This policy explains what personal information The Fight Fan collects, why we collect it, who we share it with, and the choices you have. It is written to be read, not to be survived.
This document is published in English, and the English text is the version that governs.
Who we are
The Fight Fan is operated by Pallas Tech LLC, which is the controller of the personal information described in this policy.
If you have a question about this policy, or want to exercise any of the rights described below, contact us through our contact page at /contact. We do not publish a direct email address, because an address on a public page attracts far more automated abuse than genuine correspondence.
Information you give us
We ask for information only where there is something we cannot do without it.
- Contact form: your name, your email address, and your message. We use these solely to read and reply. The contents of a contact form submission are never written to our application logs.
- Account registration: your email address and a password. Passwords are never stored as you typed them. They are hashed with scrypt, a deliberately slow algorithm chosen so that a stolen database is not a stolen list of passwords.
- Predictions and picks: if you predict fight outcomes while signed in, we store those picks against your account so that we can score them and show your record.
Information collected automatically
- Standard server request data, including IP address, browser user agent, and the page requested. This is ordinary web-server operation, used to keep the site available and to investigate errors and abuse.
- Analytics data about which pages are viewed and how visitors move through the site, as described under Analytics below.
Cookies
A cookie is a small file that a website asks your browser to keep. We use as few as we can.
- ff_session — set only when you sign in. It is what keeps you signed in from page to page, it is cryptographically signed so that it cannot be forged, and it is strictly necessary: the site cannot offer accounts without it. Sign out and it is discarded.
- Google Analytics cookies, whose names begin with _ga — set on every visit, for the analytics described below. These are not strictly necessary, and you can refuse them as described in the next section.
- Plausible sets no cookies at all, and stores no identifier in your browser.
Analytics, and an honest note about consent
We use two analytics tools. Plausible is cookieless and collects no personal information and no cross-site identifier. Google Analytics 4 tells us more about how the site is used; we run it with Google Signals disabled and advertising personalisation disabled, so your activity here is not fed into advertising profiles.
One thing deserves to be stated plainly rather than buried. Google Analytics 4 sets cookies, and we currently load it without first asking you through a consent banner. If you are in the UK or the EU, the usual expectation is that non-essential cookies are set only after consent is given. We are telling you directly so that you can act on it.
You can opt out at any time by blocking cookies for this site in your browser, by using private browsing, by using any content blocker, or by installing Google's official opt-out browser add-on. Refusing analytics limits nothing: no part of this site is gated on being measured.
Who we share information with
We do not sell your personal information and never have. We do not share it with advertisers or data brokers. It reaches only the service providers that make the site work:
- Microsoft Azure, which hosts the application and the database.
- Google, for Google Analytics, configured as described above.
- Plausible, for cookieless analytics.
- YouTube, when a page carries a video embed. We use the youtube-nocookie.com domain, so YouTube does not set tracking cookies unless you actually play the video. Pressing play is a request to YouTube, and Google's own privacy policy governs it from that point.
- Amazon, if you follow one of our affiliate links, as described below.
Affiliate links
Some links to products are affiliate links, which means we may earn a small commission if you buy something after following one. This never changes the price you pay. Following such a link hands you to the retailer, whose own privacy policy and cookies then apply. We are not paid to give a favourable opinion, and a commission does not buy a recommendation.
Where your information is held
The site and its database are hosted in the United States (Microsoft Azure, East US). If you are outside the United States, your information is transferred there and processed there. We rely on the standard safeguards our hosting and analytics providers make available for such transfers, including standard contractual clauses where those apply.
How long we keep it
- Contact form messages: kept while we deal with your enquiry, and for a reasonable period afterwards in case you follow up, then deleted.
- Account information and predictions: kept for as long as your account exists. Delete the account and they go with it.
- Analytics data: kept according to the provider's retention settings, and no longer than we have a reason for.
Your rights
Depending on where you live you may have some or all of the following rights. We honour them for everyone who asks, wherever they live, because operating two standards would be more work than doing it properly once.
- Ask for a copy of the personal information we hold about you.
- Ask us to correct information that is wrong or incomplete.
- Ask us to delete your information, including by deleting your account.
- Object to, or ask us to restrict, a particular use of your information.
- Ask for your information in a portable, machine-readable form.
- Withdraw consent at any time, where we relied on consent.
- Complain to your data protection regulator. In the UK that is the Information Commissioner's Office; in the EU it is your national authority.
If you are in California
We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act, and we do not offer financial incentives in exchange for personal information. You may exercise the access and deletion rights described above through our contact page, and we will not treat you differently for having done so.
Legal bases, if you are in the UK or EU
- Answering your message: performance of a contract, or our legitimate interest in responding to enquiries.
- Running your account and scoring your predictions: performance of a contract with you.
- Keeping the site secure and available: our legitimate interest in operating a service that works and is not abused.
- Analytics: your consent, where consent is required. See the note above about how that consent is currently obtained.
Children
This site is not directed at children, and we do not knowingly collect personal information from anyone under 13, or under 16 where local law sets that higher age. If you believe a child has given us personal information, contact us and we will delete it.
How we protect information
The site is served only over HTTPS. Passwords are hashed with scrypt. The application sends a strict Content Security Policy, so a script we did not authorise does not run in your browser. Administrative functions are restricted to a named allowlist and additionally require a signed session.
No system is perfectly secure and we will not claim otherwise. What we will say is that we do not collect information we do not need, which is the only protection that cannot fail.
Changes to this policy
We may update this policy as the site changes. The date moves when the text changes, not when the file is touched, so it means something. Last updated: 22 August 2026.