Privacy Policy

DRAFT — pending legal review Last updated: 21 July 2026 Version 1.0

LLM Prediction Arena is an information and entertainment resource with no registration and no accounts, and it asks for nothing about you: no sign-up form, no email field, no payment page. What we do store is a random identifier your browser generates, the campaign parameters in the link you arrived on, and which parts of the page you used — enough to know whether an advert worked, and nothing more.

The short version

No registration. There is no account to create, and none is planned.
No name, email, phone or payment details. We have no way to collect them and no field that would accept them.
No cookies. The site sets none. It uses five keys in your browser's local storage, listed in §5.
No third-party advertising or analytics scripts run on the page. Measurement is a request to our own server.
A random identifier is created by your browser so a round is not scored twice and one visit is not counted as ten. It is not derived from anything about you or your device.
Your prediction is stored against that identifier — the round, the direction, and whether it turned out right.
Your click id travels to the broker if you follow our affiliate link, so the campaign that paid for the click gets credited.
Clearing site data resets everything we hold that is linkable to you, from your side, without asking us.

Who is responsible

The controller of the data described here is [OPERATOR LEGAL NAME], registered under number [COMPANY NUMBER] at [REGISTERED ADDRESS]. Contact: [privacy@DOMAIN].

This policy covers this domain and any mirror domain serving the same Arena. It does not cover the broker's website, which has its own controller and its own policy.

What we collect

Everything the Arena stores about a visit is in this table. There is no other collection.

Data	Where it comes from	What it is for
Random visitor identifier `arena.visitor`	Generated by your browser on the first visit and kept in local storage. Random — never derived from your device, network or behaviour.	Counting a visitor once rather than once per page view, and making sure one round is scored once.
Campaign parameters `sub_id`, `utm_*`	The advertising link you arrived on, if it carried them.	Knowing which advert, placement and campaign brought you here, and crediting the resulting conversion to it.
Page events `visit`, `round_view`, `prediction_made`, `offer_click`	Sent by the page as you use it, with the identifier above, the round number, the domain and a small technical detail such as which leaderboard tab was open.	Measuring the funnel: how many people watch a round, how many play, how many click through.
Your predictions	Recorded when you press UP or DOWN: the round, the direction, the identifier, and afterwards whether it was correct.	Scoring the round, enforcing one call per visitor per round, and the aggregate "humans vs AI" figures.
Server logs	Created automatically by our web server for every request: IP address, user agent, the path requested, status code, timing.	Keeping the site up, diagnosing faults, and detecting abuse.
Rate-limiting counters	Your IP address, as a short-lived counter key.	Stopping one client from flooding the prediction and event endpoints. The counter expires within minutes.
Conversion notifications	Sent to us by the broker, server to server, if you register or fund an account after following our link: the click id, the broker's own reference, and the amount.	Reconciling affiliate commission and measuring campaign performance.

Nothing about you reaches the models

The language models are prompted by our server with market data only. Your identifier, your prediction, your IP address and your campaign parameters are never included in a prompt and are never sent to any model provider.

What we never collect

Your name, email address, postal address or phone number.
Payment card or bank details — the Arena takes no money, ever.
Government identifiers, or any special-category data.
Precise location. We do not use geolocation; an approximate country may be inferred from an IP address in server logs, as it is on any website.
Your browsing on other sites. We run no advertising pixel, no remarketing tag and no cross-site tracker, and we do not buy or enrich visitor data from data brokers.
A profile of you as a person. The identifier is attached to a browser, not to an individual we could name.

If we ever add an advertising pixel — media buying often ends up needing one — this policy will be updated before it goes live, and consent will be collected first where the law requires it.

Storage on your device

The Arena sets no cookies. It writes five keys to your browser's local storage, all of them first-party and all readable by you in your browser's developer tools:

Key	Contents	Why
`arena.visitor`	A random string.	Recognises this browser between rounds and reloads.
`arena.attribution`	The click id and campaign parameters from your first landing, and when you landed.	The click id has to survive until you click the offer, which may be several rounds later.
`arena.streak`	A number.	Your run of correct calls. Never leaves your browser.
`arena.score`	Two numbers: wins and rounds played.	Your record. Never leaves your browser.
`arena.prediction`	The current round and the direction you chose.	Stops a reload from scoring the same round twice.

