This notice explains how [NOT CONFIGURED — operator must set this before public launch] handles your personal data when you use Combat Reviews. We are the data controller. If you have a question or want to exercise any of your rights, contact [NOT CONFIGURED — operator must set this before public launch].
What we collect and why
| Category | What | Why | Lawful basis | How long |
|---|---|---|---|---|
| Account | Name, email address, username, password (hashed with bcrypt — never stored in readable form), chosen role. | To create and operate your account. | Contract — we cannot give you an account without it. | Until you delete your account. Deletion is immediate and permanent for your account and personal data. ONE EXCEPTION, stated plainly: discussion you posted stays on the thread it belongs to, re-attributed to "Deleted User" — removing it outright would delete the replies other people wrote underneath it. Your name, handle, photo and every other identifier are severed from it. |
| Sessions & security | A signed session cookie, a session-version counter, sign-in rate-limit counters, and password-reset tokens (stored only as a SHA-256 hash). | To keep you signed in and to detect and slow down attacks on accounts. | Legitimate interests — securing the service. | Sessions expire after 30 days. Reset tokens expire in 30 minutes and are single-use; dead tokens are purged after 7 days. |
| Identity-verification documents | The passport, driving licence, ID card or federation licence you upload when you claim a fighter profile. | Solely to verify that you are who you say you are before we hand you control of a profile. | Consent — you choose to claim a profile. You can withdraw by deleting the claim or your account. | Stored PRIVATELY, never publicly. Deleted from storage immediately once your claim is approved; 14 days after a rejection (an appeal window); 30 days if the claim is abandoned; and immediately if you delete your account. Deletion removes the file itself, not just the database record. |
| Voice recordings and transcripts | Audio you record in the voice-to-profile feature, the transcript of it, and the profile fields extracted from it. | To fill in your fighter profile from what you said. | Consent — you must explicitly agree before recording, and the feature is off unless you use it. | The audio is NOT stored on our servers: it is held in memory for the length of the request and then discarded. Transcripts and extracted fields are shown back to you for confirmation and are not retained unless you save them to your profile. |
| Community content | Forum threads, posts, reactions, and any community activity. | To run the community. | Contract / legitimate interests. | Until you delete it. Deleting your ACCOUNT does not delete posts you have already published: they are kept and re-attributed to "Deleted User", because deleting a thread would take every reply inside it — other people's writing — with it. Reactions, bookmarks and subscriptions are deleted outright. |
| Private messages | The text of direct messages you send, who they were sent to, when they were sent and read, and which conversations you have archived. | To deliver your messages and show you what is unread. | Contract — the feature cannot work otherwise. | Until you delete your account, which deletes the messages you sent. NOT END-TO-END ENCRYPTED: they are stored in our database and, like any other content, are readable by an administrator with database access. Do not send anything you would not put in an email. We do not scan them for advertising and never sell them. |
| Predictions and picks | The fighter you picked in each bout, optionally how you think it ends, when you picked, whether it was correct, your streaks, accuracy and leaderboard position, and any head-to-head battles you enter. (A 1–5 confidence rating was collected previously; the control was removed and nothing new records it. Values on older picks are retained and still shown to you.) | To score your predictions and rank them against other people's. | Contract — this is the core of the service. | Until you delete your account. PUBLIC BY DEFAULT: your picks, accuracy and leaderboard position are visible to anyone under the display name you choose. NO MONEY IS STAKED and no gambling takes place — picks score points only. |
| Location on the community map | An approximate pin you place YOURSELF, a visibility setting, and check-ins you make at a gym or event. We do NOT read your device's GPS, we do not ask for the browser location permission, and we never track you in the background. | To show people and gyms near you on the community map. | Consent — the map is HIDDEN by default and stays hidden until you turn it on. | Until you change your visibility or delete your account. Set visibility back to hidden and the pin stops being published immediately. A pin you place yourself is the point of the design: a precise device location is not collected, so it cannot leak. |
| Follows and favourites | The people you follow, who follows you, and the fighters, events and promotions you favourite. | To build your feed and notify you about what you follow. | Contract / legitimate interests. | Until you unfollow or delete your account. Follower and following counts are public. |
| Blocks | The people you have blocked, and when. | To stop someone contacting you, following you, or appearing in what you read. Required of any app with user-to-user contact. | Legitimate interests — your safety on the platform. | Until you unblock them or either account is deleted. THE PERSON YOU BLOCK IS NEVER TOLD: no notification is sent, nothing appears on their profile, and no public count includes it. Only you can see your own list, and only you can undo it. |
| Notifications | Notifications generated for you, and — only if you turn on push — the subscription your BROWSER issues: an endpoint URL at your browser vendor plus two encryption keys. | To tell you when a fight you follow is resolved or someone replies to you. | Consent for push (your browser asks first, and you may refuse). Legitimate interests for in-app notifications. | Deleted when you disable push, when the browser vendor reports the subscription as expired, or when you delete your account. A push subscription is bound to that one browser and cannot be used to identify you elsewhere. |
| Usage analytics | Aggregate events — pages viewed, predictions made, follows — linked to your account id when you are signed in, and to NO identifier at all when you are not. | To understand which parts of the site are used and what is broken. | Legitimate interests — improving the service. | FIRST-PARTY AND COOKIELESS: stored in our own database, no third-party analytics script, no advertising identifier, nothing written to your device. It is never sold or shared. |
| Moderation and reports | Reports you make or that are made about your content, moderator decisions, and the moderator audit trail (who acted, when, on what). | To keep the community safe and to allow appeals. | Legitimate interests — running a safe platform. | Kept while needed to handle the report and any appeal. |
| Automated content screening | The text of a post, thread title or comment is checked against a fixed set of rules at the moment you submit it. The check runs in memory on our own servers, is not sent anywhere else, and nothing about the check is stored when the content passes. | To stop slurs, incitement against a group, and spam being published. Ordinary swearing is explicitly permitted and is not screened. | Legitimate interests — running a safe platform. | Nothing is retained. A blocked post is never written to the database; you are shown a message and your text stays in the box for you to edit. There is no automated decision-making about you as a person, no profiling, and no consequence to your account from a blocked post. |
| Audit logs | Records of security-relevant actions: sign-ins, password changes, claim decisions, admin actions, and every time a reviewer opens an identity document. | Security, accountability, and being able to tell you who looked at your ID. | Legal obligation and legitimate interests. | Metadata only — never the contents of a document, a transcript, or a password. |
Identity documents
If you claim a fighter profile you may upload an identity document. We treat this as the most sensitive thing you can give us:
- It is stored in private storage. There is no public link to it, ever.
