Privacy policy

Personal data operator

The operator of the personal data processed when you use battlr is Alexander Igorevich Zimin, taxpayer ID (INN) 753615500773. For questions about personal data processing, contact spreadlex@gmail.com.

What data we process

Depending on how you use battlr, we may process the following categories of data:

• Account data: email, username, password hash, optional first and last name, profile picture (a link to it), role and ban details if there ever was a ban.
• Google sign-in data: your Google account ID and email. The name from your Google profile is only used to suggest a username and is not stored.
• Public battler profile and user content: battler name, bio, avatar and cover (links to images), stats and rating, the texts of posts, comments, battle answers and reports, likes and subscriptions.
• Push notification data: technical identifiers of the browser or device subscription, if you turned notifications on.
• Yandex Metrica analytics data — only if you gave consent in the cookie banner: on-site behaviour (page views, clicks, time on page) tied to the Metrica client ID, plus in-service actions (such as registration, sign-in, creating a battle, answering, voting, liking) that the server reports to Metrica under the same ID.
• Technical error data (Sentry): details of the failure, the page address, browser and device type, plus recordings of some sessions for diagnostics. Page text and entered data are masked in those recordings.
• Necessary cookies and data in browser storage — they are listed under “Cookies and analytics”.
• Voting data: which answer you voted for, plus an irreversible hash of your IP address (for IPv6, a hash of the /64 network) computed with a secret key. The address itself is not stored with the vote. The hash is used to spot vote manipulation; during such a check a moderator sees the usernames of those who voted from one address. Each vote also keeps a note of whether the voter followed a participant and whether they registered before the battle started: it decides whether the vote affects rating. If you almost always vote for the same battler, a moderator reviewing the battle sees your username and how often you picked that battler in battles they took part in.
• Support requests: topic, text, reply email, the address of the page the request was sent from, app version, interface language and browser details.
• Server technical logs: IP address, request time and address, browser details.
• Traffic statistics in our own Umami service on our servers: the address of the page viewed without parameters, the referrer, the page title, device type, browser, operating system, language, screen resolution and approximate location (country, region, city) derived from the IP address, plus actions in the service without their content (for example, sign-up, sign-in, a vote, creating a battle). The IP address itself is not stored: visits within one day are linked by a de-identified identifier computed from the IP address and browser details. No cookies are used for this. Separately, the server counts page views per day by device type (phone or computer) without any identifiers.

Purposes of processing

• Registration, authentication and keeping your account running.
• Providing the service features: publishing content, battles, voting, rating, subscriptions, notifications.
• Content moderation and protecting users from spam, insults and prohibited content.
• Improving the service: usage analysis, error diagnostics and fixes.
• Answering support requests and personal data requests.
• Protecting against vote manipulation, abuse and attacks on the service.
• Website traffic statistics.

Legal basis for processing

Account, profile and user content data are processed on the basis of the consent to personal data processing you give when registering, and to perform the service agreement whose terms are set out in the community rules and this policy. Analytics (Yandex Metrica) only on the basis of separate consent in the cookie banner. Traffic statistics are kept for statistical purposes subject to mandatory de-identification (Article 6(1)(9) of the Federal Law on Personal Data). You send a support request voluntarily, giving an email for the reply. Technical logs, error diagnostics and protection against vote manipulation are needed for the service to work and stay secure.

Cookies and analytics

Necessary cookies are used without separate consent: refresh_token keeps you signed in; anonymous_session lets a guest vote in tutorial battles; NEXT_LOCALE stores the interface language; battlr_returning marks that someone has signed in on this device (so the home page opens the feed straight away); battlr_seed is a random number from 0 to 255 that sets the order of answers in battles; battlr_cookie_consent stores your analytics choice; battlr_document_update_dismissed marks that you closed the notice about updated documents. In browser storage the site keeps technical settings: a signed-in hint, the colour theme, navigation history for the Back button, and a note that you closed the install-app prompt. Analytics cookies — Yandex Metrica’s and metrica_client_id, which links your in-service actions to the Metrica ID — are used only with your explicit consent, asked for by a banner on your first visit; the Yandex Metrica script is not loaded before consent. If you decline or withdraw consent, the link to the Metrica ID is removed, and Metrica cookies already saved can be deleted in your browser settings. Your choice is kept for 12 months, after which the banner will appear again; you can change it any time below.

Sharing data with third parties

For the service to work, some data is processed or received by: Google — when you sign in with Google, to confirm your identity; Yandex — Yandex Metrica, only with your consent; Sentry — error diagnostics; your browser’s push notification services (for example Google, Mozilla, Apple) — delivering notifications if you turned them on; the email service that sends our emails (email verification, password reset, support replies). Google, Sentry and the push notification services are located abroad, so this is a cross-border transfer of personal data; by using the relevant features you consent to it. Hosting, the database and backups are located in Russia; the archive of traffic statistics is kept in Selectel cloud storage in Russia. Traffic statistics are processed on our servers; third parties receive only aggregate figures (for example, the number of visitors per day) that cannot identify anyone. The “I am not a robot” check and the automatic checks of texts and images run on our own servers, without passing data to third parties. Profile and cover pictures given as links are loaded by your browser from the sites where they are hosted.

Retention periods

Account data is kept while the account exists. When you delete the account in your profile settings, we immediately delete your email, name, avatar, battler profile, subscriptions, push subscriptions, sign-in methods and your support requests, and your votes in ongoing battles are withdrawn. Comments, answers and votes in finished battles stay anonymised — without your name, avatar or profile link. Other support requests are kept for no more than a year. Server technical logs are overwritten automatically as they accumulate. Database backups are kept for up to 7 days — within that time deleted data disappears from them too. Detailed traffic statistics are kept in the database for 12 months (their backups for up to 28 days), then moved to an archive in cloud storage in Russia and kept there indefinitely. Daily aggregate traffic figures — the number of visitors and page views — are kept indefinitely. The log of moderator actions is kept as long as it is needed to resolve disputes and prevent abuse. Analytics and diagnostics data is kept for the period set by the respective service (Yandex Metrica, Sentry) and no longer than reasonably necessary for the purposes of processing.

Your rights

• Find out what data about you is processed and get a copy — write to us through the “Report a problem” form (topic “Personal data”) or by email. We reply within 10 working days.
• Change your account and profile data — in profile settings; if something cannot be changed there, write to us.
• Withdraw your consent to personal data processing and have the data deleted — with the account deletion feature in profile settings or by an email request.
• Withdraw consent to analytics cookies — in the “Cookies and analytics” section of this page or by writing to us by email.
• Complain to the authority protecting the rights of personal data subjects (Roskomnadzor) if you believe your rights have been violated.

Data protection

We apply generally accepted technical and organisational measures to protect data: encrypted connections (HTTPS), storing passwords as irreversible hashes, hashing IP addresses with a secret key, role-based access to data.

Changes to this policy

We may update this policy. The version in force is always available on this page, and the date it took effect is shown at the top of the document. We give notice of significant changes at least 7 days in advance — with a notice on the site or an email to the account address. By continuing to use battlr after a new version takes effect, you accept it; if you do not agree, you can delete your account in profile settings. If the changes extend the processing of your personal data — new data, purposes or recipients — we will ask for your separate consent and will not carry out such processing without it.

Contacts

Questions about personal data processing, requests to access or delete your data — write to us at: