Privacy Policy

1. Data Controller

Yael Brinkert — 23 rue de Bâle, 68440 Zimmersheim, France
Email: [email protected]

2. Data We Collect

We collect the following personal data when you use Royal Arena:

• Account data (Discord OAuth): Discord user ID, username, avatar, and email address (if provided by Discord).
• Epic Games account (optional, user-initiated): Epic account ID and display name. If you authorise it, we also store the Epic authorisation credentials that let Royal Arena read your competitive data on your behalf — an Epic device authorisation and refresh token. These are encrypted at rest, are used only to retrieve your own Fortnite data (such as your tournament and scrim history), and are never shared with third parties. You can remove them at any time by unlinking your Epic account or deleting your Royal Arena account.
• Uploaded replay files: Fortnite .replay files submitted for coaching analysis, stored temporarily on Cloudflare R2.
• Coaching session data: Notes you provide with your submission, and the delivered coaching video.
• Token balance & transaction history: Number of tokens purchased and used, timestamps.
• Subscription data: Your current plan (Free, Platinum, Platinum+ or Organization), its status, billing interval and renewal date, plus a Stripe customer reference used to match payment events to your account. Managed entirely through Stripe; retained while your account exists.
• Payment data: Processed exclusively by Stripe. Royal Arena does not receive or store your card number. We receive a confirmation of payment and the email address to which Stripe sends the receipt.
• Usage data: Pages visited, actions performed, anonymised analytics via Umami (self-hosted, no cross-site tracking).
• Authentication tokens: JWT access and refresh tokens stored in your browser's localStorage for session management.

3. Purpose & Legal Basis

4. Data Retention

• Account data: Retained for as long as your account is active. Deleted upon account deletion request.
• Replay files: Deleted from Cloudflare R2 once the coaching video is delivered and confirmed accessible.
• Coaching videos: Stored on Cloudflare R2 and accessible in your dashboard. Deleted upon account deletion or on request.
• Transaction records: Retained for 10 years as required by French accounting law (Article L123-22 du Code de commerce).
• Authentication tokens: Refresh tokens expire after 30 days; access tokens after 60 minutes.
• Epic authorisation credentials: Kept for as long as your Epic account stays linked, and deleted when you unlink it or delete your account.

5. Data Storage & Hosting

• Database & application server: Hosted on Hostinger VPS (61 Lordou Vironos Street, 6023 Larnaca, Cyprus).
• Replay files & coaching videos: Stored on Cloudflare R2 object storage (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Data transfers to the USA are covered by Cloudflare's Standard Contractual Clauses.
• Payment processing: Stripe, Inc. (510 Townsend St., San Francisco, CA 94103, USA). Stripe's processing is covered by appropriate data transfer mechanisms.

6. Third-Party Services

• Discord: Used for authentication. Discord's privacy policy applies to their platform: discord.com/privacy.
• Epic Games (optional): Used for linking your Fortnite account. Epic's privacy policy applies: epicgames.com.
• Stripe: Handles all payment processing, including recurring subscription billing and the customer portal (cancellation, card changes). We receive only payment confirmations, subscription status events and your email. stripe.com/privacy.
• Google AdSense: May use cookies to serve contextual ads. You can opt out via Google Ad Settings.
• Umami Analytics: Self-hosted, privacy-friendly analytics. No cross-site tracking, no personal data sent to third parties.
• api-fortnite.com: Used for Fortnite competitive data (display names, tournament results). No personal account credentials are shared.

7. Cookies & Local Storage

• LocalStorage: Used to store your session tokens (JWT) and user preferences. This is required for the service to function.
• Cookies: Used by Google AdSense for ad serving. No advertising cookies are set by Royal Arena directly. In the EEA, UK and Switzerland you choose whether to allow them when you first visit, and you can change or withdraw that choice at any time via Cookie settings in the footer of every page.
• We do not use tracking cookies for profiling or retargeting purposes.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — obtain a copy of your data.
• Right to rectification — correct inaccurate data.
• Right to erasure — request deletion of your account and associated data (subject to legal retention obligations).
• Right to restriction — request that processing be limited in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interest.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés).

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include HTTPS encryption, JWT authentication with short-lived access tokens, encryption at rest of Epic authorisation credentials (AES-256-GCM), and access controls on our infrastructure. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified on the site. The date at the top of this page reflects the latest revision.