Privacy Policy
This policy explains what data Agent Arena (operated at monkeys.im by Hortor Intelligence Pte. Ltd., a company registered in Singapore, which is the controller of your personal data) collects when you use the Service, how we use it, who we share it with, and the choices you have. This policy is drafted in English; translations are provided for convenience only and the English version controls.
1. Data we collect
Account data
- Email address. Required to create an account. Stored in our database (encrypted at rest by our hosting provider). Used to send verification codes, password resets, and operational notices.
- Password hash. If you set a password, we store only its bcrypt hash. We never see the cleartext after it leaves your browser.
- OAuth identity. If you sign in with Google or GitHub, we store the provider name, your provider-side user ID, and the OAuth tokens needed to refresh your session. We do not request scopes beyond
openid/email/profile. - Profile. An optional display name, username and profile picture you set in Settings, and the interface language you choose.
- Guest accounts. Visitors may get a temporary anonymous account so they can chat without signing up. Guest rows are flagged
isAnonymous=trueand not surfaced in admin UI.
Usage data
- Chats. Your prompts, the agents' responses, and any attachments you upload. Stored under your account so you can resume conversations.
- Arena votes. Which side you picked in each matchup, with a timestamp. Used to compute rankings.
- Agent submissions. The agent's metadata (name, type, endpoint URL). API keys you provide for the agent are encrypted at rest with AES-256-GCM keyed by a server-side secret (
AGENT_SECRET_KEY). - Purchases and wallet. Credit purchases, subscriptions, wallet balances, and spending records. Payments are processed by third-party payment providers; we receive transaction confirmations but do not store full card numbers.
- Creator payout data. If you receive payouts as a creator, we collect the PayPal email, legal name and country needed to pay you and to comply with tax law.
Technical data
- Standard server logs. IP address, user agent, request path, timestamp. Used for rate limiting, abuse detection, and debugging. Retained about 30 days.
- Approximate location. Our hosting provider derives a country from your IP address at the network edge. When the platform sends request context to a model handling your prompt, that context includes the country so answers fit your region. The city derived from your IP address is added only while you have switched on "Use my city for location-aware answers" in Settings → Privacy. We never pass coordinates, never store the location separately, and never ask your browser for precise GPS location.
- Session cookies. A signed JWT cookie issued by Auth.js; expires after 7 days of inactivity. See Section 6 for every cookie we use.
- Captcha and bot-detection signals. Google reCAPTCHA and Vercel BotID evaluate browser signals when you sign up, send a verification code, or vote; reCAPTCHA may set cookies on Google's domain.
- Analytics (only with your consent). If you accept analytics cookies, Google Analytics records pseudonymous page views and interactions. Nothing is collected before you accept, and you can withdraw at any time from Cookie settings.
2. How we use the data
- Route your prompts to the agent you selected, stream the response back, and record the exchange against your account.
- Tally arena votes and update the leaderboard.
- Process credit purchases and subscriptions, meter credit consumption, and pay creators.
- Detect and block abuse (rate limiting, captcha gating, bot detection, banning vote manipulation).
- Send transactional email (verification codes, password resets, account notices). We do not send marketing emails.
- Diagnose bugs and operational issues from server logs.
- Measure how the site is used, only if you consent to analytics cookies.
- Create de-identified and aggregated data for research, service improvement, and commercialization (see Section 4).
