Privacy Policy

Ocaso Arena (“we”, “us”) is operated from New Zealand. This policy explains what personal information we collect, why, and your rights under the NZ Privacy Act 2020 and equivalent regimes (UK GDPR, EU GDPR, CCPA) where they apply.

What we collect

• Account — email address, display name, optional alias, optional favourite team.
• Activity — predictions you submit, leagues you join, leaderboard standings.
• Device & session — IP address (for security and rate-limiting), browser type, push-notification token if you enable notifications, timezone.

Why we collect it

• To operate the prediction sandbox you signed up for.
• To secure your account against fraud and abuse.
• To notify you about matches and league activity (only if you opt in).
• To improve the product, using aggregated and anonymised data only.

Lawful basis

Performance of contract (running your account) and legitimate interest (security, anti-abuse). Push notifications and any future analytics require your explicit consent.

Who processes your data

• Lovable Cloud — managed backend hosting (database, authentication, storage).
• Cloudflare — edge runtime and DDoS protection.
• Email delivery — transactional email for sign-in links and notifications.

Retention

We keep your account and predictions for as long as the account exists. When you delete your account, identifiable data is removed within 30 days; aggregated, anonymised leaderboard history may be retained.

Your rights

• Access — request a copy of your personal data.
• Rectify — correct anything that’s wrong.
• Erase — delete your account and personal data.
• Port — export your data in a machine-readable format.
• Object — withdraw consent for notifications or analytics at any time.

Use the “Your data” tab in your Profile, or email privacy@ocaso.app.

Children

Ocaso Arena is not directed at children under 13. We do not knowingly collect data from anyone under 13.

Changes

We’ll update the “last updated” date and, for material changes, re-prompt for consent.