Privacy policy

Effective 5 November 2026 · Version newsletter-2026-11-08 · A Swedish version will follow.

1. Who is responsible (controller)

2. What we process, why, and on what legal basis

2.1 Visiting the site (server logs)

When your browser loads the site, the web server automatically logs the request: IP address, date and time, the page requested, the referring page, browser/OS (user agent) and HTTP status code. Purpose: running the site, fixing errors and protecting against abuse. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in a secure, working site. We don't use these logs to identify or profile visitors. Retention: up to 30 days in the hosting provider’s logs, unless we need them longer to investigate a specific security incident.

2.2 Club newsletter

If you sign up for AOA CHAMP news, Nobelton AB stores: your e-mail address; when you signed up, confirmed and (if applicable) unsubscribed; the exact consent text and version you agreed to; the consent timestamp; a one-way cryptographic hash (HMAC) of your IP address, never the IP itself, used as proof of consent and to block abuse; and sending data (last send time, number of e-mails sent).

Purpose: sending you club and Brawl Stars news and being able to prove your consent. Legal basis: your consent (GDPR Art. 6(1)(a)). Sign-up uses double opt-in: nothing is sent until you click the link in the confirmation e-mail. Giving your e-mail is voluntary. Without it, you just won't get the newsletter.

Withdrawing consent: every e-mail has an unsubscribe link, or you can e-mail us. Withdrawal does not affect anything we did lawfully before it. Retention: unconfirmed sign-ups are deleted after 30 days. After you unsubscribe we keep your address and the unsubscribe date for 12 months, only to prove the unsubscribe and avoid e-mailing you again, and then delete them. Active subscriptions are kept until you unsubscribe. Our newsletters contain no tracking pixels.

2.4 Player card lookups (player tags)

If you enter a Brawl Stars player tag on the Player Card page, our server sends it to Supercell's official Brawl Stars API (api.brawlstars.com) and shows you the public game profile it returns. Purpose: to give you the feature you asked for. Legal basis: legitimate interest (Art. 6(1)(f)) in providing the requested function. The API response is kept in a server-side cache for up to 10 minutes, so repeated lookups don't overload the API, and cache files are deleted within 24 hours. We don't link tags to e-mail addresses or any other data and don't keep a lookup history. Rate limiting uses a hash of your IP address that expires after a few minutes. The last tag you entered is remembered only in your own browser (see 2.6).

2.5 Club leaderboard

The Club page shows the public in-game names, roles and trophy counts of AOA CHAMP members, from Supercell's official API or a public snapshot (brawlace.com). Legal basis: legitimate interest (Art. 6(1)(f)) in presenting the club. This data is already public in the game. We also store a daily club-total trophy figure for the progress chart, which contains no personal data. Members can ask to have their name hidden by e-mailing us.

2.6 Local storage on your device

Games and tools save their state in your browser's localStorage under keys starting with aoa_: Brawldle progress and streaks, your tier list, your quiz result and the last player tag you looked up. This data stays on your device and is never sent to us. It is strictly necessary for features you use (Swedish LEK 9 kap. 28 §), so no consent is needed. You can delete it at any time by clearing site data in your browser.

2.7 E-mails you send us

If you e-mail us, we process your address and message to answer you (legitimate interest, Art. 6(1)(f)). We delete them within 12 months after the matter is closed.

3. Who else processes data (processors & recipients)

We do not sell or share your data for advertising. We transfer no data outside the EU/EEA ourselves. Images loaded from third-party CDNs (Brawlify) may be served from outside the EU, directly between your browser and that provider. brawlace.com is only used by us as a data source and receives no visitor data.

4. Cookies & local storage

We set no cookies and use no analytics, advertising or social-media trackers. Games only use local storage on your device (2.6). See the cookie policy.

5. Your rights

• Access (Art. 15): get a copy of your data
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction (Art. 18) and objection to processing based on legitimate interest (Art. 21)
• Data portability (Art. 20)
• Withdraw consent at any time (Art. 7(3))

E-mail [CONTACT EMAIL – placeholder] to use any of these rights. We answer within one month. You can also complain to the Swedish supervisory authority: Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, www.imy.se, or to the authority where you live or work.

6. Children

Many Brawl Stars players are young. Under Swedish law (Lag 2018:218, 1 kap. 10 §), information-society services may rely on a child's own consent only from age 13. If you are under 13, ask a parent or guardian to sign up for you. If we learn that someone under 13 subscribed without that, we delete the address.

7. Security

Connections use HTTPS. Subscriber data is stored in a password-protected database outside the public web folder. IP addresses are stored only as a hash. Confirm and unsubscribe links are cryptographically signed.

8. Changes

If this policy changes, we update the date above. For a material change to the newsletter, we ask for consent again.