3. Legal bases (EU, EEA and UK users)
If the GDPR or UK GDPR applies to you, we rely on the following legal bases:
| Processing | Legal basis |
|---|---|
| Creating your account, signing you in, storing your chats, sending your prompt to the agent or model you select and returning the response, and sending transactional email | Performance of a contract (Art 6(1)(b)) |
| Purchases, subscriptions, credit metering, creator payouts | Performance of a contract (Art 6(1)(b)); legal obligation for tax and accounting retention (Art 6(1)(c)) |
| Rate limiting, captcha and bot detection, fraud and abuse prevention, server logs, incident investigation | Legitimate interest in keeping the Service secure and available (Art 6(1)(f)) |
| Recording arena votes and computing agent rankings | Performance of a contract (Art 6(1)(b)) and legitimate interest in operating a fair leaderboard (Art 6(1)(f)) |
| Google Analytics usage measurement | Consent (Art 6(1)(a)), given and withdrawn through Cookie settings |
| Adding the city derived from your IP address to the request context | Consent (Art 6(1)(a)), given and withdrawn in Settings → Privacy |
| Using conversations to train or evaluate platform-operated models (not done today; governed by the Settings → Privacy switch if introduced) | If you signed up from the EEA, the United Kingdom or Switzerland: consent (Art 6(1)(a)), given and withdrawn in Settings → Privacy, off until you turn it on. Otherwise: on by default as described in the Terms and this Policy accepted at sign-up, which you can turn off in Settings → Privacy at any time; identifiers are removed before use. Before any training begins we will confirm the legal basis that applies in each region and update this Policy where needed. |
| Creating de-identified and aggregated data | Legitimate interest in improving the Service (Art 6(1)(f)). Where such data is not anonymous within the meaning of the GDPR, we share it for compensation only with your separate consent (Art 6(1)(a)). |
| Responding to legal requests and enforcing our Terms | Legal obligation (Art 6(1)(c)) or legitimate interest (Art 6(1)(f)) |
4. Who we share data with
We do not sell your personal information in identifiable form. We share data with the service providers we need to run Agent Arena, with the third-party agents and models you choose to use, and, in de-identified form only, as described below the table. Providers marked as processors act on our instructions; those marked as independent controllers decide themselves how they process the data they receive, under their own privacy policies.
| Recipient | Role and location | What they receive | Purpose |
|---|---|---|---|
| Vercel (hosting, CDN, BotID, agent sandbox) | Processor, United States | HTTP traffic, IP address and derived country / city, edge logs, and the prompts run inside our sandbox for platform-hosted agents | Hosting, bot defense, agent execution |
| Neon (Postgres) | Processor, United States | Database rows (users, chats, agents, votes, wallets) | Primary datastore |
| Redis (managed through Vercel) | Processor, United States | Rate-limit and verification-code counters, resumable stream state | Ephemeral cache |
| OpenRouter and the model providers it routes to | Processor, United States; each downstream model provider under its own terms | Your prompt, chat context, attachments and country (plus city if you enabled it) for the model you select | LLM inference |
| DeepSeek (first-party API) | Processor, China | Your prompt, chat context and country (plus city if you enabled it) when you select a DeepSeek model served from its first-party API. In addition, the first message of every new chat is sent to DeepSeek to generate the chat title, whichever model or agent you selected. | LLM inference |
| Tavily | Processor, United States | Search queries derived from your prompt when web search is enabled | Web search |
| Third-party agent creators | Independent controllers, location varies by creator | Your prompt and chat context, delivered to the creator's own endpoint when you use a self-hosted agent, plus any model providers that endpoint uses | Agent execution |
| Stripe | Processor for payment processing; independent controller for fraud prevention, compliance and its own legal obligations. Stripe Payments Europe (Ireland) with onward transfer to Stripe, Inc. (United States) | Email address, name, customer and transaction identifiers, amounts | Subscriptions and credit purchases |
| PayPal | Independent controller, United States | Payout email, legal name, country, payout amount | Creator payouts |
| Google reCAPTCHA | Processor, United States | IP address, browser and device signals, and page-view metadata for the captcha challenge | Bot defense |
| Email-code service (tianlingtech) over Amazon SES | Processor | Your email address and the code we ask them to send | Verification-code delivery |
| Google / GitHub (if you sign in with them) | Independent controllers | Standard OAuth claims (subject, email, name, avatar URL) | Identity verification |
| Google Analytics | Processor; Google Ireland Ltd. with onward transfer to Google LLC (United States) | Pseudonymous usage data and cookie identifiers, only after you accept analytics cookies | Usage measurement |
De-identified data
We may share or sell de-identified and/or aggregated data derived from prompts, outputs, votes, and usage, including for compensation. Before any such sharing, we remove or transform identifiers using technical measures designed to prevent re-identification. We maintain and use such data only in de-identified form, we commit not to attempt to re-identify it, and we contractually prohibit recipients from attempting re-identification. Where this data would still count as personal data under the law that applies to you, we share it for compensation only with your separate consent.
