Privacy
Privacy Policy
Effective July 29, 2026 · Version 1.0-draft
1. Information RFL collects
Discord OAuth supplies identifiers and profile information authorized by you, such as Discord user ID, username, avatar, and, when supplied, email. RFL stores profile names, account status, roles, date of birth, policy versions and acceptance timestamps, sessions, wallet entries, Crown game and betting history, cards, packs, marketplace activity, fighter records, fight requests, notifications, administrative audit records, and other actions needed to operate current features.
2. Information RFL does not request
RFL does not issue or store account passwords. The current service does not process payment-card or bank information and does not offer cash deposits or withdrawals. Discord access and refresh tokens are removed after authentication; the service retains the Discord account link needed for login. RFL does not independently verify government identification or age.
3. How information is used
Information is used to authenticate users, enforce age and role restrictions, operate profiles and competitions, record Crown transactions, settle games and fight bets, manage cards and marketplace listings, deliver Discord notifications, prevent abuse, investigate incidents, administer the platform, and maintain auditability.
4. Public information
Fighter names, ranks, status, records, fight history, and other competition information may be public. Marketplace listings and card ownership-related information may be visible as part of marketplace operation. Do not use a display name that reveals information you do not want shown publicly.
5. Cookies and sessions
RFL uses essential secure session cookies to keep users signed in and support OAuth security. These cookies are required for account features. The current implementation does not use advertising cookies or a separate analytics-cookie system.
6. Sharing and service providers
RFL uses Discord for authentication, server membership, roles, and notifications; DigitalOcean for hosting and managed infrastructure; PostgreSQL for data storage; and Prisma software to access the database. Information is disclosed to these providers only as necessary to operate the service, or when required by law, to address abuse, or to protect rights and safety. RFL does not currently sell personal information or share it for cross-context behavioral advertising.
7. Security and administrative access
RFL uses role-based administration, database-backed sessions, environment-managed secrets, HTTPS in production, database constraints, transactional balance changes, rate limits on sensitive actions, and administrative audit records. Authorized administrators can access information needed for operations and moderation. No system is perfectly secure, and RFL does not promise absolute security.
8. Retention, access, export, and deletion
Information is retained while an account is active and as reasonably needed for operations, integrity, disputes, security, and legal obligations. RFL does not yet provide self-service account deletion or automated data export. Users may request access, correction, export, or deletion by email. Requests are handled manually and may require identity verification; some competition, transaction, audit, or legal records may be retained or de-identified where appropriate.
9. Children
RFL is not intended for children under 13. Users self-report a birth date during onboarding. Accounts reporting an age below 13 are rejected, and accounts reporting an age below 18 are technically blocked from Crown wagering, fight betting, and casino features. RFL does not currently perform independent age verification. A parent or guardian concerned about a minor’s information should contact RFL.
10. International and California users
RFL is operated from the United States, and information may be processed there. Depending on location, users may have rights to access, correct, delete, or obtain a copy of information. California residents may also request disclosure concerning collection and use. RFL does not discriminate for exercising applicable privacy rights and does not currently sell or share personal information as those terms are used by California privacy law.
11. Changes
This Policy may change as the platform changes. The effective date and version identify the current text. Material changes may be presented for renewed acceptance.
Questions may be sent to [email protected].