email support, we process the address, message and attachments you send to respond to your request.

Creating a guest identity in production also uses Cloudflare Turnstile to detect automated abuse. The browser loads Cloudflare’s challenge script; the server verifies its challenge token and sends your connection IP as part of that verification. Cloudflare processes browser and network signals as described below.

Service statistics

The game measures visits, request counts, errors, rejected requests, transferred data and response times, and aggregates gameplay by champion. Approximate daily visitor counts are calculated from a daily keyed transformation of IP and browser information; persistent statistics contain counters and a compact aggregate rather than a list of visitor addresses. This does not remove the separate IP records used for account security.

3. Why we process it

The following is the intended legal-basis mapping where the GDPR or a comparable law applies. The identified operator must validate it for the final service and document the assessment of its legitimate interests.

Purpose	Information and intended basis
Deliver the game and requested account features	Guest identity, sign-in identity, sessions, live gameplay, saved progress, social actions and chat: necessary to provide the service you request, including performance of the game agreement where applicable.
Protect players and the service	IP and activity records, security checks, restrictions and audit trails: legitimate interests in preventing abuse, maintaining fair play and protecting account access.
Understand and improve the game	Service and champion statistics: legitimate interests in reliability, capacity planning and game balance, subject to a documented assessment and any consent requirements for optional device tracking.
Answer support and rights requests	Contact information, correspondence and relevant account records: respond to your request, meet privacy obligations and establish or defend legal claims where necessary.
Meet a specific legal requirement	Only information required by a law or valid legal request, relying on that obligation.

Provider authorization is not blanket consent for unrelated processing. If a future optional use requires consent, it must be offered separately and be withdrawable. We do not use the current game to sell personal data or deliver targeted advertising.

4. What other people can see

Your display name, game account ID and gameplay activity can be visible in arenas, chat, player profiles and rankings. Public profiles can include sign-in provider type, level, mastery, unlocks, statistics, ranking, last champion and visible staff status. Leaderboards publish names and relevant scores or progression. Friends can see online presence, arena information and last activity.

Your email address, provider identifiers, IP history, session credentials, private block list and moderation audit trail are not displayed as public profile fields. Authorized staff can access account information needed to administer the service.

The Private profile setting restricts detailed profile statistics and progression for ordinary viewers. Your name and public gameplay can still be visible; the setting does not hide you in an arena, erase leaderboard data, or prevent authorized staff access. Blocking limits supported interactions and visibility, including delivered chat, but cannot retrieve copies already seen by someone else. Invisible presence is a staff-only feature.

Other players may copy or screenshot public messages and gameplay. Do not share private or sensitive information in your nickname or arena chat.

5. Cookies and browser storage

The game uses first-party storage for sign-in, guest identity and requested settings. There is no advertising cookie or third-party analytics script in the current client.

Storage	Purpose and duration
Account session cookie	Keeps a registered account signed in for up to 30 days unless you sign out or the session is revoked. The production session is Secure and HttpOnly. It is shared with the restricted `admin.elementclash.io` host so authorized staff can use their verified game account.
Sign-in and popup cookies	Bind an OAuth attempt and its completion to your browser and prevent forged sign-ins. Google, Discord and popup flow cookies last up to 10 minutes and stay on the game host.
Guest token and nickname	Stored locally by the browser. A guest token is valid for up to 30 days; the saved value and nickname may remain until replaced or cleared.
Game preferences	Remember champion choices, controls, audio, graphics, accessibility, chat and connection preferences. These local values have no automatic expiry and remain until changed or cleared.
Security challenge state	Cloudflare Turnstile processes its challenge state and device/network signals when a guest verification is requested. Cloudflare website protection may also use security cookies when those features are enabled. Its own notices explain the relevant security cookies or storage; the game does not treat that processing as advertising consent.
Asset cache	Your browser may cache game artwork, sounds and other files to load the game efficiently, according to browser and server cache rules.

You can remove cookies and local storage in your browser’s site settings. This may sign you out or reset guest identity and preferences. It does not delete a registered account’s server records. Authentication and requested settings are functional storage; any future optional tracking must be assessed and obtain consent when required by local rules. No optional tracking consent is inferred from simply opening the game.

