Privacy Policy

1. Who handles your data

Dota4Newbie is run by one person, from Indonesia, and that person is responsible for the data described on this page. Any question or request about your data can go to admin@dota4newbie.com, or through the Contact page.

2. What we collect

What actually gets stored:

• From Steam sign-in: your Steam ID, display name, and profile picture. Your Steam password never reaches us.
• What you enter yourself: display name, username, email (optional, used for receipts and account notices), your MMR and coach quiz answers, and the posts, builds, messages, and reports you write.
• Your Dota 2 match history, fetched from OpenDota using your public Steam ID — the same data anyone can already see there.
• Transaction records: order number, amount, status, and payment method from Midtrans or PayPal. Card numbers never reach us. For coaches, the bank account or e-wallet a payout goes to is stored as well. For Arcana gifts: the code, the message you write for the recipient, and who bought and who claimed it. The buyer's display name and profile picture are shown to anyone who opens that code, and the claimer's display name is shown to the buyer.
• Ordinary technical records: IP address and request logs, used for security and rate limiting. The country your connection comes from, as the hosting provider reports it from the IP address, is used on the spot to pick your starting language and tailor a few lines of the page, and is not stored.

3. What it is used for

Your data is used to:

• Run your account and the site's features, including Arcana's analysis of your match history
• Calculate rank points and show the community leaderboard
• Process payments and refunds through Midtrans or PayPal, and transfer coaches' earnings to their payout destination
• Send notices about your account and transactions — not marketing spam
• Keep the place safe: prevent abuse, act on reports, and enforce the Terms of Use

4. Third parties that process it

We do not sell your data. These services process it because the site runs on them:

• Midtrans — payments. Receives your name, email, amount, and transaction details.
• Vercel — application hosting, Singapore region.
• Neon — the database, Singapore region.
• Cloudflare — DNS and content delivery.
• Resend — transactional email delivery. Receives the address and the message.
• STRATZ, OpenDota and Steam (Valve) — the source of match data and of sign-in identity.
• Upstash — the counters behind request rate limiting.
• PayPal — Arcana payments from outside Indonesia. Receives the amount, the order number and the plan; your name, email and payment method you give to PayPal directly.

5. Data is stored outside Indonesia

The application and its database run in Singapore, and the providers above may process data in other regions. We choose providers that apply comparable safeguards, and the transfer happens only as far as running the service requires.

6. How long it is kept

Account data is kept while your account exists. Arcana score snapshots are trimmed automatically after two years; read notifications and short-lived sign-in tokens are swept far sooner by a daily job. Transaction records are kept longer because bookkeeping and dispute resolution need them, even after an account is deleted.

7. Security

We store no passwords — authentication is entirely through Steam. Every connection uses TLS, and the contents of member-to-member messages are encrypted at rest, so they are not readable straight out of the database. No system is perfect, but this is what we do.

8. Cookies

We use cookies for your sign-in session and your language choice. There are no third-party advertising trackers, and no analytics that follow you to other sites. You can clear cookies at any time from your browser — the only effect is being signed out.

9. Your rights

You may ask for a copy of the data we hold, correct anything wrong, delete your account and its data, and withdraw consent where consent is what we relied on. Send the request through the Contact page; deletion is processed within seven working days at the latest. We handle these rights in line with Indonesia's Law No. 27 of 2022 on Personal Data Protection.

10. Children

The service is not intended for children under 13 and we do not knowingly collect their data. If you are a parent or guardian and find that your child has created an account, contact us and we will delete it.

11. Moderation and content review

When you report something, we store your report, the reported content, and the outcome of the review — and the person you reported is never told who reported them. Separately, messages between members are checked automatically for contact patterns (phone numbers, social handles) while the two parties have no paid booking together. That check raises a warning for both sides and records that the pattern appeared, along with the message id — not the number or handle detected, and not the message itself. The reason: transactions off the platform have no escrow behind them, and the person who loses is almost always the one who paid. Message content is not read by a person unless a report includes it.

12. Changes to this policy

If something significant changes, we notify you on the site and at your registered email at least seven days before it takes effect, and update the date at the top of this page.