Privacy Policy

• No ads, and no tracking of children. We show no advertising, and pages students use carry no third-party trackers or analytics.
• Your organization is in charge. A school, company or community decides what goes into Arena and why. We process it for them, and only to run Arena.
• Consent is purpose by purpose. For anyone under 18, consent is recorded from a parent or guardian for each purpose, and features that share a child’s data beyond the school require it.
• A person decides, not the AI. AI can draft text for staff. A person always reviews and saves it; AI never writes to anyone’s record on its own.

• Account details: your name, email address and/or phone number, profile picture, and the organization, workspace, group or role you belong to (for a school: campus, class, house, and roles such as captain).
• Google sign-in: if you sign in with Google, we receive your name, email address and profile picture from Google. We do not receive your Google password, and we do not access your other Google data.
• Activity in Arena: entries, submissions, scores, points, recognitions, event attendance, and messages, comments, photos and video posted in workspaces you belong to.
• Interests a member declares in a talent survey, and consent records: what was agreed, by whom, and when it was withdrawn.
• Device and notification data: push notification tokens for the devices you enable notifications on, and basic app settings.
• Technical data: log and audit records needed to keep the service secure, diagnose faults and show administrators who changed what.

We do not collect home addresses or government ID numbers.

• To create and secure your account and sign you in.
• To run competitions, scoring, leaderboards, chat and the features your organization turns on.
• To send you transactional messages, such as invitations, sign-in codes and notifications you have opted into.
• To provide AI-assisted features (for example setup suggestions or judging help) when your organization uses them.
• To detect abuse, keep the service reliable, and meet legal obligations.

We do not sell personal information, and we do not use it for advertising. Arena does not show ads and does not track children for marketing.

Arena’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to sign you in and to show your name and profile picture in Arena. We do not use it for advertising, and we do not allow humans to read it except where needed for security, to comply with law, or with your consent.

Each organization’s data is walled off from every other organization’s, and inside an organization access follows the workspace and role. A student’s co-curricular record is visible to the student and their school staff, and to nobody else. Arena staff can reach an organization’s data only through time-limited, logged support access, and never children’s portfolio or consent records.

We share information only with your organization and the service providers that help us run Arena:

• Database, authentication and file storage hosting (Supabase).
• Transactional email delivery (Resend).
• AI model providers, only when staff use an AI feature: the text they are working on is sent to produce a draft (Anthropic).
• Google and Apple push notification services, to deliver notifications you enable.
• Google, for sign-in when you choose to use it.
• Your organization’s administrators, who can see the information needed to run their workspace, such as members, results and activity.

Some things go beyond the organization only when it chooses: a share link for a leaderboard or TV screen shows names and points to anyone holding the link, and a league or fest a host publishes is listed publicly without students’ names. We may also disclose information where the law requires it.

For a school, the school is the data fiduciary under India’s Digital Personal Data Protection Act, 2023, and Arena is its data processor. Questions about a student’s data go to the school first, and the school can bring us in.

Most students using Arena are under 18. Unless the school tells us otherwise, we treat every student as a child, which means the most protective settings apply. Consent for a child is recorded from a parent or guardian, purpose by purpose. A student or guardian can withdraw a consent, even one a parent gave, and withdrawal works even if the school’s subscription has ended. We do not run advertising or behavioural tracking aimed at children, and we limit what children’s profiles show to what their workspace needs.

We keep account and activity information for as long as your account or organization is active. Read notifications are cleared after 90 days. When an organization leaves, its data stays exportable, and we delete it within 30 days of its request. When an account is deleted, we remove its personal information, except where we must keep limited records for legal, security or accounting reasons. Backups are overwritten on their normal cycle.

We encrypt data in transit, restrict access to personal information by role, and record administrative actions in audit logs. No online service is perfectly secure, so please use a strong, unique password and tell us promptly if you think your account has been compromised.

You can view and update your profile in Arena, turn notifications on or off in your settings, and sign out at any time. You can also ask to access, correct, export or erase your personal information, or to withdraw consent. In a school, ask the school first; it can act directly or ask us. Otherwise email us. Depending on where you live, you may have additional rights under local law. We respond within a reasonable time and within the period the law requires.

We may update this policy. When we make material changes we will update the “Last updated” date above and, where appropriate, tell you in the app or by email.

Questions about this policy or your personal information, and grievances under the DPDP Act, can be sent to hello@example.com. Grievance officer: [to be appointed].