Privacy Policy
AutoArena · last updated 26 October 2026
AutoArena is a browser game. This page explains exactly what it stores about you, why, and how to get rid of it. It is written to be read, not to be survived.
You can play without giving us anything
Opening the game creates a guest account automatically. It has no name, no email and no link to you as a person — just a random id. You only hand over personal information if you choose to save your account.
What we store
| Always | A random account id and account number, your in-game display name, your trophies, wins, losses, XP, level, coins, gems, unlocked minis and heroes, your saved deck, your game settings, and the dates you created the account and last played. |
|---|---|
| Match history | The result of each match, the rounds won and lost, your deck and hero, and your opponent's display name. We use this to run the ladder and to balance the game. |
| Device | A random device id generated in your browser, plus your browser's user-agent string. This exists so we can tell one install from another and spot a single person farming many accounts. |
| Activity | A short log of what you do in the game: where you arrived from (just the site's name, such as bing.com), which screens you open, how far you get through the tutorial, joining and leaving the queue, and any error the game hits. It is tied to your account number, kept for 90 days and then deleted, and shared with no one. We use it to see where new players get stuck. |
| Friends | The players you add as friends, the players who add you, and when. A friend is someone you have both added: friends can see whether you are online, looking for a match or in one, and when you were last here. Someone you have only sent a request to, or who has only sent one to you, sees none of that. Friendly matches between friends are recorded like any match, with your result, deck and hero. |
| Feedback | Anything you type into the Feedback box on the menu, with your player name and account number and your browser's name, so we can tell a phone's bug from a desktop's. It is read by the people who make the game, shared with no one, and kept until we have acted on it. |
| If you save your account | Your email address and a password hash. We never store your actual password — it is hashed with scrypt and cannot be reversed. |
| If you use Google Sign-In | Your Google account id, your email address, and your Google display name and picture if you have them. We never receive your Google password, and we ask Google for nothing beyond basic profile and email. |
| If you buy something | A record of what was bought, when, and the transaction id from the payment provider. Card details never touch our servers. |
Cookies and browser storage
We use no advertising cookies, no analytics cookies and no third-party trackers. We store exactly two kinds of thing:
aa_tokencookie — the login token for your account. It is set by our server, marked HttpOnly and Secure so scripts cannot read it, and lasts up to 400 days. Without it you would be logged out and lose a guest account every time your browser cleared its storage.- Local storage — the same login token, your device id, and a local copy of your profile and settings so the game loads instantly.
Both are strictly necessary to keep you signed in. Clearing them signs you out, and if you have not saved your account, the guest account is gone for good.
Who else sees it
We do not sell your data, share it for advertising, or hand it to data brokers. It is seen only by:
- Amazon Web Services, who host the game and its database in Sydney, Australia.
- Google, but only if you choose Google Sign-In, and only to confirm the sign-in is genuine.
- Anyone playing the game, who can see your display name, account number, trophies and ladder position. Your email address is never shown to other players.
- Your friends, who can also see whether you are online and when you last played. Remove a friend and they stop seeing it at once.
Where it lives and how long
Your data is stored in Australia and kept while your account exists. Delete your account and we delete the personal parts — email, password hash, Google id, device records. Match results may be kept in a form that is no longer linked to you, for game balance. The activity log is deleted after 90 days, whatever happens to your account.
Your choices
- Play anonymously — never save an account, and we never learn who you are.
- See or correct your data — email us and we will send you a copy or fix it.
- Delete everything — email us from your account's email address and we will erase it.
- Unlink Google — set a password from the account sheet, then remove the Google link.
If you are in the UK, EU or another place with data protection law, those rights apply to you and we will honour them regardless of where we are.
Children
AutoArena is not aimed at children under 13, and we do not knowingly keep data from them. If you believe a child has created an account, email us and we will remove it.
Changes
If this policy changes in a way that matters, we will update the date above and say so in the game.
Contact
Questions, corrections or deletion requests: matt@autoarena.gg.
← Back to AutoArena