Privacy policy
Last updated 19 September 2026. CompanionsArena is published by an individual in the European Union; this policy is written to satisfy the EU General Data Protection Regulation (GDPR), and applies to every visitor regardless of location.
This page describes the site as designed and built. Who publishes and hosts the site is set out in the legal notice.
The short version
- We don't sell your data. There is nothing to sell — we don't run ads.
- Site analytics run on self-hosted, cookieless software (Umami) — no tracking cookie is set, no cross-site profile is built.
- If you sign up for the email digest, that address is used for exactly that, nothing else.
- Outbound links to reviewed platforms are disclosed on the page, and clicking one sends you to that platform's own site, under their own privacy policy.
- You can ask us to access, correct, export or delete anything we hold about you at any time.
What we collect
Site analytics. We use a self-hosted instance of Umami, an open-source analytics tool that sets no cookies and stores nothing in your browser. For each visit it records the pages viewed, the referring site, browser, operating system, device type, screen size, language, and approximate location (country, region and city) derived from your IP address. The IP address itself is not stored. To count visits without cookies, Umami derives an anonymous visit identifier from a one-way hash of the IP address, browser details and a secret salt that changes regularly, so it cannot be turned back into who you are or linked across that period.
How the site is used. The same tool records a few interactions, with no identifier beyond that anonymous visit: words typed into the site's search boxes (shortened to 80 characters), filters you switch on or off, and which links and buttons you click, including links out to reviewed platforms. Please don't type personal details into a search box.
Email digest signup. If you subscribe, we store the email address you provide and the timestamp of your consent. That's it — no name, no other profile data is requested.
Server logs. Like any web server, ours logs request metadata (IP address, requested path, timestamp, user agent) for a short rolling period, for security and abuse prevention. These logs are not cross-referenced with any other data we hold.
Comments or correspondence. If you email us — a correction report, a Discord message, a support question — we keep that correspondence to respond to it and to maintain the corrections record described in our corrections policy.
What we do not collect
We don't require an account to read the site — there are no reader accounts (see About). We don't run advertising pixels, third-party trackers, or social-media "share" buttons that phone home. We see that a link to a platform was clicked, and nothing about what you do on that platform afterwards.
Legal basis for processing
Cookieless analytics runs under legitimate interest (Article 6(1)(f) GDPR) — understanding which pages, searches and comparisons are useful, without identifying or profiling individuals. Because nothing is stored on or read from your device, no cookie consent is needed for it. Email digest signup runs under consent (Article 6(1)(a)) — you opt in, and every send includes an unsubscribe link that takes effect immediately.
How long we keep it
| Data | Retention |
|---|---|
| Analytics events | Up to 24 months, then deleted; nothing individually identifying is stored to begin with |
| Email digest address | Until you unsubscribe or request deletion |
| Server logs | 30 days, then automatically purged |
| Correspondence | Kept as part of the corrections/audit record; deleted on request unless needed for an active correction |
Your rights
Under GDPR, you can ask us to:
- tell you what we hold about you (right of access)
- correct anything inaccurate (right to rectification)
- delete data we hold about you (right to erasure)
- give you a portable copy of it (right to data portability)
- stop processing it for a specific purpose (right to object)
Email The Admin with your request — we respond within 30 days, as required by law. If you're unsatisfied with our response, you can lodge a complaint with your national data protection authority — every EU member state has one, coordinated through the European Data Protection Board.
Third parties
Hosting. The site, its database and its analytics are hosted by Railway Corporation (United States), which processes this data on our behalf. We run them in Railway's EU West region (Amsterdam). See the legal notice for the host's details.
Outbound platform links. Links to reviewed platforms are plain links — we don't use affiliate links today (see our affiliate disclosure). Clicking one takes you to that platform's own site, governed by their own privacy policy — we don't control or receive data from what happens after you leave.
Children
This site is not directed at, and does not knowingly collect data from, anyone under 18. See our content policy.
Changes to this policy
If this policy changes materially, the "last updated" date at the top will move and, where the change is significant, we'll note it on the updates page.