Cobra Arena logoCOBRA ARENA Back to home

Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains how Clouds Ecom LTD, trading as Cobra Arena ("we," "us," "our"), collects, uses, and protects your personal data when you use the Cobra Arena website and platform (the "Service").

Data controller:
Clouds Ecom LTD (trading as Cobra Arena)
71-75, Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company No. 16846181
Phone: +41 78 311 67 96

1. What Data We Collect

Account data. When you sign up, we collect your email address, password (stored in encrypted/hashed form, never in plain text), and any display name or profile information you choose to provide. If you sign in with Google, Apple or LinkedIn instead of a password, we receive the basic profile details that provider shares with us (your email address and, where shared, your name and profile picture) and no password is created. With Apple you can choose "Hide My Email": we then only see a private relay address that forwards to you, and Apple shares your name only the first time you sign in, if you choose to (unless you already chose a display name, we use it as yours; you can change it at any time).

Payment data. When you subscribe, payment is processed by Stripe, Inc. We do not receive or store your full card number. We retain limited billing metadata (such as your subscription status, plan, and billing history) necessary to manage your account.

Usage & progress data. We collect data about your activity on the Service: lessons completed, quiz and exam results, exercise answers, streaks, achievements, and time spent — so we can deliver the progressive-unlock system and track your learning progress. When you complete onboarding we also store the goal, first arena and daily rhythm you choose, and your browser's time zone (so that "today" for your streak is your own day).

Community data. If you post in community channels, we store the content of your messages and associate them with your account. Other members see your posts together with your display name and rank. You can delete your own posts at any time.

Weekly leagues. When you earn XP in a week, you join a league group of up to 30 members. The other members of your group see your display name, level and XP for that week; nobody else does.

Public profile and portfolio. Your profile is private unless you publish it. If you do, anyone with its link can see your display name, the short bio you write, your level and rank, how many lessons and titles you have, your best streak, the month you joined, your certificates, your skill constellation (for each arena and module, how many lessons you cleared, shown as stars that shine brighter when an exercise passed on the first try or a module quiz went well, and gold when the arena is certified), and the exercises you choose to show (your graded answer, the lesson it answered and any note you add). It is not listed in search engines. It is only online while your membership is active (it goes offline if your membership ends and comes back if you rejoin), and you can take it offline or remove any piece of work at any time. The addresses you have used stay reserved to you, so a link you shared can't point to someone else.

Squads. If you join a squad, its members (up to five) see your display name, level, streak, the weekly goal and focus line you set, how many lessons you cleared this week, and the cheers you send. We keep each week's result (goal and lessons cleared) for the squad's check-in. If you have not cleared a lesson for 14 days you are moved out of the squad automatically; you can leave or join again at any time.

Free account and tips emails. With a free account (no payment details) you can take the first lesson of each arena; we store the same usage and progress data as for members. If you tick "email me a few tips" during onboarding, we send you at most four emails over your first two weeks about your free lessons and membership. Every one has an unsubscribe link, and we stop them as soon as you become a member.

Streak reminders. If your streak is still waiting for you on a given day, we send one short email at the hour you choose (7 PM in your time zone unless you change it). You can change the time or turn these emails off at any time from your account page or with the link in every reminder.

Coach Cobra. When you ask the AI coach a question, we store your question and its answer with the lesson, so the conversation is still there next time and on your other devices. You can clear a conversation at any time from the coach panel.

Missions. When you send proof for a mission, we store the link and the write-up you submit, whether you attached a screenshot, the result of the check with its feedback, and the XP it earned. Screenshots are sent to our AI provider for the check and are never stored. To check a link, our server opens that public page once, like any visitor would, and reads its title and text; we don't keep a copy of the page. Missions never ask for payments, real trades or personal details, and we ask you to blur names and personal information in screenshots.

Sparring. When you practise a conversation in Sparring, we store the messages you write, the AI character's replies, the score and feedback from the AI judge, and the XP it earned, so you can review your past bouts. Your messages are sent to our AI provider to write the character's replies and the verdict. Bouts are role-play: please don't include personal details about real people.

Certificates. When you earn a certificate, we create a certificate page showing your display name, the arena, the date and a credential ID. The page is only reachable through its link, which you choose whether to share, and it is not listed in search engines.

Advertising data. We may advertise Cobra Arena on Google. Only if you accept advertising cookies, the Google tag records that you arrived from one of our ads and whether you then became a member (with the amount paid), so we can see which ads work. We do not send Google your name, email address or lesson activity. If you decline, the Google tag is not loaded at all.

Technical data. We automatically collect certain technical information, such as your IP address, browser type, device information, and general usage logs, for security, troubleshooting, and service-improvement purposes.

2. How We Use Your Data

We use your data to:

  • Create and manage your account and subscription;
  • Process payments and billing through Stripe;
  • Deliver course content and track your learning progress;
  • Enforce the progressive-unlock and access-control system;
  • Communicate with you about your account, billing, or the Service (including onboarding, reminders, and support);
  • Improve and maintain the Service, including troubleshooting and security monitoring;
  • Measure how well our advertising works, only if you accept advertising cookies;
  • Comply with legal obligations.

We do not sell your personal data to third parties, and we do not use your lesson activity or answers for advertising.

3. Legal Basis for Processing (UK/EU GDPR)

Where applicable, we process your data on the following legal bases:

  • Contract — processing necessary to provide the Service you subscribed to;
  • Legitimate interests — improving and securing the Service, preventing fraud;
  • Consent — for optional communications, analytics cookies and advertising cookies, which you can withdraw at any time;
  • Legal obligation — where we must retain data to comply with tax, accounting, or other legal requirements.