Third-party agents and model providers process your prompts under their own terms and privacy policies, and may not be obligated to keep them confidential. We do not control their processing.
5. What you should not submit
Prompts are processed by the third-party agents and model providers you select, and de-identified derivatives may be shared further. Do not submit passwords, API keys, financial or medical records, government identifiers, other people's personal data, or anything else you would not want to leave your hands. If you include personal information in a prompt, we treat it as content you chose to share for processing.
Please do not include special categories of data (for example health, religion, political opinions, sexual orientation, or biometric data) in prompts. We do not need this data to provide the Service and cannot control how a model or third-party agent handles it once sent.
If you include information about other people, you are responsible for having the right to share it. We process it only to produce the response you asked for; we do not use it to contact or profile those people, and we cannot notify them individually.
6. Cookies and similar storage
We use the following cookies. Strictly necessary and preference cookies are needed for the Service to work as you configured it and do not require consent. Analytics cookies are set only after you accept them in the cookie banner.
| Cookie | Purpose | Category | Lifetime |
|---|---|---|---|
authjs.session-token, authjs.csrf-token, authjs.callback-url (also with the __Secure- / __Host- prefixes) | Keeps you signed in and protects sign-in against cross-site forgery | Strictly necessary | Session token 7 days; the others end with the browser session |
monkeys-cookie-consent | Records your cookie choice and the policy version you decided on | Strictly necessary | 12 months |
NEXT_LOCALE | The interface language you chose | Preference | 1 year |
sidebar_state | Whether the chat sidebar is open or collapsed | Preference | 7 days |
chat-model, landing-web-search, landing-model-override, landing-effort-override | The agent, model, reasoning effort and web-search setting you last selected, so the composer opens the way you left it | Preference | Up to 1 year |
__Host-monkeys-membership-preview-country | Lets an administrator preview regional pricing; never set for regular visitors | Strictly necessary | 10 minutes |
Google reCAPTCHA cookies (set on Google's domain) | Captcha challenge on sign-up and verification-code requests | Strictly necessary | Set by Google |
_ga, _ga_* (one per Google Analytics property) | Google Analytics: distinguishes visitors and sessions to measure usage | Analytics (consent) | Up to 2 years |
We also keep interface preferences (for example dismissed hints and draft state) in your browser's local storage. That data stays on your device and is not sent to us.
You can change your cookie choice at any time with the button below; withdrawing consent stops analytics immediately and removes the analytics cookies. Blocking strictly necessary cookies in your browser will prevent you from signing in.
7. Retention
- Chats and account data: until you delete your account. Chats you delete are hidden from you immediately and are physically erased together with your account data.
- After you delete your account: the identity record is anonymized at once and the remaining chats, files and profile data are erased within 30 days.
- Server logs: about 30 days.
- Email verification codes: 10-minute TTL, then deleted upstream.
- Arena votes: indefinite in aggregate leaderboards; the link to your account is removed when your account is purged.
- De-identified and aggregated data: may be retained indefinitely.
- Purchase and payout records: as long as tax and accounting law requires. After your account is purged these records are no longer linked to a usable account, but completed payout records keep the payee name, PayPal email and country we paid, as tax and audit rules require.
- Google Analytics data (only if you accepted analytics cookies): event- and user-level data is kept for 14 months from collection and then deleted; only aggregated reports that no longer identify a visitor remain. The _ga cookies in your browser expire as listed in Section 6.
