Privacy Policy

What we collect

Only what the site actually needs to work. Specifically:

• Account — name, username, email address and a hashed password. Passwords are hashed, never stored in a readable form.
• Date of birth — used once, to check you are old enough to hold an account. It is not shown on your profile.
• Referrer — if you named a member who referred you, we store the link between the two accounts.
• Profile — anything you choose to add: display name, bio, location, website, avatar, banner, linked accounts.
• Comments and submissions — what you write, and the IP address it came from.
• Newsletter — your email address, when you confirmed, and where you signed up.
• Two-factor — an encrypted secret and hashed recovery codes, if you enable it.

Why we keep an IP address

Comments and newsletter signups record the originating IP. It is used for abuse handling only — working out whether a wave of spam is one person — and it is never displayed anywhere on the site.

Analytics

If analytics is enabled on this installation it is Google Analytics, which sets its own cookies. See the cookie policy for what those are. We do not sell or share your personal data with advertisers.

Third parties

• Email delivery — confirmation and notification emails are sent through a delivery provider, which necessarily sees the recipient address.
• Human verification — the sign-up and comment forms may use Redeyed Sentinel, which receives your IP address to judge whether a submission is automated.
• Fighter and event data — licensed from a third-party provider. That is data about athletes, not about you.
• Social sign-in — only if you choose to link an account. We store the provider's account id, your handle and avatar. We do not post on your behalf.

Cookies

We set a session cookie so you stay logged in, and a CSRF cookie that protects forms from being submitted from other sites. Details on the cookie policy.

How long we keep it

• Account data — until you delete your account.
• Published articles and comments — indefinitely, because they are part of the public record of the site. Deleting your account removes your name from them.
• Newsletter — until you unsubscribe. Unsubscribing keeps a record that you did, so we do not accidentally re-add you.

Your rights

You can see and change most of your data from your profile at any time, and delete your account there too. You can also ask us for a copy of what we hold, ask us to correct it, or ask us to erase it. Email [email protected] and we will respond within 30 days.

Every newsletter has a one-click unsubscribe link, and the unsubscribe works without logging in.

Children

Accounts are for people aged 13 and over. We ask for a date of birth at registration, check it, and never show it on your profile. If you believe a child under 13 has created an account, tell us and we will remove it.

Security

Passwords are hashed, two-factor secrets and OAuth tokens are encrypted at rest, and the site is served over HTTPS. No system is perfect — if you find a security problem, please report it to [email protected] before disclosing it publicly.

Changes

If we change what we collect or why, we will update this page and the effective date at the top.