Privacy Policy
LLM Prediction Arena is an information and entertainment resource with no registration and no accounts, and nothing on it requires you to identify yourself: no sign-up, no payment page. What we store by default is a random identifier your browser generates, the campaign parameters in the link you arrived on, and which parts of the page you used — enough to know whether an advert worked, and nothing more. The one exception is an email address, and only if you type one into the subscription form to receive the arena's weekly digest.
The short version
- No registration. There is no account to create, and none is planned.
- No name, phone or payment details. We have no way to collect them and no field that would accept them.
- An email address only if you give us one in the subscription form, to receive one email a week about the arena. Nothing else on the site asks for one, it is never a condition of using the Arena, and it is not passed to the broker. See §3 and §10.
- Two cookies, both set by Google Analytics. Nothing else on the site sets one. There are also five keys in your browser's local storage. All seven are listed in §5.
- Google Analytics runs on every page, loaded through Google Tag Manager, so Google sees your visit — see §7. Our own funnel measurement is separate, and is a request to our own server. No advertising or remarketing pixel runs.
- A random identifier is created by your browser so a round is not scored twice and one visit is not counted as ten. It is not derived from anything about you or your device.
- Your prediction is stored against that identifier — the round, the direction, and whether it turned out right.
- Your click id travels to the broker if you follow our affiliate link, so the campaign that paid for the click gets credited.
- Clearing site data resets everything we hold that is linkable to you, from your side, without asking us.
Who is responsible
The controller of the data described here is [OPERATOR LEGAL NAME], registered under number [COMPANY NUMBER] at [REGISTERED ADDRESS]. Contact: [privacy@DOMAIN].
This policy covers this domain and any mirror domain serving the same Arena. It does not cover the broker's website, which has its own controller and its own policy.
What we collect
Everything the Arena stores about a visit is in this table. There is no other collection.
| Data | Where it comes from | What it is for |
|---|---|---|
Random visitor identifierarena.visitor |
Generated by your browser on the first visit and kept in local storage. Random — never derived from your device, network or behaviour. | Counting a visitor once rather than once per page view, and making sure one round is scored once. |
Campaign parameterssub_id, utm_* |
The advertising link you arrived on, if it carried them. | Knowing which advert, placement and campaign brought you here, and crediting the resulting conversion to it. |
| Your email address only if you subscribe |
Typed by you into the subscription form and submitted under the wording shown beneath it. Stored with the date, the exact wording you agreed to, the page the form was on, and the campaign parameters above. | Sending you the arena updates you asked for: a season ending, a new model joining the board, results being published. Nothing else is sent to it, and it is not used to advertise to you elsewhere. |
Page eventsvisit, round_view, prediction_made, offer_click, email_subscribed |
Sent by the page as you use it, with the identifier above, the round number, the domain and a small technical detail such as which leaderboard tab was open. | Measuring the funnel: how many people watch a round, how many play, how many click through. |
Google Analytics measurement_ga, _ga_8Y8NY8JE9B |
Collected by Google's own script, which runs on every page: which pages you view and when, the referrer or campaign parameters you arrived with, your IP address, and your device, browser and language. Google derives an approximate location from the IP address. This is separate from the page events above and is held by Google, not by us. | Audience and traffic reporting — how many people arrive, from where, and which pages they read. |
| Your predictions | Recorded when you press UP or DOWN: the round, the direction, the identifier, and afterwards whether it was correct. | Scoring the round, enforcing one call per visitor per round, and the aggregate "humans vs AI" figures. |
| Server logs | Created automatically by our web server for every request: IP address, user agent, the path requested, status code, timing. | Keeping the site up, diagnosing faults, and detecting abuse. |
| Rate-limiting counters | Your IP address, as a short-lived counter key. | Stopping one client from flooding the prediction and event endpoints. The counter expires within minutes. |
| Conversion notifications | Sent to us by the broker, server to server, if you register or fund an account after following our link: the click id, the broker's own reference, and the amount. | Reconciling affiliate commission and measuring campaign performance. |
The language models are prompted by our server with market data only. Your identifier, your prediction, your IP address and your campaign parameters are never included in a prompt and are never sent to any model provider.
