Privacy Policy

Who is responsible

Madoros, business registration number 218-21-71514, registered in the Republic of Korea, is the controller of the personal data described here.

The person accountable for personal data protection is Ma Joonyoung, reachable at legal@favefight.com. Use the same address for any request about your data.

What we collect and why

Account data. If you sign in with Google we receive your email address, display name and profile image. We use them to show who owns a bracket and to let you back into your own brackets. They are kept until you ask us to delete your account, after which they are removed.

Play records. Every finished play stores a hashed IP address, a random token held in your browser, the bracket and round played, the winner, and the time between picks. These exist to stop one person from voting hundreds of times and to detect automated play. The IP address itself is never stored — only an irreversible hash, which we cannot turn back into an address.

Choice records. Each pick is stored as a pair of numbers: which option was shown against which, and which one won. These carry no name, image or account reference and cannot be traced back to a person. They are the source of every ranking on the site and are kept permanently.

Bracket content. Titles, descriptions, candidate names, notes and images that creators upload are stored so the bracket can be played.

Reports. When you report a bracket we store which bracket it was, the reason you picked, and a hashed IP address. The hash lets us stop one person from flooding the moderation queue and limits how many reports a single source can file in a day. As with play records, the IP address itself is never stored — only an irreversible hash. Reports carry no free-text field, so nothing you write about yourself or anyone else can end up in them.

How long we keep it

Account data is kept while the account exists. Bracket content is kept until the bracket is deleted. Anonymous choice records are kept permanently, because rankings are built from them and they cannot be recollected after the fact.

Play records and reports, both of which include a hashed IP address, are currently kept for as long as the record itself exists — we do not yet run a scheduled purge. We are working toward a fixed retention period for these records and will state it here once it is in place.

Cookies and similar storage

A session cookie keeps you signed in after you use Google sign-in. It is required for the account features to work at all.

Your browser also holds a random token for each bracket you play, stored in local storage. It is not a site-wide identifier and does not follow you between brackets — a deliberate choice, because a single permanent identifier would collect far more than duplicate defence requires.

Google AdSense and Google Analytics set their own cookies to measure traffic and to select advertising. You can control personalised advertising at https://adssettings.google.com and read Google's own description of how it uses this data at https://policies.google.com/technologies/partner-sites.

Who else processes it, and where

Running the service means the data described above is processed outside the Republic of Korea. This happens continuously over the internet, as part of serving each request, for as long as you use the service.

Cloudflare, Inc. (United States and its global edge network) hosts the application and stores uploaded images. Neon, Inc. (United States) hosts the database holding accounts, brackets and play records. Google LLC (United States) provides sign-in, advertising and analytics, and receives the data those features require.

We do not sell personal data, and we do not share it with anyone else except where the law requires it.

What happens when a bracket is deleted

Deleting a bracket does four things. It stops being reachable, so its play page, ranking page and share links all return not-found. Uploaded images are deleted from storage. Candidate names and notes are cleared from the database. And the win-loss records stay.

The records that stay are anonymised in the strict sense: what remains is a set of numbers recording that one option beat another, with no name, image, account or device information attached, so they cannot be connected back to a person or to the deleted content.

Deletion is permanent. We keep no copy that would let us restore a deleted bracket.

Your rights

You can ask to see the personal data we hold about you, to correct it, to delete it, or to stop us processing it. You can withdraw consent to sign-in data at any time by asking us to delete your account.

Send any of these requests to legal@favefight.com. We will answer within the period required by law. If you believe we have handled your data improperly, you may also complain to your national data protection authority; in the Republic of Korea that is the Personal Information Protection Commission.

Children

Fave Fight is not intended for children under 14 and we do not knowingly collect their personal data. If you believe a child under 14 has used the service, write to legal@favefight.com and we will delete what we hold.

Security

Data is transmitted over encrypted connections and stored with the access controls our hosting providers offer. IP addresses are hashed before storage rather than kept in the clear. No service can promise perfect security, but we do not collect data we do not need.

Changes

When this policy changes, the revision date at the top of the page changes with it. Material changes to what we collect or who receives it will be announced on the site before they take effect.

Contact

Data protection contact: Ma Joonyoung, Madoros — legal@favefight.com