What Arena Academy stores

The short version

• — There is no database and no account with us. We store nothing about you.
• — Browsing hero pages, rankings and guides is anonymous. No sign-in is needed.
• — If you sign in, the session lives in your own browser and expires after 24 hours.
• — Signing out, or clearing site data, removes everything we hold. There is no copy elsewhere.

Who operates this

Arena Academy is operated by PT RoneAI Teknologi Internasional, trading as RoneAI, an Indonesian company domiciled in Boyolali Regency, Central Java. Indonesian Law No. 27 of 2022 on Personal Data Protection governs us, and this notice is written against it.

It is an unofficial, community-maintained project with no affiliation to Moonton. It reads publicly accessible game data through the Rone Arena API, which we also operate.

Browsing without signing in

Nothing identifying is collected. Hero pages, rankings, ratings, equipment and guides are fetched from the Rone Arena API without anything about you attached, and responses are cached briefly in memory so moving between tabs on a hero page does not refetch.

Your language and theme choices are kept on your own device — language in a cookie so the server can render the right text, theme in local storage. Neither identifies you, and the theme value never leaves your browser.

As with any website, our host sees your IP address and browser in order to serve the request, and keeps standard request logs under its own retention policy.

If you sign in

Signing in is optional and only needed for the account view. You give your in-game ID and zone, the game emails you a verification code, and that code is exchanged for a session token. We never see or ask for your game password.

The session — the token, your role and zone, and your display name and avatar — is stored in your browser’s local storage and expires 24 hours after sign-in. It is not stored on any server of ours.

Because the session lives in the browser, requests for your own data are made from the browser with the token attached. Those authenticated responses are never cached: a cache keyed on URL alone would be a way to serve one player another player’s profile, so they bypass both cache layers unconditionally.

Local storage is readable by scripts running on this origin. That is a real trade-off of keeping the session client-side rather than in a server cookie, and it is why the session expires in a day rather than lasting indefinitely. Sign out on a shared computer.

Why we are allowed to process it

Under Article 20(2)(b) of the Act, signed-in requests are processed to fulfil your own request — you asked to see your account and it cannot be shown otherwise. Server logs rest on Article 20(2)(f), our legitimate interest in keeping the service running.

We do not rely on consent, and there is nothing retained to withdraw it from.

Who else is involved

The Rone Arena API, which we operate, and which stores nothing about you. The game’s own servers, which authenticate you and hold the data being displayed under their terms rather than ours. And Cloudflare, which hosts and serves this site.

Cloudflare is established outside Indonesia, so running the service involves a transfer out of the jurisdiction. We rely on Article 56(3): binding contractual protection under the provider’s published data processing terms, because Indonesia has not yet published a list of countries meeting the equivalent-protection test in Article 56(2).

There is no analytics provider and no advertising network here.

Your rights

The Act gives you information (Article 5), correction (Article 6), access and a copy (Article 7), erasure (Article 8), restriction (Article 11), compensation (Article 12) and portability (Article 13). Where action is needed it allows 3 × 24 hours, not the thirty days European rules use — Articles 30, 31, 40 and 41.

For this site most of those have a short answer: we hold nothing on a server to access, correct or erase. Everything is in your browser, and clearing site data is an immediate and complete erasure that needs no request to us.

To change the underlying account data, go to the game — it is their record and we only display it. For anything else email hello@rone.dev. If our answer does not satisfy you, you may complain to the Ministry of Communication and Digital Affairs, which supervises data protection until Lembaga PDP is established.

Security, children, and changes

Everything is served over HTTPS, and there is no data store here to breach. Report a vulnerability to founder@rone.dev rather than opening a public issue — scope and safe-harbour terms are at rone.dev/security.

We do not knowingly process data from anyone under 18. If what this site does changes, this page changes with it and the date at the top moves.

Contact

• PT RoneAI Teknologi Internasional (RoneAI)
• Boyolali Regency, Central Java, Indonesia
• General and data protection: hello@rone.dev
• Security reports: founder@rone.dev

Site-wide terms are at rone.dev/terms.