What we never collect
- Your name, postal address or phone number. An email address is collected only from the subscription form, only with your consent, and only to send what that form describes.
- Payment card or bank details — the Arena takes no money, ever.
- Government identifiers, or any special-category data.
- Precise location. We do not use geolocation; an approximate country may be inferred from an IP address in server logs, as it is on any website.
- Your browsing on other sites. We run no advertising pixel, no remarketing tag and no cross-site tracker, and we do not buy or enrich visitor data from data brokers. Google Analytics sees what you do on this site and nothing beyond it.
- A profile of you as a person. The identifier is attached to a browser, not to an individual we could name.
If we ever add an advertising pixel — media buying often ends up needing one — this policy will be updated before it goes live, and consent will be collected first where the law requires it.
Storage on your device
Two cookies, both placed by Google Analytics. They are first-party cookies on this domain, so no other site can read them — but the values are generated by Google's script and sent back to Google. Nothing else on the site sets a cookie.
| Cookie | Contents | Why |
|---|---|---|
_ga | A random client id Google generates for this browser. | Lets Google Analytics tell one browser's visits from another's. Expires two years after your last visit. |
_ga_8Y8NY8JE9B | Session state for this site's analytics property. | Groups the pages you view into one visit. Expires two years after your last visit. |
Beyond those, the Arena writes five keys to your browser's local storage. They are first-party, none of them is sent to Google, and all are readable by you in your browser's developer tools:
| Key | Contents | Why |
|---|---|---|
arena.visitor | A random string. | Recognises this browser between rounds and reloads. |
arena.attribution | The click id and campaign parameters from your first landing, and when you landed. | The click id has to survive until you click the offer, which may be several rounds later. |
arena.streak | A number. | Your run of correct calls. Never leaves your browser. |
arena.score | Two numbers: wins and rounds played. | Your record. Never leaves your browser. |
arena.prediction | The current round and the direction you chose. | Stops a reload from scoring the same round twice. |
Local storage has no expiry date, so these persist until you remove them. Clearing site data for this domain deletes all five and both cookies: the next visit starts as a stranger with a new identifier, an empty streak, and a new client id as far as Google Analytics is concerned. Private or incognito browsing discards the lot when you close the window, and the Arena works normally without any of it — you simply lose the streak between visits.
The streak and prediction keys are needed for a feature you asked for. The two Google Analytics cookies are not, and neither are the attribution and measurement keys: in the EEA and the UK, storage of that kind requires consent before the first write, and analytics cookies are the textbook case. This site does not ask for that consent today — the analytics tag fires on page load. Whether it shows a consent banner is a per-market decision that has to be settled before the first campaign runs.
Why, and on what legal basis
Where the GDPR or the UK GDPR applies, we rely on the following bases. Where it does not, the same purposes still describe everything we do with the data.
| Purpose | Basis |
|---|---|
| Running the Arena: serving the page, scoring the round you played, showing your streak. | Legitimate interests — delivering the feature you used. No account exists to make this contractual. |
| Keeping the service available and safe: logs, rate limiting, abuse detection. | Legitimate interests in the security and integrity of our own systems. Also a legal obligation where security measures are required of us. |
| Measuring the funnel and attributing conversions to campaigns. | Consent where required for the storage on your device; otherwise legitimate interests in understanding whether our advertising works. |
| Reconciling affiliate commission from the broker. | Legitimate interests in being paid correctly, and a legal obligation to keep accounting records. |
| Sending the weekly digest you subscribed to. | Consent, given by submitting the form under the wording shown with it. We keep a record of when it was given and of the exact wording shown, and you can withdraw it from any message we send — see §10. |
Where we rely on legitimate interests we have weighed them against your rights. The balance is helped by the fact that the data we rely on them for is pseudonymous, minimal, never sold, and never used to build a profile of you: we measure a funnel, not a person. Your email address is not among it — that rests on consent alone, and withdrawing it ends the processing. You can object at any time — see §10.
