Legal

Privacy Policy

Last updated: 22 July 2026

1. Who we are

Arodly is a consumer SaaS platform where people practice and improve their negotiation skills through structured, gamified scenarios. Arodly is operated by Arodly. Contact: arodly.admin@gmail.com Website: https://www.arodly.com

2. Who this policy applies to

This policy applies to all visitors and registered users of arodly.com. By creating an account or using the platform, you agree to the practices described in this policy. Arodly is not intended for use by anyone under the age of 16. By creating an account, you confirm that you are at least 16 years old. If we become aware that a user is under 16, we will delete their account and associated data.

3. What data we collect

Data you provide directly

Email address — collected at signup, used for authentication and account communications

Password — hashed and stored securely by Supabase Auth; we never see or store your plain-text password

Nickname — a public display name you choose when setting up your profile

Avatar selection — a numbered avatar choice used on your public profile

Data generated through use

Gameplay statistics — total points, games played, wins, losses, draws, current streak, last played date

Match history — scenario name, opponent (if PvP), outcome, and date for each completed match

Negotiation chat content — messages sent during PvAI and PvP matches

Negotiation Insights data (Pro users only) — per-match scores across five parameters, detected negotiation style, improvement tips, and trend data

Activity data — dates on which you played, used to generate your activity calendar

Data we do NOT collect

Real name

Phone number

Payment card details — handled entirely by Stripe — we never see or store card information

Location data — beyond what is captured automatically by Supabase authentication infrastructure

Browser fingerprints or device identifiers

Third-party tracking or advertising data

4. How we use your data

To provide the service — authentication, gameplay, scoring, match history, and profile display

To improve the service — understanding how the platform is used in aggregate to make product decisions

To communicate with you — account-related emails such as password reset and email confirmation

To enforce our Terms of Service — including detecting and acting on abuse or policy violations

To process payments (Pro users) — we pass your email to Stripe to manage subscriptions

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in Section 5.

5. Who we share your data with

Service	Purpose	Data shared
Supabase	Database, authentication, and real-time infrastructure	All user and gameplay data
Vercel	Hosting and deployment	Request logs and server-side rendering
Anthropic	AI opponent (Claude API)	Negotiation chat messages sent to the AI opponent during PvAI matches
Stripe	Payment processing (Pro users)	Email address and subscription details

6. Public data on Arodly

The following information is publicly visible to any authenticated user on the platform: nickname and avatar, ranking tier and total points, win/loss/draw record, current streak, activity calendar, recent match history, and negotiation style (Pro users). Your email address is never publicly visible. Match transcripts are visible only to you and (for PvP matches) your opponent.

7. Data retention

We retain your data for as long as your account is active. If you request account deletion, we will delete your personal data within 30 days. Some anonymised aggregate data may be retained for analytics purposes after deletion.

8. Your rights

Depending on where you are located, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict its processing. To exercise any of these rights, contact us at arodly.admin@gmail.com. We will respond within 30 days. New Zealand users may also contact the Office of the Privacy Commissioner at privacy.org.nz. EU/UK users may contact their local data protection authority.

9. Cookies and local storage

Arodly uses cookies for authentication session management only. These are set by Supabase Auth and are necessary for the platform to function. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

10. Data security

All data in transit is encrypted via HTTPS/TLS

Passwords are never stored in plain text — Supabase Auth handles hashing

Row-Level Security is enforced on all database tables

Server-side secrets are never exposed to the browser

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at arodly.admin@gmail.com.

11. International data transfers

Arodly is operated from New Zealand. Your data may be stored and processed in data centres located outside New Zealand, including in the United States and European Union, by our infrastructure providers. These providers maintain appropriate data transfer mechanisms in compliance with applicable law.

12. Children

Arodly is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has created an account, please contact us at arodly.admin@gmail.com and we will delete the account promptly.

13. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify registered users by email.

14. Contact

For any privacy-related questions, requests, or complaints: Email: arodly.admin@gmail.com Website: https://www.arodly.com