Privacy policy

What the website stores

The website stores the information needed to remember your experience in your browser on this device:

• the guest or local-profile name you choose;
• password-verification data if you create an optional password-protected local profile;
• fighter, avatar, difficulty, board, sound, motion, and accessibility settings;
• active-match state, local match history, achievements, daily streak, completed practice positions, and device leaderboard records.

This information uses browser storage. Clearing site data removes it. A local profile is separate from an online account. Device-only history, passwords and locally calculated XP are not imported as verified online account progress or published to opponents.

Android app: local play and storage

The Android app includes its game code, artwork, models, and fonts on your device. AI battles, same-device two-player games, and practice do not require an online account or the Tahni Arena website. Your local profile, chosen name, settings, saved progress, match records, and optional local-profile password-verification data stay in the app's local storage. The bundled game does not automatically send them to Tahni Arena or other players. You can choose to share a result as described below.

The app saves stable active-match checkpoints so an interrupted game can be restored. Valid Android checkpoints have no time-based expiry. A later save can replace the checkpoint; completing or leaving the match, signing out, or removing local app data clears it. Settings and progress remain available until they are replaced or removed. If Android closes the app during an unfinished move animation, the preceding stable checkpoint may be restored.

You can remove this locally stored information through Android Settings by opening Tahni Arena's app information and clearing its storage or app data. Uninstalling also removes its local data. These actions remove saved settings, progress and match information, but do not delete a separate online account. Android backup is disabled.

The bundled Android game disables Tahni Arena's Google Analytics and network crash-reporting integrations. It does not include advertising, purchases, or collection of portal-account information.

App versions with the optional online hub can contact the Tahni Arena HTTPS service to check availability and, if you are already signed in, restore your online session. These requests expose ordinary connection information such as your IP address even when registration or matchmaking is unavailable. They do not upload your device-only profile, password or local match history. Offline modes remain playable without a successful connection.

Optional online accounts and gameplay

When online account services are enabled and you choose to register, Tahni Arena stores your arena name, email address, email-verification status, salted password hash, account identifiers and creation/update times. Your password is sent over HTTPS for authentication and is not stored as a readable password. Verification and recovery require a working email service; the app does not claim to send an email when that service is unavailable.

Online play uses server-validated moves and saves room membership, move events, board state, turn deadlines, results and reconnection information. Friend codes and random matchmaking both use this service. Opponents can receive your arena name and account identifier as part of a shared match; they do not receive your email address, password hash or session credentials.

Online journey progress records challenge attempts, submitted legal-move proofs, completions, account XP and equipped or earned cosmetic rewards. The prepared journey contains 12 challenges. Rewards do not change either fighter's strength. Device-only wins, achievements and XP do not become verified online rewards.

Signing in, email and security information

Website sign-in uses a secure, HttpOnly session cookie restricted to the website. On Android, the native account bridge stores a signed session credential as encrypted private app data, using a key held by Android Keystore. The native credential is used only with Tahni Arena's HTTPS API and is not returned to the game's JavaScript. Signing out or deleting the online account removes or revokes the applicable session; clearing Android storage removes the locally held credential.

Verification and password-reset emails contain expiring links. The delivery queue stores the recipient and link in encrypted form, with a keyed recipient identifier used for cancellation. Verification links expire after one hour and password-reset links after 15 minutes. Queue entries are removed after successful processing, cancellation or expiry cleanup. If the worker is stopped, expired encrypted entries can remain until cleanup resumes. Delivery retries can send the same still-valid link more than once; queue acceptance is not proof that an email reached your inbox.

The configured email provider receives the destination address, message and delivery information needed to deliver these emails. Normal links carry the credential in a URL fragment that is removed by the account page and submitted in an HTTPS request body. It is not included in the page's HTTP request URL. Account and mail application errors use fixed public codes and do not include email links, passwords or session credentials.

To protect accounts and matches, servers process connection IP addresses, timestamps and request outcomes. Game API quota records use keyed hashes of their identities. Authentication also keeps session IP addresses, browser/app information and its own database-backed request limits; these authentication records are not all represented by the game quota hashes. Access is restricted to operating and securing the service.

