Privacy

Your identity

There are no passwords, anywhere, ever. The first time you do something that needs an identity — rate, judge, submit, report, or hide someone — an anonymous identity is created and stored in your browser. Reading the site, playing audio, skipping an entry, and sharing a link create nothing.

That identity lives in your browser. Clear your browser storage and it is gone, along with your ability to change a rating or manage an entry from that browser.

You may OPTIONALLY add an email address to that same identity so you can recover it on another device or after clearing your browser. It is never required to publish, to be ranked, or to contest the Throne. It adds an address to the identity you already have — it does not create a second account, and nothing moves.

A private league or a public league is the one exception: creating or joining one requires an email, because a season runs for weeks and a place in it should survive a lost browser.

If you add an email, it is used ONLY to send you a sign-in code. It is stored in our authentication system and nowhere else: never on your profile, never in a league, never in any public page, never in our analytics, and never used for marketing.

What is public

• Your chosen username.
• Your entry title, audio, duration, waveform, score, rating count, and rank.
• Throne match results, including which entry won.
• If you join a public league: your league display name, matchups, locked weekly entries, results, and standings in that league.

What is private

• Your individual ratings — nobody can see how you rated anything.
• Your Throne ballots.
• Your reports, including the fact that you filed one.
• Which competitors you have hidden.
• Private-league membership, entries, matchups, results, and standings, except to other members of that league.
• Moderation records and operator notes.

Abuse prevention

To stop scripted abuse we count actions per identity and per network. We do NOT store your IP address. Instead we store a one-way HMAC of a normalized network address, keyed by a secret only the server holds and salted with the current calendar month — so the value changes every month and cannot follow you over time. These rows are deleted shortly after their counting window ends, and no user can read them.

Cloudflare Turnstile may be used to check that a new identity is being created by a person rather than a script. Cloudflare receives whatever their widget collects, governed by their own privacy policy.

Processors

• Supabase — database, anonymous authentication, and audio storage.
• Vercel — application hosting.
• OpenAI — receives entry audio to generate Official Scouting Reports.
• Cloudflare — Turnstile bot protection, when enabled.

Deletion, and its limits

You can withdraw your own entry at any time. The public page becomes unavailable and the stored audio is deleted.

We cannot recall copies. Audio is served from public storage, so anyone who already downloaded the file, or who holds a direct link, may still have it. Anyone who reshared it elsewhere still has it. This is a real limitation, not a formality.

A small amount of private metadata is retained after removal for abuse detection and for the moderation audit trail.

Deleting your whole identity is NOT implemented yet. Abandoned anonymous identities with no history at all may be cleaned up periodically.

Advertising

There are no ads, no behavioural advertising, no advertising identifiers, and no third-party analytics or tracking pixels.