What Arena Academy stores

• — There is no database and no account with us. We store nothing about you.
• — Browsing hero pages, rankings and guides is anonymous. No sign-in is needed.
• — If you sign in, the session lives in your own browser and expires after 24 hours.
• — Signing out, or clearing site data, removes everything we hold. There is no copy elsewhere.

Arena Academy is operated by PT RoneAI Teknologi Internasional, trading as RoneAI, an Indonesian company domiciled in Boyolali Regency, Central Java. Indonesian Law No. 27 of 2022 on Personal Data Protection governs us, and this notice is written against it.

It is an unofficial, community-maintained project with no affiliation to Moonton. It reads publicly accessible game data through the Rone Arena API, which we also operate. The API is published at two addresses running the same code — arena.fastapicloud.dev (the default) and arena.rone.dev — and the footer lets you choose between them. A request goes to the address you have chosen. If that address is busy or failing, a public request (never one carrying your sign-in) is retried once against the other address, so a page can still load.

Nothing identifying is collected. Hero pages, rankings, equipment and guides are fetched from the Rone Arena API without anything about you attached, and responses are cached briefly in memory so moving between tabs on a hero page does not refetch.

Your language, theme and data-source choices are kept on your own device — language and data source in cookies so the server can render the right text and ask the right API address, theme in local storage. None of them identifies you, and the theme value never leaves your browser.

As with any website, our host sees your IP address and browser in order to serve the request, and keeps standard request logs under its own retention policy.

Signing in is optional and only needed for the account view. You give your in-game ID and zone, the game emails you a verification code, and that code is exchanged for a session token. We never see or ask for your game password.

The session — the token, your role and zone, and your display name and avatar — is stored in your browser’s local storage and expires 24 hours after sign-in. It is not stored on any server of ours. A session belongs to one API address, so switching the data source in the footer signs you out.

Because the session lives in the browser, requests for your own data are made from the browser with the token attached. Those authenticated responses are never cached: a cache keyed on URL alone would be a way to serve one player another player’s profile, so they bypass both cache layers unconditionally.

Local storage is readable by scripts running on this origin. That is a real trade-off of keeping the session client-side rather than in a server cookie, and it is why the session expires in a day rather than lasting indefinitely. Sign out on a shared computer.

The broadcast overlays and their control panel keep everything in your browser’s local storage on that computer: team names and tags, player names, uploaded team and sponsor logos (shrunk to a small image first), the match and draft, the standby screen and player card text, the scorebar readings, and the panel’s settings, including the OBS WebSocket password if you enter one. Nothing of it is sent to us or stored on any server; exporting a setup saves a file on your own computer.

For the live scorebar, the control panel connects to OBS’s WebSocket on the same computer (it refuses any other address), takes frames of your game capture and reads the numbers in your browser. Frames never leave your computer. The number reader is downloaded once from this site and kept in the browser’s cache and IndexedDB. Importing a team from MPL fetches the league standings from the Rone Arena API, like the esports pages do.

Under Article 20(2)(b) of the Act, signed-in requests are processed to fulfil your own request — you asked to see your account and it cannot be shown otherwise. Server logs rest on Article 20(2)(f), our legitimate interest in keeping the service running.

We do not rely on consent, and there is nothing retained to withdraw it from.

The Rone Arena API, which we operate, and which stores nothing about you. The game’s own servers, which authenticate you and hold the data being displayed under their terms rather than ours. And Cloudflare, which hosts and serves this site.

Cloudflare is established outside Indonesia, so running the service involves a transfer out of the jurisdiction. We rely on Article 56(3): binding contractual protection under the provider’s published data processing terms, because Indonesia has not yet published a list of countries meeting the equivalent-protection test in Article 56(2).

There is no analytics provider and no advertising network here.

The Act gives you information (Article 5), correction (Article 6), access and a copy (Article 7), erasure (Article 8), restriction (Article 11), compensation (Article 12) and portability (Article 13). Where action is needed it allows 3 × 24 hours, not the thirty days European rules use — Articles 30, 31, 40 and 41.

For this site most of those have a short answer: we hold nothing on a server to access, correct or erase. Everything is in your browser, and clearing site data is an immediate and complete erasure that needs no request to us.

To change the underlying account data, go to the game — it is their record and we only display it. For anything else email hello@rone.dev. If our answer does not satisfy you, you may complain to the Ministry of Communication and Digital Affairs, which supervises data protection until Lembaga PDP is established.

Everything is served over HTTPS, and there is no data store here to breach. Report a vulnerability to founder@rone.dev rather than opening a public issue — scope and safe-harbour terms are at rone.dev/security.

We do not knowingly process data from anyone under 18. If what this site does changes, this page changes with it and the date at the top moves.

• PT RoneAI Teknologi Internasional (RoneAI)
• Boyolali Regency, Central Java, Indonesia
• General and data protection: hello@rone.dev
• Security reports: founder@rone.dev

Site-wide terms are at rone.dev/terms.