International transfers
Our infrastructure is located in [REGION]. The broker, the hosting provider and Google — for analytics as well as fonts — may process data outside your country, including outside the EEA. Where that happens and the GDPR applies, the transfer is covered by an adequacy decision or by the European Commission's standard contractual clauses. A copy of the safeguards used for a specific transfer is available on request at [privacy@DOMAIN].
How long we keep it
| Data | Kept for |
|---|---|
| Page events and campaign parameters | 14 months from the event, then deleted. |
| Your predictions and their outcomes | 14 months, then deleted. Aggregate round statistics survive in a form that identifies nobody. |
| Server access logs | 30 days. |
| Rate-limiting counters | Minutes — the counter's own window. |
| Conversion notifications from the broker | As long as required for accounting and commission records, typically [7 years]. |
| Your email address and its consent record | Until you unsubscribe or ask us to delete it. After you unsubscribe we keep the address and the date for 12 months as proof that we stopped, then delete both. |
| The keys in your browser | Until you clear them. We cannot delete them for you. |
| The two Google Analytics cookies | Two years from your last visit, unless you clear them sooner. What Google builds from them is kept for the retention period set on our analytics account. |
Round-level and model-level results — prices, model predictions, wins and losses — are published as a public benchmark and kept indefinitely. They contain nothing about visitors.
Your rights
Subject to your local law, you may ask us to give you a copy of the data we hold that relates to you, correct it, delete it, restrict or object to our processing of it, or receive it in a portable form. Where we rely on consent you may withdraw it at any time, without affecting what was lawful before.
Clearing site data for this domain in your browser removes the identifier that everything is keyed on. From then on, nothing we hold can be connected back to your browser — and nothing new is written until you return.
If you subscribed, your address is the handle on that record: write from it, or name it, to [privacy@DOMAIN] and we can find it, correct it, export it or delete it. Every message we send also carries an unsubscribe link, which needs no request and no reply from us. Withdrawing that consent stops the messages and does not affect anything else on this page.
For everything else, write to [privacy@DOMAIN]. Because
the rest of what we hold carries no name or address, the only way to find those
records is the identifier: open the site, read the value of arena.visitor in your
browser's local storage, and include it in your message. Without it we genuinely cannot tell which rows are yours, and we will not ask you for
identity documents to make up the difference — collecting more data to answer a privacy request would
defeat the point.
We answer within one month. There is no charge for a reasonable request.
Children
The Arena is for adults aged 18 and over. It is not directed at children and we do not knowingly collect their data. If you believe a child has used the site and left data with us, write to [privacy@DOMAIN] and we will delete it.
Security
The site is served over HTTPS only, under a strict content security policy: scripts may load only from this site and from Google's tag and analytics domains, and anything else the page tries to run is refused by the browser. Access to the database is restricted to the application and to named administrators. Write endpoints are rate limited, and the broker's conversion notifications are authenticated with a shared secret.
The subscription list is held apart from the rest: the public web service can write an address to it and has no privilege to read one back, so no request to this site — however malformed — can return the list.
No system is perfectly secure, but the exposure here is unusually small: a breach of our database would reveal random identifiers, click ids, up/down guesses and the email addresses of people who asked for updates — no names, no credentials and no money.
Automated decisions
We make no automated decision that produces a legal or similarly significant effect on you, and we do not profile you. The language models on the Arena predict market direction; they are never applied to visitors.
Changes to this policy
We may update this policy — for example if we add a measurement tool or change a provider. The version in force is the one published here, dated at the top. Material changes will be summarised at the top of the page for a reasonable period before they take effect.
Contact and complaints
Privacy questions and requests: [privacy@DOMAIN]. Everything else, including questions about the Terms of Use: [legal@DOMAIN].
If you are in the EEA or the UK and are not satisfied with our answer, you may complain to your national data protection authority. Ours is [SUPERVISORY AUTHORITY]. We would rather you came to us first, and we will try to fix it.