WHAT WE KEEP

PRIVACY POLICY · THE WHOLE LIST, NOT A SUMMARY

LAST UPDATED 2026-08-05

Everything we store about you is listed below. All of it. It fits on one screen.

01 — THE WHOLE LIST

USERNAME What you chose. No real name required, and we don't check.
PASSWORD Stored hashed — never the password itself. We cannot read it, recover it, or tell you what it was. If you lose it, it gets reset, not looked up.
EMAIL Required when creating an account, to prove the address is yours and reset your password. Never for marketing; there is no newsletter. Accounts from before email existed don't have one until they choose to add it.
TIER Which access level the account has, and when it last changed. During the pilot everyone is a member. The field exists so a future paid tier doesn't need a rebuild. We also keep when you last logged in.
AGE The date you confirmed you're of legal age, recorded once when the account was created.
CORNER PASSES Invite codes: which pass created your account, and what your own passes were used for. If you delete your account, passes you handed out stop pointing at you.
RESET & VERIFY LINKS The short-lived links we mail for verification and password resets. Stored scrambled, dead after one use, and cleaned up within days.
SECURITY LOG A record of account events: sign-ups, verifications, password resets. Kept 90 days. No IP addresses in it.
SESSION A random identifier in a cookie so the site knows it's still you. Expires after 7 days.
FIRST VISIT A single date recording that you've been shown the introduction, so we don't show it to you twice.
ACTIVITY The last page you opened, when you were last seen, and a count of requests. Kept current rather than kept as a history.
PAGE VISITS When you last opened a given fight card. It powers the "what's changed since your last visit" markers. Deleted after 30 days.
IP ADDRESS Used briefly to limit repeated failed logins, and recorded in standard web server logs the way every website does. Not stored against your account.

THAT IS EVERYTHING.

02 — WHAT'S NOT IN IT

  • No marketing use of your email. Verification and reset mail only, and only when you trigger it. No newsletter, no announcements, no "we miss you".
  • No bets. We never see what you actually wagered, where, or how much.
  • No third-party trackers. No Google Analytics, no ad pixels, no social buttons phoning home.
  • No data broker, ever. We do not sell, rent or trade any of it. There is no version of this site where that changes.

03 — ANALYTICS

We measure traffic ourselves rather than handing it to an analytics company. It records which page was viewed, where the visit came from, an approximate country and a rough device type, and sets no advertising cookies. When you're signed in, a pageview is associated with your username so we can tell whether members come back after a card. It is not shared with anyone.

04 — MAIL

Verification and reset mail is handed to a delivery service to send. That is the one third party that sees your address, along with the message itself, and nothing else. We don't run our own mail servers because self-hosted mail lands in spam, and the reset link has to actually arrive.

05 — COOKIES

One cookie. It keeps you signed in, is sent over an encrypted connection, cannot be read by scripts in your browser, and expires after 7 days. There are no advertising or cross-site cookies here, which is why there's no consent banner nagging you.

06 — HOW LONG WE KEEP IT

  • Sessions: 7 days, then expired and pruned.
  • Page visits: automatically deleted after 30 days.
  • Reset & verify links: dead after one use, or within a day at most; the scrambled remains are cleaned up within 7 days.
  • Security log: 90 days.
  • Account, email + activity row: until you ask us to delete the account.

07 — WHAT YOU CAN ASK FOR

  • Delete my account. The account and everything listed above is removed: actually deleted, not switched off. Passes you handed out stop pointing at you; accounts they created stay theirs.
  • Log me out everywhere. Every session invalidated immediately.

Ask at contact@cagestank.com.

08 — KEEPING IT SAFE, HONESTLY

Account data is held on servers we operate, reachable only over an encrypted connection. Passwords are hashed, backups are encrypted, and the code handling all of it has been audited.

WE ARE A SMALL OPERATION, NOT A BANK. WE'VE DONE THE OBVIOUS THINGS PROPERLY, BUT NOBODY CAN PROMISE A BREACH IS IMPOSSIBLE. DON'T REUSE A PASSWORD THAT MATTERS — HERE OR ANYWHERE.

If we ever did suffer a breach affecting accounts, we'd say so on the site, quickly, with what happened.

09 — CHANGES

If what we store changes, this page changes in the same release, and the date at the top moves. This document is meant to describe the software exactly — if it ever doesn't, the software is right and this page is a bug worth reporting.