YOUR DATA
Privacy policy
What OctaGOAT processes when you browse, play or create an account.
Last updated:
Who is responsible?
The operator described in the Legal notice is responsible for the personal data used by OctaGOAT. For privacy questions or to exercise your rights, use the contact form.
Information we use and why
You can play without an account. If you register, we store your email address, public username, password hash, registration date and account activity dates. Passwords are not stored in plain text. We use these details to provide sign-in, your profile and your results history. The legal basis is performance of the service agreement.
Necessary session, connection and security information helps run the game, protect forms and accounts, and prevent spam or fraud. These uses rely on our legitimate interest in operating a reliable service. Authentication and email requests are rate-limited.
When you contact us, we store the name, email address, subject and message you provide, together with any replies, to handle your enquiry and its follow-up. This generally relies on our legitimate interest in responding; an account request or legal obligation may instead rely on the service agreement or that obligation. Contact correspondence is handled separately from your account, so account deletion does not automatically delete a support exchange. Contact us to request its erasure where applicable.
Optional audience measurement relies on your consent. Refusing it does not prevent you from playing or using an account. We do not sell your personal data.
Current and abandoned careers
The server temporarily holds your active career and its rules to calculate and validate your choices. Leaving or reloading Play abandons the run. Its temporary record is deleted when that request arrives. If the browser cannot send it, the run expires after 24 hours without an action and is removed during scheduled cleanup. Only aggregate counters remain for abandoned careers, without a result card or fight history.
Public profiles, results and statistics
Each completed career receives a public result link, including guest careers. We keep a career summary: game ID, start and completion dates, chosen fighter and division, record, score, abilities, title reigns, title defences, peak rank, best win streak and legacy distinction. We do not keep a permanent fight-by-fight history.
A result belongs to your account if you were signed in when starting the career. Your username, profile, registration and last-visit dates, statistics and recent activity are public. Your email address and password are never displayed. Anyone with a result link can view the card; other people may copy or share it.
Season leaderboards show up to 30 verified players, with one best eligible career per player. A season closes at its configured end time in UTC. Its final ranking is then retained as a historical snapshot, including the public username, rank and career summary recorded at the deadline.
General and daily statistics keep aggregate counts of visitors, registrations, deletions, career starts, completions, abandonments and titles. These totals remain after account deletion. A career that reaches the title counts once in the “titles won” total, even if it wins the belt more than once.
Account deletion and retention
Account information and personal statistics are kept while your account remains active. Completed career summaries and public result links are retained for game history and sharing while the service operates.
You can delete your account from Account settings. This removes your account, profile, personal statistics and account tokens, and abandons any active career. Existing result cards remain accessible without your username or account association. Your entry disappears from an ongoing season's live leaderboard, freeing the place for another player.
Closed-season exception: final seasonal leaderboards retain the public username, rank and career summary saved at the deadline, even after account deletion. The name no longer links to a profile. We retain this limited public record to preserve the integrity of historical rankings, based on our legitimate interest. You may contact us to object to this processing or request erasure of a particular entry, subject to applicable rights and circumstances.
After voluntary deletion, only your email address and deletion date are kept in a separate anti-abuse record to enforce a seven-day registration waiting period. Expired records are removed during account maintenance or on successful registration with the same email address. The end of the waiting period does not itself trigger immediate erasure. This record contains no password, game history or restorable account. A new account never restores previous data.
After three years without signing in or using an authenticated session, we send an email giving 15 days' notice before deleting the account and personal statistics. Signing in before deletion cancels it; playing a game is not required. For an account that has never signed in, inactivity is measured from registration. Inactivity tracking records are erased with the account. Deletion for inactivity does not impose the voluntary-deletion waiting period.
Activation links expire after 24 hours; password-reset and email-change links expire after one hour. Expired tokens are removed during account maintenance. Contact correspondence and security records are retained only as needed for their purpose, follow-up or an applicable legal obligation. You can ask us about a specific record. Copies already downloaded or shared elsewhere cannot be recalled by us.
Audience measurement and Google Analytics
With your permission, first-party visit and online-activity counters use a random browser-session identifier. These records contain no name, email address or IP address and are not linked to an account or career. A visible tab sends presence signals periodically; a session is counted as online for five minutes after its last signal. Stale presence records are cleared during normal use.
The daily visitor count derives a different key for each UTC day. During presence processing, only today's and yesterday's keys are retained; older keys are removed. Aggregate totals remain. This measurement is separate from Google Analytics and stops when you refuse optional cookies.
We plan to use Google Analytics 4 to understand page visits and browser or device usage. It is not enabled in this version. Once enabled, it will run only after you accept optional analytics cookies. Refusing or withdrawing consent will prevent further Analytics collection from this site. The cookie information will be updated and a new choice requested when this provider is enabled.
Google Analytics uses cookies and processes usage and device information. Details of the applicable settings and retention will be published here before activation. See How Google uses information from sites or apps that use its services. When enabled, we will not intentionally send account identifiers, usernames, emails, contact messages or private activation and recovery links to Analytics.
No third-party advertising script is currently loaded by the site. Any future advertising integration and its partners will be described before activation and will require a separate consent choice where applicable.
Hosting, email and external services
We use IONOS for hosting and email services. Account emails concern activation, password recovery, security and account management. The host and email provider may process connection information, including IP address, request time and browser details, to deliver and protect the service.
Cloudflare Turnstile protects the contact form against automated abuse. When that form is loaded or used, Cloudflare may process technical information about your browser, connection and IP address to perform the check. See the Turnstile Privacy Notice.
Private information is accessible to the operator and providers needed to supply or protect the service, or where disclosure is legally required. Some providers, including Cloudflare and Google when Analytics is enabled, may process data outside the European Economic Area. Their privacy notices describe their international processing and transfer safeguards. Contact us for information about the providers involved.
X and Ko-fi apply their own terms and privacy policies when you follow their links. Any voluntary support payment is handled by Ko-fi and its payment providers.
Your rights
Depending on the legal basis and circumstances, you may request access, correction, deletion, restriction or a portable copy of your personal data. You may object to processing based on legitimate interests and withdraw consent for processing that relies on it, without affecting the lawfulness of earlier processing.
Use the contact form to make a request. We may need to verify your identity before disclosing or changing account information. Requests are normally answered within one month; we will explain any lawful extension. You may also complain to the French data protection authority, the CNIL, or the competent authority in your country.
Children and teenagers
The game is open to a general audience and does not request a date of birth. Where applicable law requires parental involvement for an account or optional processing, a parent or guardian must be involved. A parent or guardian can contact us about a child's personal data.
Changes to this policy
This policy may change as the game, its providers or privacy requirements evolve. The date above identifies the latest revision.