Privacy Policy

This policy explains how Oathblades collects, uses, and protects information when you visit our sites, play the Mini Game arena, read the wiki, or contact us.

Who is responsible for your data

Oathblades is a product of EK-Games, which is the controller of the personal data described here. The quickest way to reach us about anything in this policy is the contact form.

Information we collect

• Account data — your email address, a display name, and the authentication identifiers Supabase needs to sign you in. If you play as a guest we do not create an account — only a short-lived session cookie on your device so you can join a lobby. Guest stats are not saved to the leaderboard.
• Gameplay data — lobby membership, match results, the moves you commit in a round, leaderboard points, and the character you pick.
• Contact messages — the name, email, subject and message you submit, plus your IP address and browser user agent, which we keep to detect and block abuse of the form.
• Rate-limit records — a short-lived count of requests per IP address, used to stop automated abuse of sign-in, sign-up and the contact form.
• Usage analytics — only if you consent, Google Analytics in production, to understand aggregate traffic. Analytics cookies are not set until you allow them.
• Error records — when a page fails we store the error message, the route, and a reference code. These records contain no IP address, no account identifier and no personal data, and they are deleted after 30 days.

Why we are allowed to use it

Under UK and EU data protection law we must have a legal basis for each use. Ours are:

• Performance of a contract — creating and running your account, matchmaking, resolving duels, and maintaining the leaderboard. Without this we cannot provide the service you asked for.
• Consent — Google Analytics. You give it through the cookie banner and you can withdraw it at any time under Cookie settings in the footer, with no effect on anything else.
• Legitimate interests — security logging, rate limits, the contact-form bot check, and the abuse metadata attached to contact messages. Our interest is keeping a free service running and not being overwhelmed by automated traffic; we have weighed that against the limited and short-lived data involved.
• Legal obligation — where we are required to retain or disclose information by law.

How we use information

• Operate the website, wiki, Mini Game, and Steam-related promotions.
• Authenticate users, prevent spam and abuse, and enforce fair play.
• Respond to contact requests and support enquiries.
• Improve gameplay balance, content, and site performance.
• Comply with legal obligations where applicable.

Who processes it for us

We do not sell your personal information and we do not share it for advertising. We rely on the following processors:

• Supabase — database, authentication, and file storage. All account, gameplay and contact records live here.
• Our hosting provider — serves the Next.js application and keeps short-lived request logs.
• Google — analytics only, and only after you consent.

Staff accounts with the editor or owner role can read contact submissions in order to answer them.

Where your data goes

Authentication, database hosting, and analytics may be processed outside the United Kingdom, including in the United States. Where that happens, the transfer must rely on an approved safeguard such as an adequacy decision or Standard Contractual Clauses. The publisher is responsible for confirming which safeguard applies to each provider before launch, and will name it here once confirmed.

Cookies and similar technologies

You can change your choice at any time via Cookie settings in the site footer.

• Necessary — authentication cookies when you sign in, and a short-lived guest session cookie if you play without an account, so you can hold your place in a lobby or match. These cannot be turned off. A small first-party cookie also remembers your consent choice.
• Analytics — optional Google Analytics cookies, set only after you accept analytics. If you choose Necessary only, the analytics script is never loaded.

You can also control cookies through your browser settings. Blocking necessary cookies may prevent sign-in or arena features from working.

How long we keep it

• Session cookies — for the length of your session.
• Consent cookie — one year, then you are asked again.
• Rate-limit records — deleted automatically within a day.
• Error records — deleted automatically after 30 days.
• Contact messages — until your request is handled, and then for up to 24 months as a record of abuse and of what was asked and answered.
• Account and gameplay records — until you delete your account.

What other players can see

Your display name and your leaderboard record are public. Other players see them in lobbies, during matches, and on the leaderboard. Your email address is never shown to other players, and a default display name is generated for you rather than taken from your email.

Your rights

You have the right to:

• Ask for a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased.
• Ask us to restrict how we use it.
• Receive your data in a portable format.
• Object to processing based on our legitimate interests.
• Withdraw your analytics consent at any time.

If you have an email account you can delete it yourself from your account page. Deleting removes your login, your profile, your display name and your leaderboard standing permanently; it cannot be undone. Wiki pages written by staff editors remain published, with no personal data attached. For anything else, use the contact form.

If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority in your own country.

Children

Oathblades is not directed at children under 13, and you must be at least 13 to create an account. If you believe a child under that age has given us personal information, contact us and we will remove it.

Security

We apply safeguards appropriate to a game and community site: access control on every database table, server-side validation of everything you submit, rate limiting, and a content security policy. No method of transmission or storage is perfectly secure, and we do not claim otherwise.

Changes

We may update this policy. The "Last updated" date at the top changes when we do. Continued use of the service after a change means you accept the revised policy.

Contact

Questions about this policy or a request about your data: contact us. Publisher site: ek-games.com.