Privacy Policy

Colossal Arena("the Game", "we", "us") is a free browser-based multiplayer survival game operated by the Colossal Arena team. For the purposes of the EU/UK General Data Protection Regulation, we are the data controller for the personal data described below. You can reach us at any time at support@colossalarena.com, or through the Contact Us panel on our home page.

We only collect what the Game needs in order to work. Specifically:

• Account data - the email address and password you sign up with, and the username you choose. Authentication is handled by Google Firebase Authentication; your password is stored and verified by Firebase and is never visible to us.
• Profile and progression data - your character classes, levels, statistics, in-game gold, inventory, gear, emblems, cosmetic colour choices, quest progress, house layout, match history, leaderboard entries, friends list and friend requests.
• Gameplay and connection data - the inputs your client sends to our game servers, your chosen server region, session times and similar telemetry needed to run the multiplayer simulation and to detect cheating or abuse.
• Communications you send - in-game chat messages, bug reports (which may include an automatic snapshot of your current run) and messages you submit through the Contact Us form, including any name and email address you enter there.
• Technical data - IP address, browser type and version, device and screen information, and error logs. This is processed by our hosting and infrastructure providers as a normal part of serving an internet application.

We do not knowingly collect special-category data (health, biometrics, political or religious views), we do not run advertising networks, and we do not sell personal data.

• To provide the Game- creating your account, saving your progress, matching you with other players, showing leaderboards and chat. Legal basis: performance of our contract with you (our Terms & Conditions).
• To keep the Game safe and fair - detecting cheating, exploits, spam and abusive behaviour, and enforcing our Terms. Legal basis: our legitimate interests in protecting the service and our players.
• To fix problems and improve the Game - investigating bug reports, crashes and performance issues. Legal basis: legitimate interests.
• To respond to you - answering messages you send us through Contact Us or by email. Legal basis: legitimate interests, and performance of our contract where the message concerns your account.
• To comply with the law - where we must retain or disclose information to meet a legal obligation or respond to a valid legal request. Legal basis: legal obligation.

We do not use advertising or cross-site tracking cookies. The Game stores a small amount of data in your browser's local storage and in cookies set by Firebase Authentication, purely so that you stay signed in and so that your client-side settings (such as graphics and audio preferences) persist between sessions. Clearing this data will sign you out but will not delete your account or your progress, which are stored server-side.

Video trailers on our home page are embedded from YouTube using its privacy-enhanced player. YouTube may still set cookies or collect device information when you press play; that processing is governed by Google's own privacy policy.

We do not sell, rent or trade your personal data. We share it only with service providers who process it on our behalf, and only as far as they need to:

• Google Firebase (Authentication, Cloud Firestore) - account credentials, profile, progression, chat persistence, bug reports and contact messages.
• Our hosting and game-server providers - serving the website and running the real-time multiplayer servers, including the technical data described above.
• YouTube / Google - only if you play an embedded trailer.

We may also disclose information where we are legally required to do so, where it is necessary to investigate a violation of our Terms, to protect the rights or safety of our players, or in connection with a merger, acquisition or sale of assets (in which case we will tell you before your data becomes subject to a different privacy policy).

Please remember that some information is public by design: your username, your leaderboard placements, your published house and anything you type in public chat are visible to other players. Do not share personal information you would not want other players to see.

Our providers operate globally, so your data may be stored or processed in countries outside your own, including the United States. Where data leaves the EEA or the UK, our providers rely on recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Account, profile and progression data are kept for as long as your account exists, so that you do not lose your progress. Chat messages, bug reports and contact messages are kept only as long as they are useful for moderation, support and troubleshooting, and are deleted or anonymised after that. Technical logs are typically kept for a short period measured in weeks. If you ask us to delete your account, we will remove your personal data within 30 days, except where we are required to keep something to comply with the law or to resolve a dispute.

Traffic between your browser and our servers is encrypted in transit. Access to the databases behind the Game is restricted to the small number of people who need it to operate the service, and administrative tools (such as the bug report and contact viewers) are limited to accounts we explicitly mark as administrators. The Game is authoritative server-side, which also limits what a compromised client can do.

No online service can promise perfect security. If we become aware of a breach that affects your personal data, we will notify you and the relevant supervisory authority where the law requires it.

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access - ask for a copy of the data we hold about you.
• Correction - ask us to fix data that is wrong or incomplete.
• Deletion - ask us to delete your account and associated data.
• Portability - receive your data in a machine-readable format.
• Objection and restriction - object to processing we base on legitimate interests, or ask us to pause it.
• Withdraw consent - where we rely on consent, withdraw it at any time.

Californian residents additionally have the right to know what personal information we collect and how we use it, to request deletion or correction, and to opt out of the "sale" or "sharing" of personal information - we do not sell or share personal information as those terms are defined by the CCPA/CPRA. We will never discriminate against you for exercising a privacy right.

To exercise any of these rights, email support@colossalarena.com or use the Contact Us panel. We may need to verify that the request comes from the account holder. If you are in the EEA or the UK and you are unhappy with our response, you have the right to complain to your local data protection authority.

The Game is not directed at children under 13, and you must be at least 13 years old to create an account. Where you are in the EEA and under the age at which your country allows children to consent to online services (between 13 and 16 depending on the country), you may only use the Game with the permission of a parent or guardian. If we learn that we have collected personal data from a child below the applicable age, we will delete the account and the data. Parents and guardians can contact us at support@colossalarena.com.

We may update this policy as the Game evolves. When we do, we will change the "last updated" date at the top of this page, and for significant changes we will give notice in the Game before the change takes effect. Continuing to play after a change means you accept the updated policy.