6. Providers and other recipients

Hosting and infrastructure: the providers that host the website, arena servers, account database, network and support mailbox process necessary data to deliver those services. The final provider list and locations must be completed before publication.
Google and Discord: if you choose their sign-in, the provider handles its authorization flow and learns that you are connecting to Elemental Clash. Its own account and privacy rules also apply. See Google’s Privacy Policy and Discord’s Privacy Policy.
Cloudflare DNS and public website delivery: Cloudflare is configured to provide the domain’s authoritative DNS and, when enabled for the public game and its public redirects, the network proxy, content delivery and protection service. DNS processing includes queried domain names and resolver/network information. Proxied website traffic includes your IP address, browser and request metadata, and the content of requests and responses passing through the service, including account session cookies and game or sign-in requests where present. Cloudflare terminates the public HTTPS connection and makes a separate encrypted connection to our server. The administrator, mail and VPN hostnames use DNS without this website proxy, so their application traffic connects directly to our infrastructure. Cloudflare may retain service logs and derive network and security data under its applicable service terms. See Cloudflare’s Privacy Policy. The operator must confirm applicable processing arrangements, locations and retention before finalizing this notice.
Cloudflare Turnstile: the guest verification processes signals such as IP address, browser user-agent, network characteristics, the challenge site key and associated origin for bot detection. Cloudflare acts for the website in providing the check and also processes signals to improve its detection service. See its Turnstile Privacy Addendum. This protection is required for creating a production guest identity.
Discord integrations: if you use the game bot or linked community, Discord handles the interaction. Bot commands can show your linked or public game profile, mastery and rankings, and authorized staff can use supported administrative commands. The integration processes interaction IDs, invoking Discord IDs, command options and audit references; it does not request general access to private messages through game sign-in.
Other players and staff: receive the information described in section 4, according to their role and the feature used.
Legal recipients: information may be disclosed when required by a valid legal obligation, or where lawfully necessary to protect people, investigate abuse or defend a claim.

Optional IP location lookup

The software supports GeoJS to estimate an account address’s country and region. This lookup is disabled in the new production configuration. If enabled, the server sends the IP address to GeoJS and saves the approximate result with the account IP record; it does not request GPS or precise device location. GeoJS uses the Cloudflare network. Its Privacy Policy explains its processing. Enabling this integration requires an updated final notice and a review of necessity, recipients and international transfers.

Optional generated bot chat

The software can generate chat for simulated players through OpenAI’s API. It only runs when the operator enables the feature and supplies an API key. If enabled, up to 12 recent player display names and messages are sent as context, along with simulated participant information. The request does not include your email, IP history or account session token.

The code requests that generated responses not be stored as API application state, but this does not guarantee zero provider retention: separate abuse-monitoring retention may apply. See OpenAI’s API data controls. This optional integration must remain disabled for launch until its necessity, audience, contractual safeguards, retention and required user information have been reviewed.

7. International processing

Google, Discord and infrastructure providers may process data in more than one country. The final hosting locations, relevant recipients and transfer safeguards are still to be confirmed. We do not claim that all data remains in the EU or EEA, or that a particular contractual transfer mechanism is already in place.

Where an international transfer needs legal safeguards, the operator must establish and identify them, such as an applicable adequacy decision or valid contractual safeguards and necessary additional measures. You can ask the privacy contact about recipients and safeguards.

