Privacy policy

The short version

• We collect what the site needs to work: your account if you make one, what you do here (votes, posts, cards), and statistics about visits.
• We don't sell your data, and there are no ads.
• Your email address and your visits' locations are never shown to other players.
• We never store your IP address.
• Email us at animalbattlestats@gmail.com and we'll delete your account or send you a copy of your data.

What we collect

When you visit (everyone)

• The pages you view, the site that sent you (without its query string), your screen size and language, and your device type, browser and operating system. These are worked out from your browser's user agent, which we don't store.
• Your approximate location (city, region, country), which our host Vercel works out from your IP address. We don't store your IP address. To count returning visitors we store a scrambled code (a keyed hash) made from your IP address, browser and language, and your username if you're signed in. It can't be turned back into your IP address.
• How long a visit lasted and how many pages it took, using a random id for each visit. The id is kept in your browser's session storage and is gone when you close the tab.
• If you're signed in, your visits are recorded under your username. While you're on the site, we note which page you're on, for up to 2 minutes, to show who's online.
• Google Analytics also counts visits and the pages viewed (see Who else gets it).

When you make an account

• Your username, display name and email address, and your password, which is stored only as a bcrypt hash. Nobody, including us, can read it.
• Sign in with Google: your Google account id and email address. We never get your Google password.
• Sign in with Roblox or connect Roblox: your Roblox user id, username and display name. Roblox doesn't share your email or password with us.
• When you joined and when you last logged in, and your recent username changes.

What you do here

• Your votes, fight calls, tournament picks, comments and chat messages, and your XP, level, BattlePoints, cards, quests, looks and Season Pass progress.

If you connect the Roblox game

• We read your save from the game, read only: trainer level, animals, team, trophies, island progress, Weekly Cup, Sky Trail and Photo Safari results, login streak, when you started, whether you're in a server now and when you last played, and your game wallet (Coins and Wild Tracks). We read it when you or someone else opens your profile or collection (at most once a minute for you, and once every 30 minutes for others). Nothing in the game is ever changed.

How we use it

• To run your account and the site's features: votes, Versus, tournaments, cards, rewards, leaderboards and profiles.
• To keep the site safe and fair: rate limits, moderation, and stopping cheating and spam.
• To understand what people use and enjoy, so we can make the site better.
• To send account emails (verifying your email, resetting your password). Notification emails go out only if you turn them on; they're all off by default.

What other people can see

• Your profile: username, display name, profile animal, level, XP, prestige, title and frame, the year you joined, and your cards. Leaderboards also show BattlePoints.
• Your posts: comments and chat messages, with your name. If you post as Anonymous, other players don't see your name, but moderators can.
• Online now: while you're signed in, your name and the page you're on can appear in the list of who's online.
• Roblox: if you connect Roblox, your game progress shows on your profile. Your Coins and Wild Tracks don't show, and neither does whether you're playing right now. Your Roblox name shows only if you turn on "Show my Roblox name". Your Roblox avatar and user id are never shown.
• The world map on the Community page shows numbers of visits by city, with device types, never names.
• Never public: your email, your password, how you sign in, and where your visits come from.

Who else gets it

We don't sell your data and don't share it for advertising. These services help run the site:

We may also share information if the law requires it, or to protect players and the site. These services may process data in the United States and other countries.

Cookies and storage

• abs_auth_token keeps you signed in for 7 days. It's HttpOnly, so page scripts can't read it.
• abs_google_oauth_state and abs_roblox_oauth last 10 minutes, only while you sign in with Google or Roblox.
• Google Analytics cookies (_ga and _ga_…) count visits.
• Browser storage (not sent to us unless noted): your sound setting, guest votes waiting to be counted once you log in (up to 36 hours), matchups you've already seen on Vote, your tournament setup and best streak, and guests' show progress. Session storage holds the current visit's id, which is sent with page views.

You can block or clear cookies in your browser. If you block the sign-in cookie, you can't stay signed in.

How long we keep it

• Your account and what you've done on it: until you ask us to delete the account.
• Visit and activity records: kept for the site's statistics until we delete them. Ask us and we'll delete yours.
• Who's online: 2 minutes. Sign-in and rate-limit counters: up to 2 hours. Tournament entries: up to 8 days after the tournament.
• Deleted posts: a deleted comment leaves the site, but our activity log keeps its text. A deleted chat message is hidden from everyone but kept in our database.

Your choices

• Change your username and display name on your profile.
• Turn email notifications on or off at any time (they start off). Every notification email has an unsubscribe link.
• Unlink Google (once your account has a password), or disconnect Roblox at any time. Cards you got from the game stay in your collection.
• Hide or show your Roblox name on your public profile.
• Delete your own comments and chat messages.
• Get a copy of your data, correct it, or delete your account: email animalbattlestats@gmail.com from your account's email address, or message us on Discord so we can check it's you. We'll answer within 30 days.

Depending on where you live (for example the EU, the UK or California), you may have more rights over your data, such as objecting to how it's used or complaining to a data protection authority. Email us and we'll help.

Children

Accounts are for people 13 and older (see the terms). Anyone can browse, compare animals and vote as a guest without one. We don't knowingly let children under 13 create accounts. If you're a parent or guardian and think your child has made one, email animalbattlestats@gmail.com and we'll delete it.

Security

The site uses HTTPS everywhere. Passwords are stored only as bcrypt hashes. The sign-in cookie can't be read by page scripts, IP addresses are never stored, and sign-in attempts are rate limited. No system is perfect, so use a password you don't use anywhere else.

Changes and contact

If this policy changes, we'll update this page and the date at the top. For anything about your data, email animalbattlestats@gmail.com or message us on Discord.