Privacy Policy
This is a translation. If it differs from the Spanish version, the Spanish version prevails.
In short
- Prode Age is a free prediction game about the Age of Empires II competitive circuit. It is run by Javier Alejandro Belbruno, who is the controller of your data.
- We ask for the minimum you need to play: your email, a password—or your Google or Discord account—and, if you want, a name and an avatar.
- Your display name and your points appear in the standings, which anyone can see. No other user sees your email. Your individual predictions are seen only by the members of your leagues, and only after the match has closed, if you turned on “Show my predictions to my leagues” in your profile.
- We do not sell data, we do not show ads, and we do not use analytics or tracking cookies.
- You can delete your account from your profile whenever you want. It stops being visible at once, and we keep a copy for 30 days in case you change your mind; then it is deleted with everything that depends on it, except the little we keep for a while, which we detail in section 7.
1. Who the controller is
The controller of Prode Age’s user database is Javier Alejandro Belbruno, who runs the service from Argentina.
For any question about your data, write to us at jbelbruno@helianova.com.ar. That mailbox is hosted by Google, in the United States and other countries: if you write to us without an account, you expressly agree that your message and our replies are stored there (section 5). This is also the contact channel for people in Brazil: as a small-scale processing agent (Resolución CD/ANPD 2/2022), we have not appointed a data protection officer.
2. What data we process
2.1 What you give us when you create and use your account
| Data | Required? | What we use it for |
|---|---|---|
| Yes | Signing you in, confirming that the address is yours, recovering your password, and sending you notices about your account. It is not shown to other users. | |
| Password | Yes, unless you sign in with Google or Discord | Signing you in. We store only an irreversible hash (bcrypt): we never see or store your password. |
| Display name | No | Identifying you in standings and leagues. If you do not choose one, we assign you a generic one, such as “Player 3f9a2c”. If you created your account with Google or Discord, it starts out as the name on that profile. You can change it from your profile whenever you want. |
| Language | Taken from the app’s language (English, if that is not known) | Showing you the app and emails in your language. You can change it from your profile. |
| Avatar | No | Showing it next to your name. You pick it from Prode Age’s own drawings, inspired by Age of Empires II, that come with the app: you do not upload a photo. |
| Predictions | — | Playing: calculating your points, placing you in the standings and, if you turned it on, showing them to the members of your leagues after each match closes. |
| Leagues | — | The name, image, and invite code of the leagues you create, and which leagues you belong to or have asked to join. |
| Creator plan | — | If Prode Age assigns you one so you can have public leagues: its name, its limits, and who assigned it. |
| Reports and messages | — | If you report a user or a league to us, or write to us: what you tell us, who it is about, and your email address. |
| Acceptance of these documents | — | Which version of the Terms and of this Policy you accepted and when, so we can prove it, confirm it to you, and let you know if they change. |
The required data is what is needed to create your account: without it, we cannot provide the service to you. The rest is optional. If you give us inaccurate data—for example, an email that is not yours—you may be unable to recover your account or to receive our notices.
2.2 If you sign in with Google or Discord
Only if you choose that option. Google or Discord send us your basic profile: an identifier for your account, your email and whether they verified it, and details such as your name, your photo, or your language.
Of all that, we store only your account identifier, your email—only if the provider verified it—and, only when your account is created, a display name: with Google, your first name (or your full name, if Google does not give us your first name); with Discord, your display name or your username. The rest is discarded without being stored. If you created your account with Google before September 23, 2026, your display name started out as your full Google name; you can change it from your profile.
We do not receive your Google or Discord password, or your contacts, servers, friends, or messages. The access the provider gives us is used only once, to read that profile, and we do not keep it. We never post anything on your behalf.
To send you to the provider and receive you back, we pass it a signed piece of data that indicates the app’s language, the version of these documents you were shown, the page to return to and, if you are linking an account, your internal identifier.
Prode Age’s use of information received from Google APIs adheres to the Google API Services User Data Policy. We use it only to create your account, to let you sign in, to send you your account emails, and—only your name, as an initial display name you can change—to show you in the standings. We do not sell it, we do not use it for advertising, and we share it only with the providers in section 5, who help us provide the service.
