Privacy policy

Who is responsible for your data

Kokoda Awakened is the data controller for this site. It's run by a small team of volunteer admins, not a registered company. For anything privacy-related — access, corrections, deletion, or questions about this policy — email rubexeeuu@gmail.com.

What we collect

• Account data — username, email address, and password (stored hashed by our auth provider, Supabase; we never see it in plain text). If you sign up with Google, we receive the email address and name Google shares with us instead of setting a password.
• Tournament activity — match results, placements, points, and suggestion-box submissions you make while using the site.
• Security logs — IP address and timestamps for registration, login attempts, password changes, and suggestion submissions, used to enforce rate limits and detect abuse (see Security & retention below).
• Cookies & local storage — session cookies to keep you logged in, and a local-storage flag remembering whether you dismissed the cookie banner. See the cookie section of our legal notice for details.

Why we process it, and on what legal basis

• Running your account and tournaments (username, email, match history) — necessary to perform the service you signed up for.
• Security and abuse prevention (IP address, rate-limit and security-event logs, CAPTCHA) — our legitimate interest in keeping accounts and results honest and the service available.
• Non-essential cookies, if any are ever added — only with your consent via the cookie banner.

Who we share it with

We don't sell or rent your data. It's processed by the infrastructure providers that run the site, acting as our processors:

• Supabase — database, auth, and where account/tournament data is stored.
• Vercel — hosting for the site itself.
• Google — only if you choose “Sign in with Google,” to authenticate you.
• Cloudflare (Turnstile) — bot protection on login/register, when enabled.

These providers may process data on servers outside the European Economic Area (e.g. the United States), under their own standard contractual safeguards. We don't control where they host, but we only use providers that publish GDPR-compliant data processing terms.

Security & retention

Access to the database is restricted by row-level security, so only you (and admins, for moderation) can see your own account details. We keep account and tournament data for as long as your account exists. Security/rate-limit logs are kept only as long as needed to detect abuse patterns, then periodically cleared. If you delete your account, we remove your profile, account data, and associated logs within 30 days, except where we're required to keep something longer (e.g. to investigate active abuse).

Your rights

If GDPR applies to you, you have the right to access, correct, delete, restrict, or export your data, and to object to how we process it. To exercise any of these, email rubexeeuu@gmail.com — we'll respond within one month. If you're unhappy with how we've handled your data, you can also complain to your local data protection authority (in Spain, the AEPD).

Minimum age

Kokoda Awakened is not intended for anyone under 16. By registering, you confirm you're at least 16 years old.

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page. Continued use of the site after a change means you accept the update.