4. Third-Party Processors

We share limited data with trusted third-party service providers who process it on our behalf, strictly to operate the Service:

  • Stripe, Inc. — payment processing and subscription billing;
  • Supabase Inc. — database hosting (European Union region), authentication, and secure data storage;
  • Vercel Inc. — website hosting and delivery, and anonymous page-speed measurement (Speed Insights, which uses no cookies);
  • Mux, Inc. — secure hosting and streaming of course videos;
  • Resend, Inc. — sending account and service emails;
  • Anthropic, PBC — AI grading of the answers you submit to lesson exercises, answers from Coach Cobra, the AI coach in each lesson, the check of the proof you send for missions, and the AI characters and judge in Sparring (your answer, question, proof — including any screenshot — or sparring messages, and the lesson, mission or scenario material are sent to generate a response; Anthropic does not use this data to train its models under its commercial terms);
  • Functional Software, Inc. (Sentry) — error monitoring, so we can find and fix technical problems;
  • PostHog, Inc. — product analytics (pages visited and key steps such as signup or starting a lesson), only if you accept analytics cookies;
  • Google LLC / Google Ireland Limited (Google Ads) — measuring which of our ads lead to a membership, only if you accept advertising cookies;
  • Upstash, Inc. — rate limiting to protect the Service from abuse (processes your account identifier only).

These providers are contractually bound to protect your data and use it only for the purposes we specify. We do not permit them to use your data for their own marketing purposes.

Sign-in with Google, Apple or LinkedIn. If you choose "Continue with Google", "Continue with Apple" or "Continue with LinkedIn", you sign in on that provider's own page — Google LLC, Apple Inc., or LinkedIn (LinkedIn Ireland Unlimited Company for members in Europe, LinkedIn Corporation elsewhere) — and that provider tells us who you are (see "Account data" above). Nothing is sent to these providers unless you choose that option. For that sign-in they act as independent controllers under their own privacy policies.

5. International Data Transfers

Our service providers may process data in countries outside the United Kingdom or European Economic Area, including the United States. Where this occurs, we rely on appropriate safeguards recognized under UK/EU data protection law, such as Standard Contractual Clauses, to ensure your data remains protected.

6. Data Retention

We retain your personal data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. If you request account deletion, we will delete or anonymize your personal data, except where retention is required by law (for example, billing records).

7. Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you;
  • Correct inaccurate or incomplete data;
  • Delete your personal data ("right to be forgotten"), subject to legal retention requirements;
  • Restrict or object to certain processing;
  • Port your data to another service in a structured, machine-readable format;
  • Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us using the details below. We will respond within the timeframe required by applicable law.

If you are located in the UK or EEA, you also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office — ico.org.uk).

Additional information for your region

United Kingdom and European Union. The rights above apply under the UK GDPR and the EU GDPR, and you can complain to the ICO (ico.org.uk) or your local data protection authority.

Canada. We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (Law 25). You can access and correct your information, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information. The person responsible for personal information at Cobra Arena can be reached with the contact details below.

California and other US states. In the last 12 months we collected the categories of information described in section 1 (identifiers, commercial information about your membership, internet activity on the Service, and the content you submit), for the purposes in section 2. We do not sell personal information. Advertising cookies may count as "sharing" for cross-context behavioral advertising under California law: they are off unless you accept them, you can turn them off at any time with "Cookie settings", and we treat a Global Privacy Control signal from your browser as a refusal of advertising cookies. You have the right to know, delete and correct your personal information, and we will not treat you differently for exercising these rights.

India. Under the Digital Personal Data Protection Act, 2023, you can request a summary of your personal data and how it is used, correct, complete or erase it, withdraw consent, and nominate someone to exercise your rights. Contact us with the details below for any grievance; if you are not satisfied with our answer, you may approach the Data Protection Board of India.

Singapore. Under the Personal Data Protection Act 2012, you can request access to and correction of your personal data and withdraw consent. You can contact the Personal Data Protection Commission (pdpc.gov.sg) if you are not satisfied with our answer.

Philippines. Under the Data Privacy Act of 2012, you have the right to be informed, to access, object, correct, erase or block your data, to data portability, and to complain to the National Privacy Commission (privacy.gov.ph).

Malaysia. Under the Personal Data Protection Act 2010, you can request access to and correction of your personal data and limit its processing, including for direct marketing.

8. Cookies

We use cookies and similar technologies that are strictly necessary to operate the Service (for example, to keep you logged in and maintain your session). These do not require consent.

With your consent only, we use two optional kinds of cookies, which you can accept or decline separately ("Choose" in the banner):

  • Analytics cookies (PostHog) — to understand how the Service is used and improve it. Until you accept, no analytics cookies are set and no analytics events are sent.
  • Advertising cookies (Google Ads) — to measure which of our ads lead to a membership (for example the _gcl_au cookie, kept for up to 90 days). Until you accept, the Google tag is not loaded and nothing is sent to Google. We use Google Consent Mode to pass your choice to Google.

You can accept or decline in the banner shown on your first visit, and change your choice at any time with the "Cookie settings" link at the bottom of our pages. If you withdraw consent, we stop the measurement and remove these cookies from your browser.

Vercel Speed Insights measures page speed anonymously and does not use cookies. We store your cookie choice itself in your browser's local storage so that we don't ask again.

9. Data Security

We implement technical and organizational measures to protect your data, including encryption in transit, access controls, and row-level security on our database. No system is completely secure, but we work to protect your data using industry-standard practices.

10. Children's Privacy

The Service is not directed at, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you (for example, by email or a notice within the Service) before the changes take effect.

12. Contact Us

For any questions about this Privacy Policy or to exercise your data rights, contact us at:

Clouds Ecom LTD (trading as Cobra Arena)
71-75, Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company No. 16846181
Phone: +41 78 311 67 96

HomeTerms of Service