Local storage has no expiry date, so these persist until you remove them. Clearing site data for this domain deletes all five: the next visit starts as a stranger with a new identifier and an empty streak. Private or incognito browsing discards them when you close the window, and the Arena works normally without them — you simply lose the streak between visits.

Consent — to confirm before launch

The streak and prediction keys are needed for a feature you asked for. The attribution and measurement keys are not strictly necessary, and in the EEA and the UK storage of that kind requires consent before the first write. Whether this site shows a consent banner is a per-market decision that must be settled before the first campaign runs.

Why, and on what legal basis

Where the GDPR or the UK GDPR applies, we rely on the following bases. Where it does not, the same purposes still describe everything we do with the data.

Purpose	Basis
Running the Arena: serving the page, scoring the round you played, showing your streak.	Legitimate interests — delivering the feature you used. No account exists to make this contractual.
Keeping the service available and safe: logs, rate limiting, abuse detection.	Legitimate interests in the security and integrity of our own systems. Also a legal obligation where security measures are required of us.
Measuring the funnel and attributing conversions to campaigns.	Consent where required for the storage on your device; otherwise legitimate interests in understanding whether our advertising works.
Reconciling affiliate commission from the broker.	Legitimate interests in being paid correctly, and a legal obligation to keep accounting records.

Where we rely on legitimate interests we have weighed them against your rights. The balance is helped by the fact that the data is pseudonymous, minimal, never sold, and never used to build a profile of you: we measure a funnel, not a person. You can object at any time — see §10.

International transfers

Our infrastructure is located in [REGION]. The broker, the hosting provider and Google may process data outside your country, including outside the EEA. Where that happens and the GDPR applies, the transfer is covered by an adequacy decision or by the European Commission's standard contractual clauses. A copy of the safeguards used for a specific transfer is available on request at [privacy@DOMAIN].

How long we keep it

Data	Kept for
Page events and campaign parameters	14 months from the event, then deleted.
Your predictions and their outcomes	14 months, then deleted. Aggregate round statistics survive in a form that identifies nobody.
Server access logs	30 days.
Rate-limiting counters	Minutes — the counter's own window.
Conversion notifications from the broker	As long as required for accounting and commission records, typically [7 years].
The keys in your browser	Until you clear them. We cannot delete them for you.

Round-level and model-level results — prices, model predictions, wins and losses — are published as a public benchmark and kept indefinitely. They contain nothing about visitors.

Your rights

Subject to your local law, you may ask us to give you a copy of the data we hold that relates to you, correct it, delete it, restrict or object to our processing of it, or receive it in a portable form. Where we rely on consent you may withdraw it at any time, without affecting what was lawful before.

The fastest route needs no request at all

Clearing site data for this domain in your browser removes the identifier that everything is keyed on. From then on, nothing we hold can be connected back to your browser — and nothing new is written until you return.

If you would rather we acted on it, write to [privacy@DOMAIN]. Because we hold no name or email, the only way to find your records is the identifier: open the site, read the value of arena.visitor in your browser's local storage, and include it in your message. Without it we genuinely cannot tell which rows are yours, and we will not ask you for identity documents to make up the difference — collecting more data to answer a privacy request would defeat the point.

We answer within one month. There is no charge for a reasonable request.

Children

The Arena is for adults aged 18 and over. It is not directed at children and we do not knowingly collect their data. If you believe a child has used the site and left data with us, write to [privacy@DOMAIN] and we will delete it.

Security

The site is served over HTTPS only, with a strict content security policy and no third-party scripts. Access to the database is restricted to the application and to named administrators. Write endpoints are rate limited, and the broker's conversion notifications are authenticated with a shared secret.

No system is perfectly secure, but the exposure here is unusually small: a breach of our database would reveal random identifiers, click ids and up/down guesses — no names, no contact details, no credentials and no money.

Automated decisions

We make no automated decision that produces a legal or similarly significant effect on you, and we do not profile you. The language models on the Arena predict market direction; they are never applied to visitors.

Changes to this policy

We may update this policy — for example if we add a measurement tool or change a provider. The version in force is the one published here, dated at the top. Material changes will be summarised at the top of the page for a reasonable period before they take effect.

Contact and complaints

Privacy questions and requests: [privacy@DOMAIN]. Everything else, including questions about the Terms of Use: [legal@DOMAIN].

If you are in the EEA or the UK and are not satisfied with our answer, you may complain to your national data protection authority. Ours is [SUPERVISORY AUTHORITY]. We would rather you came to us first, and we will try to fix it.