Last updated: May 2026
arena is a lightweight tournament hosting tool. We built it to be simple — no accounts, no tracking, no nonsense. This policy explains what limited information we collect and why.
What we collect
arena does not require you to create an account. The information we handle is minimal:
Player and host names — entered by you when creating or joining a game night. These are stored in our database to run the tournament.
Tournament data — game type, date, location link, scores, and bracket information you enter during the game night.
Anonymous device identifier — a cookie-based identifier used solely to prevent abuse (rate limiting game night creation to 2 per device per 24 hours). It is not linked to any personal identity.
Technical data — IP addresses, browser and device metadata, and server logs collected automatically by our infrastructure providers (Vercel and Supabase) as part of normal operations.
What we don't collect
We do not collect:
Email addresses or phone numbers
Passwords or authentication credentials
Payment or financial information
Location data from your device
Browsing history or cross-site tracking data
How we use it
The data we collect is used only to:
Display player lists, scores, and standings during a game night
Enforce rate limits and prevent abuse
Operate and maintain the arena service
We do not sell your data, use it for advertising, or share it with third parties beyond what is described below.
Third-party services
arena is built on two infrastructure providers. By using arena, your data passes through these services:
Supabase — our database and real-time infrastructure. Tournament data (names, scores, brackets) is stored in Supabase-hosted Postgres. See supabase.com/privacy.
Vercel — our hosting provider. Handles request routing, serverless functions, and logs. See vercel.com/legal/privacy-policy.
Data retention
Game night data is retained until the tournament expires or is manually cleared. Tournaments automatically expire based on arena's lifecycle rules — abandoned or completed tournaments are marked expired and removed from the active system within hours of their conclusion.
We do not have a formal deletion request process at this stage, but if you'd like data removed you can contact us at the address below and we'll handle it manually.
Security
We take reasonable steps to protect data — including encrypted connections (HTTPS), environment-isolated credentials, and server-side API keys that are never exposed to the browser.
That said, arena is an indie product and we cannot guarantee absolute security. Do not enter sensitive personal information beyond what the product requires (a first name is fine; your full legal name is not necessary).
Updates to this policy
We may update this policy as the product evolves. If we make meaningful changes, we'll update the "Last updated" date above. Continued use of arena after changes constitutes acceptance of the updated policy.
Contact
Questions or requests? Reach us at hello@mazestation.com.