Privacy Policy
AutoArena · last updated 15 November 2026
AutoArena is a browser game. This page explains exactly what it stores about you, why, and how to get rid of it. It is written to be read, not to be survived. AutoArena is run by Sydney Quant Pty Ltd, an Australian company, and "we" on this page means Sydney Quant Pty Ltd.
You can play without giving us anything
Opening the game creates a guest account automatically. It has no name, no email and no link to you as a person — just a random id. You only hand over personal information if you choose to save your account.
What we store
| Always | A random account id and account number, your in-game display name, your trophies, wins, losses, XP, level, coins, gems, unlocked minis and heroes, your saved deck, your game settings, and the dates you created the account and last played. |
|---|---|
| Match history | The result of each match, the rounds won and lost, your deck and hero, the armies both sides fielded each round, what they wore, and your opponent's display name. We use this to run the ladder, to balance the game, to show you your own record with each mini and hero, and to let you watch your recent matches again from your Profile. Only you and your opponent can watch a match there. |
| Daily puzzle | If you play the daily puzzle: how many attempts you took, your time, and when you solved it. Anyone playing can see your display name, time, attempts and solve time on that day's board. Each day starts a new puzzle and a new board. |
| Device | A random device id generated in your browser, plus your browser's user-agent string. This exists so we can tell one install from another and spot a single person farming many accounts. |
| Activity | A short log of what you do in the game: where you arrived from (just the site's name, such as bing.com), the size of your browser window and whether you play by touch or with a mouse, which screens you open, how far you get through the tutorial and what you press and where you drop a mini while it waits for you, joining and leaving the queue, sharing your invite link or a replay, whether you turn notifications on and which ones we send you, starting and solving the daily puzzle, and any error the game hits. It is tied to your account number, kept for 90 days and then deleted, and shared with no one. We use it to see where new players get stuck. |
| Page counts | How many times each page of this site was opened through a link from an AI assistant such as ChatGPT, counted per day: the assistant's name, the page and a number. It is not tied to you or your account, and is kept for 120 days. |
| Friends | The players you add as friends, the players who add you, and when. A friend is someone you have both added: friends can see whether you are online, looking for a match or in one, and when you were last here. Someone you have only sent a request to, or who has only sent one to you, sees none of that. Friendly matches between friends are recorded like any match, with your result, deck and hero. |
| Replays you share | If you share a replay of a match, after it or from your Match history, we keep that match so the link can play it: every round's armies, both players' display names, trophies, decks, heroes and skins, the score and the date. Anyone with the link can watch it, without an account, and we count how often it is opened. The link carries your account number, as an invite does. It shows your opponent's side too, exactly as they played it. It is kept while your account exists and deleted with it. A match nobody shares is never made into a replay. |
| Invites | If you open the game from a friend's invite link, your account keeps which account the link belonged to, so that account can be given its reward once you have played a match. Your friend learns that someone from their link played. They are not told who. An invite link carries only your account number. |
| If you turn on notifications | The address your browser's push service gave us for this device and the keys to encrypt messages to it, and when we last sent you one. That service belongs to your browser's maker: Google for Chrome and most Android browsers, Apple for Safari and every iPhone browser, Mozilla for Firefox, Microsoft for Edge. Messages pass through it encrypted, so it delivers them without being able to read them. We send at most one a day, and never while you are playing. Turn them off in Settings and we delete the address. If the service tells us the address is gone, we delete it too. |
| Feedback | Anything you type into the Feedback box on the menu, with your player name and account number and your browser's name, so we can tell a phone's bug from a desktop's. It is read by the people who make the game, shared with no one, and kept until we have acted on it. |
| If you save your account | Your email address and a password hash. We never store your actual password — it is hashed with scrypt and cannot be reversed. |
| If you use Google Sign-In | Your Google account id, your email address, and your Google display name and picture if you have them. We never receive your Google password, and we ask Google for nothing beyond basic profile and email. |
| If you win prize money | The prize money you have won and still hold, in US dollars, and each withdrawal: the amount, when you asked for it, where it went (the Solana address or PayPal email you gave), and the payment's reference (a Solana transaction, or PayPal's). We may look through your matches before a withdrawal is sent, to check it was won fairly. |
| If you buy something | A record of what was bought, when, and the transaction id from the payment provider. Card details never touch our servers. |
Cookies and browser storage
We use no advertising cookies, no analytics cookies and no third-party trackers. We store exactly three kinds of thing:
aa_tokencookie — the login token for your account. It is set by our server, marked HttpOnly and Secure so scripts cannot read it, and lasts up to 400 days. Without it you would be logged out and lose a guest account every time your browser cleared its storage.- Local storage — the same login token, your device id, a local copy of your profile and settings so the game loads instantly, the invite link you arrived with until your account is made, and how many times we have offered you notifications.
- A service worker — a small script your browser keeps for this site. It lets you add the game to your home screen, shows a short page if you open it with no connection, and shows notifications if you turn them on. It stores nothing about you.
The cookie and the login token are strictly necessary to keep you signed in. Clearing them signs you out, and if you have not saved your account, the guest account is gone for good.
Who else sees it
We do not sell your data, share it for advertising, or hand it to data brokers. It is seen only by:
- Amazon Web Services, who host the game and its database in Sydney, Australia.
- Google, but only if you choose Google Sign-In, and only to confirm the sign-in is genuine.
- Your browser's push service (Google, Apple, Mozilla or Microsoft), but only if you turn notifications on. It carries each notification to your device encrypted, and cannot read it.
- Microsoft, who carry our own email, but only when you withdraw prize money: we email ourselves your display name, account number, email address and the amount, so we know to send it.
- PayPal, but only when you cash prize money out to PayPal: the email address you give and the amount, so it can pay that account.
- The Solana network, but only when you cash prize money out in USDT: the address you give and the amount go to a Solana node, and the transfer is recorded on Solana's public ledger, where anyone can see it move from our wallet to that address. Nothing on it names you: its note says only that it is an AutoArena prize, with the payout's number.
- Anyone playing the game, who can see your display name, account number, trophies and ladder position, and your time on a daily puzzle you solved. Your email address is never shown to other players.
- Anyone with the link to a replay of a match you played, whether you or your opponent shared it: your display name, trophies, deck, hero, skins and every army you fielded in it.
- Your friends, who can also see whether you are online and when you last played. Remove a friend and they stop seeing it at once.
Where it lives and how long
Your data is stored in Australia and kept while your account exists. Delete your account and we delete the personal parts — email, password hash, Google id, device records. Match results may be kept in a form that is no longer linked to you, for game balance. The activity log is deleted after 90 days, whatever happens to your account. A record of prize money paid out (the amount, when, and to which address or email) is kept for as long as the law asks us to keep payment records.
Your choices
- Play anonymously — never save an account, and we never learn who you are.
- See or correct your data — email us and we will send you a copy or fix it.
- Delete everything — email us from your account's email address and we will erase it.
- Unlink Google — set a password from the account sheet, then remove the Google link.
If you are in the UK, EU or another place with data protection law, those rights apply to you and we will honour them regardless of where we are.
Children
AutoArena is not aimed at children under 13, and we do not knowingly keep data from them. If you believe a child has created an account, email us and we will remove it.
Changes
If this policy changes in a way that matters, we will update the date above and say so in the game.
Contact
Questions, corrections or deletion requests: matt@autoarena.gg.
← Back to AutoArena