2.3 Technical data
- Application logs. Date and time, the requested address—without the parameters that carry credentials, searches, or invite codes—the result, the duration and, if you are signed in, your internal user identifier. We also log events on your account associated with that identifier: signing up with Google or Discord, linking accounts, closing sessions, closing the account, and moderation actions. These logs do not record your IP address or your browser. Any email addresses that may appear are stored masked, for example
j***@ejemplo.com. - Web server logs. The IP address the connection comes from—which may be that of our own intermediary server—the requested address without parameters, and the browser type.
- Abuse protection. To limit repeated attempts, for example at signing in, we count requests per IP address or per account. Those counters live only in the server’s memory: they are never written to disk and are discarded when the service restarts.
- Anti-bot check. When you create an account with an email and password—and when someone tries to sign in to an account after several wrong passwords—your browser loads a Cloudflare Turnstile check that confirms you are a person and not a program. Most of the time you do not have to do anything. To do this, Cloudflare receives your IP address, technical data about your browser and connection, and our site’s address (section 5). We receive only whether the check passed, and we do not store it. It never loads if you only visit the site, or if you sign in with Google or Discord.
- Sessions. For each session, we store an irreversible hash of its credential, when it was issued, when it expires and, if it was closed, when. Because the app renews it while you use it, these records show when you used the service.
We use technical data only for the security of the service, to prevent abuse, and to diagnose faults.
2.4 Professional players’ data
We show the names, aliases, countries, and teams of professional players as published by Liquipedia under a CC BY-SA license. This is public data about their competitive activity. If you are one of those players and something is wrong, you can correct it on Liquipedia or write to us (section 1).
3. What we use it for, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and maintaining your account, letting you make predictions, calculating points, and showing standings and leagues | Account, predictions, leagues | Providing the service you accepted (Ley 25.326, art. 5.2.d; GDPR, art. 6.1.b; LGPD, art. 7.V) |
| Sending you your account emails: confirming your email address, password recovery, confirmation that your account was closed, and notices about the service—changes to these documents, moderation of your account, security incidents, or the shutdown of the service | Email, language | Providing the service |
| Keeping a record of which version of these documents you accepted | Version and date | Providing the service and being able to prove your acceptance (GDPR, art. 6.1.f) |
| Protecting the service, preventing abuse, handling reports, and diagnosing faults | Technical data about users and visitors—including what Cloudflare receives for the anti-bot check—, reports | Our legitimate interest in a secure and usable service (GDPR, art. 6.1.f; LGPD, art. 7.IX), within the relationship we have with you |
| Showing professional players’ data | Name, alias, country, and team, taken from Liquipedia | Data from sources with unrestricted public access (Ley 25.326, art. 5.2.a) and our legitimate interest in reporting on the competition (GDPR, art. 6.1.f; LGPD, art. 7.IX) |
| Sending your email to Resend, in the United States; storing the emails we exchange at Google, in the United States and other countries; and having Cloudflare run the anti-bot check from its global network, including the United States (see section 5) | Email, the content of your account emails and of the emails we exchange, and the technical data of the anti-bot check | Your express consent, which you give by accepting this Policy—when you create your account or, if your account is older, in the app—; if you have no account, by writing to us after the notice that accompanies our address (Ley 25.326, art. 12; Decreto 1558/2001, Anexo I, art. 12) |
| Complying with legal obligations or requests from competent authorities | Whatever is necessary | Legal obligation |
We do not use your data for advertising, we do not build profiles, and we do not send you promotional emails. Points are calculated automatically, but by applying public rules that are the same for everyone (they are in the Terms); we do not make automated decisions that affect you in any other way.
4. What other people can see
- Anyone, even without an account: each tournament’s standings, with your display name, your points, and an internal identifier.
- Anyone who has the address of an image: league images are served without having to sign in.
- Members of your leagues: your display name, your avatar, and your points within that league and, if you turned it on, the prediction you made for each match of that league once the match has closed.
- The creator of a league you asked to join: your display name, your avatar, and the date of your request.
- In the public league directory: the name, image, and number of members of each league, but not who they are.
- Prode Age administrators: account data, including email, and reports, in order to operate and moderate the service.
No other user can see your email, your linked accounts, or your language. Outside your leagues, nobody sees your individual predictions.
