Your privacy

Controller and privacy contact

Assaf Raman is responsible for processing personal information for Anything Arena.

For privacy questions or requests, email privacy@anythingarena.com. You can also use our contact form without an account or write to the postal address above. Please include the complete c/o line and reference 11742 on letters. Contact details are also available in our legal notice. Private report receipts are not currently available in this beta.

Letters sent to this address are received, opened and digitized by Online-Impressum (Clear-Media UG) and made available to us through its online portal so we can handle your request. This includes the sender details and contents of the letter. See the service's privacy information.

Operator and postal contact details updated 13 October 2026.

What information is processed

• Guest play: the website host receives connection information, including your IP address, browser request headers and requested resources, to deliver and secure the website. Your game settings, tutorial progress and local collection are stored on your device. Guest play does not upload them into an account automatically.
• Accounts: email address for Google or email sign-in, verified sign-in provider identifier, an optional player nickname, account and session records, selected weapons, settings and tutorial progress. Google sign-in requests only the openid and email scopes; it does not request your contacts or Google Drive. Roblox sign-in requests only openid and profile: we use your Roblox account identifier and username or display name to sign you in and show your account name. Roblox does not provide us with your email address through these permissions. We do not request access to your inventory, messages or purchases. Authentication credentials are handled by the server.
• AI Forge: your prompt, generated gameplay instructions, generated images, audio or models, job status and ownership records. Please do not include real names, contact details, private documents, passwords or other personal or sensitive information in a prompt.
• Public creations: if you publish a weapon, other people can see its public name, generated description, appearance and playable behavior. The public catalog does not expose your email, account identifier, original prompt, provider credentials or private task records. Removing a publication prevents new public acquisitions; deleting its source creation or account also revokes its shared references.
• Online rooms: your chosen nickname and fighter, selected weapons, readiness, game settings, input and connection status are shared with your room. In Boss Battle, the director's boss description and planned stages are also shared with members of that room. These plans are not published in the public catalog. Room invitations can be forwarded by anyone who receives them. There is no public chat or public real-name directory.
• Security: limited connection and abuse-control information, short-lived authentication records, download and generation budgets, and minimal deletion markers. These controls protect accounts and limit misuse of paid generation and network services.

Required information and optional choices

You choose which features to use. Required below means needed for that feature; you do not need an account or a Forge prompt for local play.

Do not put payment-card details, identity documents or other sensitive information in a game prompt or email request. Any future parent-verification service would have its own notice and secure flow before activation.

Purposes and legal bases

Requested account, save, generation and multiplayer services rely on performing the service agreement where applicable (GDPR Article 6(1)(b)). Any future child-profile processing that requires parental consent would need that authorization before activation (Article 6(1)(a)); an age answer alone would not supply it. Proportionate security and abuse prevention protect users and the service (Article 6(1)(f)). Applicable legal obligations, including handling legally required requests, can rely on Article 6(1)(c). A privacy acknowledgement or Terms acceptance does not authorize advertising, optional tracking or unrestricted reuse of personal data.

Children and parents

The game is designed for families and players aged six and up. Local play is available without an account. Eligibility to open a personal account depends on the current policy and applicable law; this is separate from the game's audience age.

If family account features are enabled in a future version, they would require a supported adult-verification flow, a separate declaration of parental authority and separate choices for online play, AI Forge and publication. An adult check would not itself prove a family relationship or grant child permission. Those features are not available in this beta.

Parent-managed child accounts and parent verification are not available in this beta. For privacy or safety help, email privacy@anythingarena.com.

You or a parent can email privacy@anythingarena.com about child-data or safety concerns. Do not send an identity document or a child's full birth date in the initial message. An email does not automatically prove authority to access or delete an account; we establish the relevant account and authority before acting.

The Roblox version uses separate Roblox accounts, services and parental controls. The website does not sign someone into Roblox or replace Roblox's controls.

Service providers and multiplayer connections

• Cloudflare delivers this website and operates our Workers, database, private artifact storage, room coordination, network relay and security controls.
• Google handles the Google sign-in option only when you choose it.
• Roblox handles the Roblox sign-in option only when you choose it. Your sign-in returns to Anything Arena; your Roblox password is not shared with us.
• Resend sends requested sign-in emails and delivers contact-form messages to our support inbox. It processes the email addresses, message contents and delivery information required for these emails.
• Runware and Roblox provide AI interpretation and generation services. They receive the prompt and generation inputs required for the requested job, not your account email as a prompt field. The providers and models used can differ by the type of output and configured fallback.
• Other room participants receive the room and gameplay information described above. Browser multiplayer uses WebRTC. A direct peer connection can reveal your public network IP address to other participants. If a relay is used, Cloudflare processes the relayed connection traffic. We do not store signaling messages as a public player directory.

