Privacy

Who is responsible

• The controller is [legal name], based in [country]. Privacy requests, removals and complaints: @elton_ani on X.

The short version

• Your IP address is never stored. Where the site needs to tell one visitor from another it stores a one-way hash of it, salted — enough to count you once, not enough to get the address back.
• There is no analytics service, no advertising network and no tracking pixel. The visitor counter is ours and lives in our own database.
• Logos and flags are fetched by our server, not by your browser: the sites that host them never learn that you were here.

What is collected

• Presence. A hash of your address, the two-letter country code the CDN already derived, and when you were first and last seen. It powers “N online” — online means a heartbeat in the last 5 minutes.
• Answers to the questions. The question, the option you picked, a hash of your address, the time, and — for answers given from now on — the country and half your address (“82.59”). Never the whole one.
• Votes in the arena. The match, the product, your account id and the country. Voting a match needs an account; answering a question does not.
• Clicks on outbound links. The product, the time and a session hash made from your address and browser with a salt that changes daily — so the same click is not counted twice, and the trail does not survive the day.
• What you submit. The address, name, tagline and category of a product you put in the arena, and the account that submitted it.
• Payments. Card details never reach us: they go to the payment processor named at checkout. We keep which plan is active and the subscription id it gave us.

Cookies and what your browser keeps

• outfight_gate — set when you type the site password. It holds a hash of the password, not the password, is http-only so scripts cannot read it, and lasts 30 days. Strictly necessary: without it the site closes again at every page.
• of_notices_seen — remembers which notifications you have already seen, so the badge does not keep counting the same ones.
• of_poll_votes — kept in local storage, lists the questions you answered so already-answered cards do not flash before the server replies. It is never the source of truth: the server decides.
• If you sign in, the authentication cookies of our database provider. No advertising cookies, ever.

Why

• To provide what you asked for — showing the arena, registering a vote, running a plan you paid for.
• To keep it fair — one vote per person, rate limits, click counts that mean something. This is the reason the hashes exist at all.
• Because the law says so — accounting records for payments.

What is public

• Answers to the pre-launch questions appear on who voted: country, half the address, the answer and when. Do not answer if you would rather that were not visible.
• Products in the arena, their record, their matches and their click counts are public, and search engines can index them.
• The visitor roster shows short hashes and countries. No addresses, no names.

Who else sees it

• Our database and authentication provider and our host, which run the site and derive the country code from your address at the edge.
• The payment processor, for checkout — it, not us, handles the card.
• Nobody else. Nothing is sold, and there is no advertising partner. Some of these providers are outside the European Union, and rely on the standard contractual clauses for that transfer.

How long

• Presence and answers stay while the site is up: the counter of who came before the opening is the point of them.
• Click hashes are only useful within the day their salt belongs to.
• Payment records stay as long as accounting law requires.

Your rights

• You can ask for access, correction, deletion, a copy, or object to a use — write to @elton_ani on X.
• Be aware of what we can and cannot find: a hashed address cannot be searched backwards from an address. If you tell us the country, the day and roughly when, we can usually find the row; without something to match, we honestly cannot.
• A product you submitted comes off on request, with no verification asked of you.
• You can complain to your national data protection authority.

Children

• The site is for adults. We do not knowingly collect data from children.

Changes

• When the site changes, this page changes with it and the date at the top moves. It describes what the code actually does — if you find a gap between the two, tell us and the gap is the bug.