After a match closes, we may show how many people chose each side (for example, “62% with Barles”), only when there are at least 20 predictions. It is an anonymous total: it does not show any individual prediction or who made it.
5. Who we share it with
We do not sell or rent your data. We share it only with providers that process it on our behalf, to provide the service:
| Provider | What it does | What data it receives | Where |
|---|---|---|---|
| Hetzner Online GmbH | Hosts the servers and the database | All of the service’s data | Finland (European Union) |
| Cloudflare, Inc. (Cloudflare R2) | Stores the database backups | All of the service’s data | European Union: we use the service’s EU jurisdiction, which stores the backups only in the European Union |
| Cloudflare, Inc. (Cloudflare Turnstile) | Checks that whoever creates an account—or tries to sign in after several wrong passwords—is a person and not a program | Your IP address, technical data about your browser and connection, and our site’s address | Its global network, including the United States |
| Resend, Inc. | Sends your account emails | Your email, your language, and the content of the message | United States |
| Google (Google Workspace) | Hosts our contact mailbox: stores the emails we exchange | Your email, whatever you write to us, and our replies | United States and other countries where Google or its subprocessors have facilities |
If you sign in with Google or Discord, they process the data of that account under their own privacy policies; we receive only what is described in section 2.2.
Cloudflare also uses the signals of the anti-bot check on its own behalf, as a controller, to improve its bot detection, under its own privacy policy.
The whole app is served from our own domain, fonts included: to display it, your browser does not connect to Google or any other third party. The only exception is Cloudflare’s anti-bot check, which loads only when you create an account with an email or try to sign in after several wrong passwords.
Liquipedia provides us with tournament and match data. We do not send it any user data.
We may also hand over data if a law or an order from a competent authority requires us to.
International transfers
Our servers are in Finland, and the backups are stored in the European Union. The AAIP includes the countries of the European Union among those with an adequate level of protection (Disposición DNPDP 60-E/2016, art. 3, as amended by Resolución AAIP 34/2019). For people in the European Union, the European Commission recognizes the same level for Argentina (Decision 2003/490/EC).
Resend and Google store data in the United States, which is not on that list; Google may also store it in other countries where it has facilities, its own or its subprocessors’, and some of them are not on the list either. Cloudflare runs the anti-bot check from its global network, which includes the United States. We send Resend your email and the content of your account emails, the emails we exchange—the ones you send us and our replies—are stored at Google, and Cloudflare receives the technical data of the check. By accepting this Policy—when you create your account or, if your account is older, in the app—you expressly agree to these transfers; if you have no account, you agree to them by writing to us after the notice that accompanies our address. We also rely on each provider’s contractual safeguards; you can ask us for a copy of those safeguards. If you withdraw that consent, write to us: we will stop sending you notices and delete from our mailbox the emails we exchanged—yours and our replies—except any request or report still open, which we delete once it is resolved; we keep only a note of your withdrawal so we can honor it. If you later ask to recover your password or you delete your account, we will send you only the email for that request.
6. What we store in your browser
- Local storage: your session credentials—which include, in readable form, your user identifier and your email—and, if you arrived through an invitation, its code until you try to join the league or sign out. The credentials are deleted when you sign out.
- A technical cookie, only while signing in with Google or Discord: it checks that the browser coming back from the provider is the same one that left. It contains no personal data and lasts at most 10 minutes.
- The anti-bot check, only if you create an account with an email or try to sign in after several wrong passwords: it runs inside a frame of Cloudflare’s own, which may store there what is strictly necessary for that check. It leaves nothing on our domain.
- Cached app files, so that the app loads faster.
All of this is strictly necessary for the service to work. We do not use analytics, advertising, or tracking cookies or technologies, and that is why we do not ask for your consent to them.