- Only you and our claim reviewers can open it, and every time a reviewer opens it we record who and when.
- It is deleted from storage — the file itself, not just the database row — as soon as your claim is decided: immediately on approval, 14 days after a rejection (so you can appeal), 30 days if you never finish the claim, and immediately if you delete your account.
Who else receives your data
We use the following processors. Those marked not currently used relate to features that are switched off — nothing is sent to them today, but we list them so this notice does not silently become wrong if a feature is enabled.
| Processor | Role | Where | What we send |
|---|---|---|---|
| Render / Vercel | Hosting and application infrastructure | EU / US | Everything the application processes, as its host. |
| PostgreSQL database (managed by our host) | Primary data store | EU / US | Account, community and moderation data. |
| Cloudflare R2 | Private object storage | EU / US | Identity-verification documents (private bucket, never publicly readable). |
| Resend | Transactional email | US | Your email address, to send password-reset links. |
| CARTO / OpenStreetMap | Map tiles for the community map | EU / US | Your IP address and the map area you are looking at — sent by YOUR BROWSER directly to the tile server, as any image request is. We send them nothing about you, and no pin or account id is included.Only when you open the map. Every other page loads no tiles and contacts them not at all. |
| flagcdn.com | Country flag images | US | Your IP address, as with any externally-hosted image. |
| Your browser vendor's push service (Google, Mozilla, Apple or Microsoft) | Delivering push notifications | Global | The notification, to the endpoint YOUR BROWSER issued. Only if you enable push. The message body is encrypted to keys held by your browser, so the push service relays it without being able to read it.We do not choose this processor — your browser does, by issuing the endpoint. |
| Deepgram(not currently used) | Speech-to-text | US | The audio you record in the voice-to-profile feature.The voice feature is currently DISABLED. Nothing is sent to Deepgram unless it is switched on and you use it, having first given consent. |
| OpenAI(not currently used) | Speech-to-text and/or text extraction | US | Your recording and/or its transcript.The voice feature is currently DISABLED. |
| xAI(not currently used) | Text extraction from a transcript | US | The transcript of your recording.The voice feature is currently DISABLED. |
International transfers
Some of these processors are in the United States. Where personal data leaves the UK/EEA we rely on the UK International Data Transfer Addendum / EU Standard Contractual Clauses with the processor concerned. If you want to see the safeguards for a specific processor, ask us at [NOT CONFIGURED — operator must set this before public launch].
Voice recordings
The voice-to-profile feature sends your recording to a third-party speech-to-text provider and the resulting transcript to an AI provider, both in the United States. It is off by default, you must give explicit consent before recording, and we do not store the audio — it is held in memory for the length of the request and then discarded.
Cookies
We set 2 cookies and no others. There is no advertising and no third-party tracking on this site; our product analytics are first-party and cookieless and store nothing on your device, which is why you have not been shown a consent banner: there is nothing optional to consent to. See the cookie policy for the full list.
Your rights
- Access — ask for a copy of your data. Email [NOT CONFIGURED — operator must set this before public launch]; we respond within one month.
- Correction — fix anything wrong, from your account settings or by asking us.
- Deletion — delete your account from your account settings. This removes your data and destroys any identity document you uploaded.
- Objection and restriction — tell us and we will stop, unless we have a legal reason not to.
- Portability — ask us for your data in a portable format.
- Complain — to us first, please. You can also complain to the UK Information Commissioner's Office at ico.org.uk.
We do not currently offer a self-service data export. Email [NOT CONFIGURED — operator must set this before public launch] and we will do it manually within one month, which is what the law requires.
Automated decisions
We do not make decisions about you by automated means alone. Fighter-profile claims are decided by a person, not by software.
Children
Combat Reviews is not intended for children. You must be at least 16 to hold an account. We do not knowingly collect identity documents, voice recordings or media from children — if you believe we have, tell us at [NOT CONFIGURED — operator must set this before public launch] and we will delete it.
Changes
If we change how we handle your data we will update this notice and change the effective date below. This notice describes what the software does today.
Who we are. [NOT CONFIGURED — operator must set this before public launch], [NOT CONFIGURED — operator must set this before public launch].
Governing law: [NOT CONFIGURED — operator must set this before public launch].
Effective from: [NOT CONFIGURED — operator must set this before public launch].
General contact: [NOT CONFIGURED — operator must set this before public launch]