Privacy
ArenaPulse shows public World of Warcraft PvP data. This page says what the site stores, who else sees it, how long it is kept, and how to have it removed.
What the site stores about characters
Ladder rows, ratings, wins and losses, achievements, talents and gear come from Blizzard's public API for every character that appears on a rated ladder or that someone looks up. Rating history is kept for the current and past seasons; per-event history older than a year is rolled up into weekly points. A character name and realm can identify a person, so this data is treated as personal data even though Blizzard publishes it. The basis for holding it is legitimate interest: a public ladder is already public, and a site that makes it readable does not add to what the game shows. The streams page also ties stream channels to characters: either the streamer proved the channel and chose the characters, or the site listed the channel itself, with characters that public PvP profiles name as the streamer's or that were picked by hand. Any listing is taken down on request, by writing to the address below, and stays down.
Alt detection, and how to stop it
Characters are linked as alts when they share a large set of account-wide achievement timestamps. This is an inference from public data, not an account lookup, and it creates new information: it ties several characters to one player. Anyone can ask for their own characters to be unlinked, whether or not they have an account, by writing to the contact address below and naming them.
Accounts
Signing in with Battle.net is open for two things: the card packs and adding stream channels to the streams page. An account stores the Battle.net id and battletag, the characters on that Battle.net account (read again at every sign-in), the card packs it opened, the cards it has and which of them it shows, its game deck, duels and rating, the stream channels it added, a verification code while a channel is being proved, and which of its characters it shows with its streams. The cards an account shows appear on the profiles of its characters, until it turns that off on the cards page. Only the characters the account holder ticks are shown next to their stream. Deleting the account deletes all of it except its channels' names, their ids on each platform and when they were taken down, kept so they are not listed again. The rest of the site works without signing in and stores nothing about a reader.
Cookies and local storage
Nothing is stored on the device until the reader asks for something that needs it. There is no advertising, no analytics and no third-party script of any kind. Choosing a theme, a region or a language sets theme, ap_region or ap_lang for a year. Voting on a news item sets ap_voter for 180 days, so one machine casts one vote. The browser also keeps recent searches in local storage, which never leave the device. Signing in sets ap_oauth_state for the ten minutes the Battle.net round trip takes, then a session cookie (ap_session) and a form token (ap_csrf) for 30 days; signing out removes them. All of these are needed for a function the reader asked for, which is why the site shows no cookie banner: there is nothing here that consent would apply to.
Who else sees anything
News pictures are served by Wowhead's image host (wow.zamimg.com), so loading the home page or the news page tells them the reader's IP address and browser. Signing in redirects to Battle.net, which then knows about the visit. On the streams page the pictures of live streams are fetched by this server, so viewing the page tells the platforms nothing; pressing play loads that platform's own player (Twitch, YouTube or Kick), which then knows about the visit and may set its own cookies. Live status comes from the platforms' own APIs and can be a few minutes behind; the YouTube part uses YouTube API Services, under Google's privacy policy (policies.google.com/privacy). Nothing else on the site calls a third party. The server runs on Contabo hardware in Lauterbourg, France, and the database and backups stay there.
How long things are kept
Expired sessions are deleted nightly. Per-event rating history older than a year is rolled up. Database backups are kept for a few days. Everything attached to an account goes when the account is deleted; reports sent through the report form are kept while the matter they describe is open. A stream channel taken down, by its streamer (directly or by deleting the account) or on request, leaves behind only its name, its id on that platform, who took it down and when, kept with no end date so that it is not listed again.
Rights and contact
Anyone can ask what the site holds about them, ask for it to be corrected or deleted, object to the alt linking, or ask for a copy. Write to the address below and say which characters or account the request is about. A request is answered within a month. The Spanish data protection authority (AEPD, www.aepd.es) takes complaints about how this is handled.
For any of the above, write to contact@arenapulse.es.