7. How long we keep data
| Data | Period |
|---|---|
| Your account and everything that depends on it: profile, predictions, points, linked accounts, and the leagues you created | For as long as your account exists. When you delete it, they stop being visible at once and we keep a copy for 30 days, seen by nobody, to restore it if you change your mind; it is deleted sooner if you register again with the same email or the same Google or Discord account, or ask us to delete it. |
| Your leagues’ images | Kept with the copy of your deleted account and deleted with it; nobody can see them meanwhile. Those you replace or remove, within the following day. |
| Closed or expired sessions | 30 days after they end |
| Used or expired password recovery links | 7 days |
| Used, replaced or expired email confirmation links | 1 day |
| Result of the anti-bot check | We do not store it. Cloudflare keeps its data under its own policy. |
| Temporary data from signing in with Google or Discord (expires after 2 minutes) | 1 day after it expires |
| Requests to join a league | Pending ones, for as long as the league exists. Those already accepted or rejected, 12 months after they are resolved. In every case, they are deleted sooner if the league’s creator removes you from it or if you delete your account. |
| Reports | Up to 12 months after an administrator resolves them and, in any case, at most 24 months from when they were made. If you delete your account, reports about it are kept for those periods. |
| Emails we exchange (questions, requests about your data, reports) | Until they are resolved, plus 12 more months, and at most 24 months |
| Technical logs | Rotated automatically, with a maximum of 50 MB per service, and discarded when the service is recreated. |
| Backups | At most 30 days. They are used only to restore the service after a failure. |
Copies of images that browsers keep in their own cache are outside our control and may persist for a while.
8. How we protect it
We use encrypted connections (HTTPS). We store passwords with bcrypt, and session and recovery credentials only as irreversible hashes. Your sessions can be revoked—with “Sign out everywhere” or by changing your password—and they are invalidated immediately. Logs do not store credentials, and administrative access is restricted.
No system is infallible. If an incident compromises your data, we will let you know and will inform the authorities where applicable.
9. Your rights
You have the right to:
- Access your data and receive a copy, including in a reusable format.
- Rectify and update it.
- Erase it, including your entire account.
- Object to processing or ask us to restrict it.
- Withdraw your consent at any time, without affecting what was done before.
How to exercise them: you can change your name, your language, and your avatar from your profile, and that is also where you can delete your account, with “Delete my account”. For everything else—getting a copy of your data, changing your email, objecting to or restricting processing—write to us at jbelbruno@helianova.com.ar from your account’s email, or by proving in some other way that you are the account holder. It is free. That mailbox is hosted by Google, in the United States and other countries: if you write to us without an account, you expressly agree that your message and our replies are stored there (section 5).
Deadlines: we answer access requests within 10 calendar days, and requests for rectification, updating, or erasure within 5 business days (Ley 25.326, arts. 14 and 16). Access is free once every six months, or sooner if you show a legitimate interest. If the European Union’s General Data Protection Regulation (GDPR) applies to you, we answer within one month; if Brazilian law (LGPD) applies to you, we give you the complete access information within 15 days.
Complaints: you can file a complaint with the supervisory authority whenever you want, although we suggest writing to us first so we can try to resolve it. You can also bring a habeas data action in court (Ley 25.326, art. 33).
LA AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales.
Translation: THE AGENCY FOR ACCESS TO PUBLIC INFORMATION, in its capacity as the Supervisory Body of Ley N° 25.326, has the power to handle the reports and complaints filed by anyone whose rights are affected by non-compliance with the rules in force on personal data protection.
If you are in the European Union, you can file a complaint with the supervisory authority of the Member State where you live; in Brazil, with the Autoridade Nacional de Proteção de Dados (ANPD).
10. Minors
Prode Age is for people aged 13 or over. If you are not yet 18—or the age your country sets as the age of majority—your parent or guardian must authorize you to use Prode Age, and they can also exercise the rights in section 9 on your behalf. If we know that an account belongs to someone under 13, we delete it. If you are a parent or guardian and believe your child has given us data, write to us (section 1).
11. Changes to this Policy
We publish each version with its date. A new version does not apply to your account until you accept it: we show it to you in the app and ask you to accept it to keep using the app. If the change is significant, we also notify you by email at least 15 days in advance, unless a law or a security reason requires us to apply it sooner. If you do not agree, you can ask us for a copy of your data and delete your account, at no cost.
12. Contact
Javier Alejandro Belbruno · Argentina · jbelbruno@helianova.com.ar
That mailbox is hosted by Google, in the United States and other countries: if you write to us without an account, you expressly agree that your message and our replies are stored there (section 5).