These providers can process information in the United States and other countries. Their privacy practices, contractual safeguards and applicable transfer arrangements also matter; we do not promise that every provider deletes every input immediately. Cloudflare's published data-processing agreement includes Standard Contractual Clauses for applicable transfers. Hosting location hints do not guarantee that all processing remains within any particular country or region. Project-specific provider contracts and transfer arrangements still need confirmation; this notice does not claim that an unverified agreement or child-processing configuration is already in place.

Provider information: Cloudflare, Google, Resend, Runware, Roblox.

Storage and retention

Account profiles, cloud choices and owned creations remain available while your account exists, unless you remove them. Sign-in links expire after ten minutes. Server-side account sessions have a seven-day expiry. Scheduled cleanup removes expired sign-in verification records and mail-attempt and authentication rate-limit records older than one day. Generated assets for deleted creations are queued for deletion; cleanup can be asynchronous. These application rules do not establish retention periods for every provider copy or infrastructure recovery version.

Deleting an account removes its active account records and sessions, removes publications and shared references, and queues private generated artifacts for cleanup. Cleanup can be asynchronous. Minimal deletion markers can remain to prevent erased content from returning. Infrastructure recovery versions and copies held by generation providers can outlast deletion from the active database; those windows depend on the provider and service configuration. We do not promise an unverified backup-deletion deadline. Restoring data requires reapplying deletion records before making it available.

Cloudflare database recovery history can retain older versions for up to 30 days. Erased records must stay inaccessible and deletion records must be reapplied before any recovery becomes available. Resend documents 30-day email and delivery-log retention for its listed plans. Runware generated download URLs normally expire after seven days; that does not establish a seven-day deletion deadline for prompts, inputs or logs. Roblox AI data reuse depends on the project's AI Data Sharing setting, which has not been verified for this service. Provider input retention, child-processing terms and transfer details are not assumed from an output URL expiry.

In-site concern reporting is not currently available. Email privacy@anythingarena.com for privacy or safety requests, and include only information needed to understand the concern.

Device-only data is separate. Signing out or deleting an account does not automatically erase the guest collection on every device. See Device data for controls and storage purposes.

Your choices and rights

• Access and portability: use Account → Download my data for a machine-readable export of the account information and creation records we hold. The export excludes secret authentication tokens and provider credentials.
• Correction: update your player nickname in Account. Contact us to correct other account information.
• Deletion: use Account → Delete account. You can also remove an individual creation or unpublish a public listing.
• Other requests: use Report a concern or privacy@anythingarena.com to request access, correction, deletion, restriction or objection, ask about international transfers, report child data, or appoint an authorized representative where applicable. We may ask for proportionate information to establish the relevant account before disclosing or deleting its data.
• Complaints: EU/EEA and UK users can contact their relevant supervisory authority. Applicable US state rights can also be exercised through the same contact. We do not require you to waive mandatory privacy or consumer rights to play.

We aim to respond within the applicable legal deadline, ordinarily one month for GDPR requests or 45 days for applicable US state requests, with permitted extensions explained when needed. Existing signed-in accounts can use self-service export and deletion.

Contact messages

The contact form sends your optional name, reply email and message to privacy@anythingarena.com. No account is needed. Please include only information needed for your request; children should ask a trusted adult for help.

Cloudflare processes the form request and Resend delivers the email. We use these details to handle and reply to the request, based on legitimate interests in providing support, the requested service where applicable, or legal obligations for privacy and other legally required requests. The contact service does not save your message contents in the game database or use them for advertising or AI training. Short-lived pseudonymous counters and retry records limit spam and duplicate delivery; the form creates no browser cookies or saved message history.

Your message remains in the support mailbox as needed to handle the request and any applicable legal obligations. Provider delivery records follow their own retention rules described above. You can request deletion by contacting the same inbox, subject to applicable retention obligations. A successful form response confirms acceptance by the email provider; it does not confirm that a human has read or answered the message.

Security and changes

We use HTTPS, restricted server-side credentials, secure session cookies, ownership checks and bounded service budgets. No service can guarantee perfect security. Policy changes are reflected in the version shown on this page.

Use Report a concern or privacy@anythingarena.com for privacy, child-data, safety or content questions. Do not send unnecessary personal information.

Report a concern

Use our contact form or email privacy@anythingarena.com for privacy, child-safety or content concerns without signing in. If you are a child, ask a trusted adult to help if you can. Do not send passwords, identity documents, private photos or illegal images. The form below is only available when its reporting service is enabled.

In-site reporting is not available in this beta. For questions or privacy requests, email privacy@anythingarena.com.