PRIVACY

Diese Datenschutzerklärung ist auf Englisch verfasst, der Produktsprache dieser Website. Das Wichtigste auf Deutsch: Verantwortlicher im Sinne der DSGVO ist der im Impressum genannte Betreiber. Sie haben das Recht auf Auskunft (Art. 15), Berichtigung (Art. 16), Löschung (Art. 17), Einschränkung (Art. 18), Datenübertragbarkeit (Art. 20) und Widerspruch (Art. 21 DSGVO) — schreiben Sie dafür an bulatalper@gmail.com. Sie können sich außerdem bei einer Datenschutz-Aufsichtsbehörde beschweren, etwa beim Landesbeauftragten für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

Controller within the meaning of Art. 4 No. 7 GDPR is the operator named in the imprint. Contact for any request under this policy: bulatalper@gmail.com

When you enter a fighter, we store what you typed and what we need to run a match:

• Your landing page URL — required, and the whole point of the exercise.
• Your email address — so we can tell you when a match runs and send you the result.
• Fighter name, tagline and pitch, if you supplied them.
• Your Founder's Corner, if you file one: intro line, result line, up to three images.
• A frozen snapshot of your landing page: a screenshot and the visible text, captured at match time. This is the evidence the jury scores, and it is what makes a verdict checkable later.
• Your match history: scores, verdicts, wins, losses, streak, rank and title history.

Payment details are never entered on insertcoin.lol. Card data goes directly to Stripe; we receive only the confirmation that a payment succeeded, along with the identifiers needed to match it to your entry and to issue a refund.

To stop spam and abuse we record submission attempts. Your email address and IP address are not stored in readable form for this purpose — both are kept only as keyed HMAC-SHA-256 digests, which lets us count attempts without holding the underlying values. These rows are pruned after the enforcement window. The same kind of keyed digest, of your IP address together with the fighter, is how we count a visit to a fighter's landing page through insertcoin at most once a day: no readable IP address is stored and no cookie is set.

This is a public scoreboard, so most of what you submit is meant to be seen: your fighter name, tagline, landing page link, the captured snapshot, your Founder's Corner, your record, and every verdict about you — wins and losses alike. That is disclosed before every entry and challenge, free or paid, and you check a box confirming you have read it.

Your email address is never published. It is used for match notifications, result links and your private management link, and nothing else.

A fighter on the board can call out a product that is not on it yet. The data about that product comes from the fighter who made the call-out, not from its owner. We store the landing page URL they entered, its domain, a pixel fighter generated for it and, if they supplied one, an X handle. To draw that fighter we load the page once and take a screenshot of its top section through Cloudflare Browser Rendering; the colours are read from it and the screenshot is discarded. Nothing else of the page is captured, and nothing about it is judged or scored unless its owner enters it.

The purpose is a public invitation to fight: the call-out page and its share card show the domain and the generated fighter next to the caller, and the handle, if given, appears in the page's share text. We never contact the product's owner; our emails about a call-out go only to the fighter who made it. The legal basis is our legitimate interest in running that invitation (Art. 6(1)(f) GDPR); the data is a public landing page and, optionally, a public handle.

A call-out is open for up to seven days; it ends earlier if the Founding Season closes or the caller leaves the board. Once it has ended without an answer, the page shows only the caller, and the share card becomes a generic card that shows neither side. The record of the call-out, including what it stored about the target, stays in our database. If the owner enters the product, the rest of this policy applies to that entry. If the product is yours and you want the call-out removed, write to bulatalper@gmail.com.

• Art. 6(1)(b) GDPR — performance of a contract: running the match you entered or paid for, publishing the result, and contacting you about it.
• Art. 6(1)(f) GDPR — legitimate interest: preventing spam, fraud and abuse, keeping the service available, maintaining an accurate public record of matches that have already been fought, and telling participants how many visitors we sent to their page.
• Art. 6(1)(c) GDPR — legal obligation: retaining records of payments for as long as tax and commercial law require.

We use the following processors. Each acts on our instructions under a data processing agreement:

Some of these process data outside the EU. Where that happens, transfers are covered by the European Commission's standard contractual clauses or an adequacy decision.

No tracker or analytics script stores anything on your device. The site sets two cookies of its own, ic_seen and ic_fighter, both described below; neither is used for tracking.

PostHog (EU) measures pageviews and product events so we can see what works. It runs on EU servers and stores nothing on your device — no cookies, no localStorage. Instead PostHog derives a visitor id on its servers from a daily-rotating hash of your IP address and browser signature; the hash cannot be reversed and expires with the day, so we cannot recognize you tomorrow. Your browser sends this to our own domain, which passes it on to PostHog without your cookies. The URLs it sees are scrubbed of private tokens first. Our host works out your country from your IP address and we pass on only the two-letter country code; the IP itself is not stored. When you enter or pay, the utm tags of the link you arrived through and the domain of the site that sent you are kept with that submission or payment, so we can tell which posts work. Anonymous visitors are not profiled. The legal basis is our legitimate interest in understanding whether the product works (Art. 6(1)(f) GDPR).

When something breaks, the error — stack trace and request context, with private tokens scrubbed from URLs — is reported to Sentry (EU region) so we can fix it. Same legal basis: keeping the service running is a legitimate interest.

The site itself keeps a few small functional flags in your browser: whether you switched sound on, on the start screen or in a fight (in localStorage, set only by you, kept until you clear site data) and, for the current tab session only, whether the intro animation or a match replay already played (in sessionStorage, gone when you close the tab). Those flags do not identify you. On your first visit we also set a cookie, ic_seen, that holds the value 1 and nothing else: it remembers that you have been here, so the home page opens on the board instead of the start screen. It is sent only to this site and kept for one year, or until you clear your cookies. When you open your private fighter link, we also store a signed access cookie (ic_fighter, inaccessible to browser scripts) so you can return to your fighter and challenge from the board. It is sent only to this site, expires with your link (at most 90 days), and can be removed with Forget this fighter. Opening another fighter link switches the remembered fighter.

Our hosting provider records ordinary server logs, including IP address, time and the page requested, to deliver the site and detect attacks.

Match pages and the record they belong to are intended to be permanent — that permanence is what gives a win its value and a public record its meaning, and it is disclosed before every entry and challenge. Payment records are kept for the statutory retention period. Rate-limiting digests are pruned after their enforcement window.

Permanent applies to the record, not to you: a withdrawal under Art. 17 leaves the matches and verdicts standing and takes the person out of them — name, landing link, snapshots and email. What that removes and what it keeps is set out under YOUR RIGHTS below.

You may request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and portability (Art. 20), and you may object to processing based on legitimate interest (Art. 21). Write to the contact address above. You may also complain to a data protection supervisory authority.

Erasure (Art. 17 GDPR). Write to us from the address you entered at submission. We withdraw your fighter within 14 days: the name becomes “Withdrawn fighter”; sprite, landing link, tagline, pitch, page snapshots, your Founder's Corner (its text and images, including the copies frozen into past matches) and your e-mail are deleted. What stays: the W–L record, rank and title history, and the verdicts about your page — they are the opponents’ results and a truthful record of a public competition at the time it happened (Art. 17(3)(a)). Withdrawal is not silent: the record shows the fighter as withdrawn. It is also final; a withdrawn fighter is not restored.

A verdict you dislike is not a factual error, but a demonstrable factual error is corrected — and one rejudge is available for that, as set out in the rules.