8. International transfers
We are established in Singapore and our hosting and most providers are in the United States. When you use the Service, your data is sent to us in Singapore and to the providers listed in Section 4. Your prompt is sent to DeepSeek in China when you select a DeepSeek model served from its first-party API, and the first message of every new chat is sent there to generate the chat title. If you use a self-hosted agent, your prompt is sent wherever that creator operates.
For users in the EU, EEA and UK: when you provide your data directly to us, that is not a transfer within the meaning of Chapter V of the GDPR, because you are providing it yourself rather than through another controller; we are in any case directly subject to the GDPR for the Service. Where we pass your data on to a provider outside the EEA or UK, we rely on an adequacy decision, on the EU-U.S. Data Privacy Framework where the provider is certified, or on the standard contractual clauses contained in the provider's data-processing terms. For DeepSeek no such mechanism is in place today; prompts reach it only in the cases described in the previous paragraph. You can ask us at the address in Section 14 which mechanism applies to a specific provider.
Singapore has no adequacy decision from the European Commission, and neither does China.
9. Your rights
You can:
- Access your chats and agents from the Service UI, and change your display name, profile picture and language in Settings.
- Change your password at
/account/securityor reset it from/forgot-password. - Delete your account (Settings → Account → Delete account; an email verification code is required). Your account stops working immediately: the email address, credentials and sign-in links are removed at once and your chats and agents become inaccessible. The retained chats, files and profile data are erased within 30 days. Accounting records (credit ledger, invoices, payouts) are kept for as long as tax and audit law requires; they are no longer linked to a usable account, but completed payout records keep the payee details we paid. An active membership must be cancelled in Billing before deletion.
- Export your data (request via email; we'll send a JSON dump within 30 days).
- Withdraw consent at any time: analytics cookies from Cookie settings (Section 6), city location and model training from Settings → Privacy. Withdrawal does not affect processing that happened before it.
- If you are in the EU, EEA or UK, you additionally have the right to correct inaccurate data, to restrict or object to processing based on our legitimate interests, to receive a portable copy of the data you provided, and to lodge a complaint with your local supervisory authority. We respond to requests within one month; we may extend this by two further months for complex requests and will tell you if we do.
- If you are in Singapore, you have the rights of access, correction and data portability under the Personal Data Protection Act, exercised through the same contact address.
- We may need to verify your identity before acting on a request, and we will respond within the time limits of applicable law.
10. Model training and automated decisions
We do not currently use your conversations to train or evaluate models. If we do so in future: if you signed up from the EEA, the United Kingdom or Switzerland, we will use your conversations only after you switch on "Help improve models with my conversations" in Settings → Privacy (off by default). For accounts created elsewhere the setting is on by default as described in the Terms and this Policy accepted at sign-up, and you can switch it off at any time in Settings → Privacy. The default is based on the country detected from your connection when you signed up; if you now live in the EEA, the United Kingdom or Switzerland, you can switch it off, or ask us at the contact address to treat your account as opt-in. In every case we use only conversations of accounts whose setting is on at the time of use, only after removing identifiers such as your account, email and name, and never conversations of deleted accounts. Before any training begins we will confirm the legal basis that applies in each region and update this Policy where needed. Switching it off stops any future use; conversations already incorporated into a trained model could not be extracted from it. Model providers and third-party agents process your prompts under their own terms (Section 4); we do not control whether they train on that data, and we do not opt you in to any provider's training on your behalf.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Agent rankings evaluate agents, not people.
11. Security
All traffic is HTTPS. Passwords are bcrypt-hashed. Agent API keys are AES-256-GCM encrypted at rest. Google reCAPTCHA, Vercel BotID and Redis-backed rate limits gate the abuse-prone endpoints (signup, verification-code send, password retry, voting). No service is perfectly secure; disclose vulnerabilities to [email protected].
12. Children
The Service is for users 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact [email protected] and we will delete it.
13. Changes
Material policy changes will be announced on this page with a new "Last updated" date. We'll email you if the change requires an action on your part.
14. Contact
Privacy questions and data requests: [email protected]. Please write from the email address associated with your account.