Deleting an online account and retention

When account services are available, you can request deletion in the Android online hub's account settings or at tahniarena.com/account/delete. Sign in and confirm your password to delete the account. This removes the online identity, sessions and personal journey progress, attempts, completions and rewards. Waiting rooms and matchmaking are cancelled; an active match is forfeited before deletion.

Other players keep their own earned progress and shared match history. Your retained match seat is labelled as a deleted player, and your account identifier is removed from that history and the surviving opponent's reward references. Deletion cannot recall email already accepted for delivery. Pending queued email is cancelled where possible.

Account records are retained to provide your online account until you delete it. Shared match records can remain in anonymous form for the other participant. Security records and protected backups may remain until their operational retention and cleanup complete. Deleting an online account does not clear device-only profiles or records; clearing site/app storage or uninstalling does not delete the online account. Contact us below for help with access or deletion.

Opening website pages from Android

Links to the rules, fighters, privacy policy, and other Tahni Arena website pages open through Android's browser surface. Opening these pages requires a connection. Your locally saved profile and match are not included in those links. The website's analytics and diagnostics described below may apply while you use those pages, together with your browser's own privacy settings and policies.

Analytics and diagnostics

On tahniarena.com, Google Analytics may load after the page becomes idle when analytics is configured. It measures visits, board readiness, accepted human moves, learning completion, game endings, rematches, and sharing. Gameplay events include limited context such as mode, difficulty, loading time, whether a saved game was restored, and whether a game ended normally or by resignation. They do not include your chosen name, profile details, move coordinates, board positions, or private match history.

Early interactions wait in a limited in-memory queue until analytics initializes; this queue is not saved to browser storage. Tahni Arena analytics is disabled inside the bundled Android game, embedded portal builds, identified CrazyGames/Poki contexts, the downloadable standalone build, local development, and designated QA sessions. Google may process device, browser, approximate location, and interaction information under its own policies.

Dedicated account, verification, recovery and deletion pages exclude Google Analytics and Tahni Arena's browser crash reporting. Sensitive token, code, email and authentication URL contexts are also excluded. Account navigation loads a new document with a restrictive connection policy and no-referrer protection. Ordinary website pages can still use the analytics described above.

The production website sends limited crash diagnostics to Tahni Arena when a JavaScript error, unhandled promise rejection, or asset-load failure occurs. A report contains the error message and stack, affected page and asset path, portal name, viewport, and time. The monitor does not read form fields or browser-storage contents, or deliberately attach your guest name or match history. Error messages and asset paths can contain context from the operation that failed. Reports are recorded in access-controlled operational server logs under the host's log-rotation policy. The bundled Android game and downloadable standalone build do not send these crash reports.

Game portal SDKs

When the game is launched with a CrazyGames or Poki portal context, it loads that portal's official SDK to report loading and gameplay start/stop events. The portal may use its own cookies, storage, identifiers, or telemetry according to its policy. Tahni Arena does not request ads, purchases, or portal-account data in this release.

• CrazyGames privacy policy
• Poki privacy policy
• Google privacy policy

Sharing, sale, and control

If you choose Share result, the game opens your device's sharing options or prepares text for you to copy. A result summary can include the local winner's chosen name, move and capture totals, match duration, and a link to Tahni Arena. Copying a practice challenge prepares a link to that challenge without your local profile or match history. You decide whether and where to send or paste this information; a receiving app or website handles it under its own policy.

Tahni Arena does not sell personal information. It does not provide public chat or a public content feed. You can remove device-only website information by clearing tahniarena.com site data in your browser, or remove device-only Android information by clearing the app's storage or uninstalling it. Use the separate account-deletion process for online data. You can also play the portal build without Tahni Arena's Google Analytics because analytics is disabled there.

Privacy and support contact

Tahni Arena is responsible for the app and website described in this policy. For privacy questions or support, contact info@tahniarena.com.

Children and changes

The game is intended for a general audience aged 13 and older and is not directed to children under 13. This notice will be updated when the prepared online features are activated or the providers, retention practices or other data-handling features change.