BLOOD & SAND ← Back to the arena

Privacy

Last updated: October 10, 2026

GigaDuck OÜ (registry code 17501858), Tornimäe tn 5, 10145 Tallinn, Estonia, runs Blood & Sand and is responsible for your personal data. Contact privacy@gigaduck.ai with privacy questions or requests.

What we use and why

You can watch without an account. We process your IP address, browser and request details, viewer presence and crowd actions to deliver and protect the arena. Cloudflare Turnstile checks for bots; we send it your verification token and IP address.

If you sign in with Google or Apple, we receive an account identifier, email address and available profile information. We store your game profile, votes, crowd choices and gold activity to run your account and participation. We never receive your provider password. We also process messages you send us to answer enquiries and privacy requests. Account features need the relevant account and game data; watching does not require these.

We rely on our contract with you for requested account and game features; legitimate interests for operating, securing and improving the service, preventing abuse and answering enquiries; and legal obligations for privacy requests and binding legal demands. Where consent is required, it needs a separate choice. Signing in is not blanket consent.

What others can see

Your citizen name, seal, rank, gold statistics, wagers, gifts and winnings can appear publicly. Your sign-in email and authentication account ID are not shown. A game name can still identify you, and other viewers can record or share gameplay. Votes and crowd displays show collective results, but small totals can reveal individual choices.

Providers and AI

  • Supabase handles authentication and database storage; Cloudflare delivers and protects the website; Hetzner hosts the arena. Email providers handle correspondence.
  • Google and Apple receive technical information when their sign-in interfaces load, before sign-in completes. Google may show a personalised sign-in prompt. Their own privacy notices apply.
  • TypeSafe AI and models reached through OpenRouter control fictional fighters. Fight inputs include crowd effects and gifts, but no citizen names, sign-in emails, authentication account IDs or sign-in tokens. Model providers include OpenAI, Perplexity, Liquid AI, Cloudflare, Microsoft and Nace.AI.
  • Your chosen citizen name is checked for offensive content using OpenAI through OpenRouter, or TypeSafe AI when configured. The name is sent without your other account information.

Cloudflare also uses Turnstile signals as a separate controller to improve bot detection; see its Turnstile Privacy Addendum. We may disclose information where necessary to meet legal obligations or protect legal rights.

The database is configured in the EU and the arena server in the USA; providers may process information elsewhere. Contact our privacy address for information about international processing and applicable safeguards.

Browser storage and audience counts

We use local storage for sign-in, sound and display preferences, and remembering tips and announcements already shown or dismissed. Session storage remembers entry to the arena in this tab, reload recovery, actions started before sign-in and unconfirmed gold transactions. Preferences and notice records remain until replaced or cleared; session storage normally lasts for the tab, including possible browser restoration. Sign-in storage is subject to sign-out and expiry. Cloudflare security checks can also use cookies and storage, including within the Turnstile challenge frame.

We show promotions for our other projects, with links that open their websites. These links include campaign tags, but no account or device identifiers; the destination website's privacy notice applies when you visit it. We do not sell your personal data or set advertising or analytics cookies. We do count audience actions and button use to improve the show, without storing account, IP or device identifiers alongside those counts. Requests still expose connection information to our infrastructure. Global Privacy Control or Do Not Track stops page-control counts, but not server-observed counts. Small totals can sometimes identify activity.

Keeping and deleting information

Account and participation records have no automatic age-based expiry. Use “Delete account” or email us to request deletion. This removes linked account, citizen and participation records. We retain a hashed provider identifier and limited grant and gift records to prevent repeated claims and bypassing gift limits, plus balancing records without your name or account ID. These retained records currently have no automatic expiry.

Live connection state ends when the connection closes. Detailed audience totals are removed after about 90 days; match summaries have no scheduled expiry. Logs, messages, AI/provider records and backups are handled separately and are not all erased immediately by account deletion. Necessary legal records, fictional match history and truly anonymous statistics may remain. Signing out or clearing browser storage does not delete your account.

Your choices and rights

Email privacy@gigaduck.ai to request access, correction, deletion, restriction or portability, or to object to processing based on legitimate interests. You can withdraw consent where processing relies on it. These rights have legal conditions and exceptions; we may need to verify your identity. GDPR requests are normally answered within one month, with notice of any permitted extension. You can complain to the Estonian Data Protection Inspectorate or your local data-protection authority.

The service is for adults aged 18 or over, subject to a higher local minimum. Contact us if a child has supplied personal data. We will date revisions and provide notice or request consent for material changes where required.