8. How long information is kept

Information	Current retention behaviour
Guest server records	Temporary in-memory records expire about one hour after their last refresh and are also lost on a server restart. Browser token and nickname storage is separate.
Account sessions and OAuth flows	Account sessions expire after 30 days; sign-in and popup flows after 10 minutes. Expired authentication records are periodically removed. Sign-out removes the relevant session.
Arena chat	The arena keeps a rolling history of at most 40 messages in memory and sends up to 20 recent messages to a joining participant. Older messages are displaced; a restart clears this history. The game does not maintain a permanent chat transcript database. Screenshots or support reports can be separate records.
Aggregate service, arena and champion statistics	Hourly service counters, minute-level arena performance buckets and daily champion statistics are pruned after 90 days. This does not erase registered account lifetime statistics.
Discord interaction deduplication	Short records used to prevent repeated command execution expire after 24 hours and are periodically removed. Related staff audit records are separate.
Accounts, progression, social records, IP history and audits	These remain in the account database until changed or explicitly removed. The current implementation has no automatic expiry for inactive accounts, account IP history, persistent moderation or audit records. A final necessity-based review and deletion schedule must be approved before publication.
Infrastructure logs, backups and support correspondence	Exact retention and backup expiry are pending confirmation with the production providers and operator. They are not covered by the game’s 90-day statistics cleanup.

Email support to request account closure or erasure. There is currently no self-service deletion or export button. Signing out, unlinking a provider, changing a profile preference, or an administrator resetting game progress does not itself delete all account data. Necessary records may be retained for an active security issue, legal obligation or claim; we must explain an applicable exception rather than treat it as an unlimited right to retain data.

9. Security

The production service uses HTTPS, protected account cookies, server-side sign-in verification, short-lived sign-in state, request limits, role checks and moderation audit records. Staff dashboard access is additionally restricted to the administrative network. Access is intended to be limited to authorized people who need it for service operation.

No online service can guarantee complete security. Keep your provider account and device secure, sign out on shared devices, and never send a password or session token to support. Contact us if you suspect unauthorized access.

10. Your choices

Play as a guest if you do not want to connect a Google or Discord identity; connection and basic security processing still occurs.
Change your display name and use the Private profile setting in account settings, subject to the game’s change limits.
Disable chat, block supported player interactions, and remove friends or pending requests.
Manage linked providers while keeping at least one available sign-in method, or sign out.
Clear local browser storage to remove guest credentials and saved preferences.
Contact support for access, correction, account deletion, export, an objection or a review of a restriction.

Providing sign-in identity is optional, but it is required to create and recover a registered account. Live connection and gameplay information is necessary to run a multiplayer match. Friend and chat data is processed when you choose those features.

11. Your privacy rights

Depending on applicable law and the reason for processing, you may request access, correction, erasure, a restriction, or a portable copy of qualifying data. You may object to processing based on legitimate interests and withdraw consent for any consent-based use. These rights have conditions and lawful exceptions.

Email [email protected] with your game account ID and request. We may ask for proportionate evidence that the account or information is yours. Do not send passwords or session tokens.

Where the GDPR applies, requests normally receive a response within one month. If complexity requires a permitted extension, we must explain it within that month. You can complain to the relevant data protection authority and seek available legal remedies. The operator’s country and relevant authority will be identified when its details are completed; you may also contact the authority where you live.

More information is available in the European Data Protection Board’s guide to individual rights.

12. Automated checks and decisions

Game rules automatically calculate scores, rewards and rankings, validate actions, rate-limit traffic, filter some names or messages, and enforce active account or IP restrictions. These checks support gameplay and security; we do not use the game to make credit, employment or similar consequential decisions about you.

Staff can review and apply moderation measures. If an automated check or restriction affects you unfairly, contact support with the relevant context and ask for human review. A right that applies to a significant solely automated decision is not waived by these terms or this policy.

13. Children and young players

The intended audience, minimum age and any age or parental-permission controls must be confirmed before this draft is finalized. The current client does not collect a date of birth or implement a parental consent process. A sign-in provider’s age rules do not by themselves establish every permission required for the game.

If you are below the age of majority, review the Terms with a parent or guardian and follow applicable age rules. A parent or guardian can contact support about a child’s information, account access or deletion. Do not send unnecessary sensitive identity documents by email; we will explain any proportionate verification needed.

14. Changes to this policy

We will update this page when the service or its data practices change. The version and effective date will be shown above. Material changes, such as a new purpose, recipient or optional tracking feature, need clear notice before they take effect and consent where required. Accepting game terms is not a substitute for a required privacy choice.

For privacy questions, contact [email protected].