Privacy

Last updated: 10 October 2026. Comments are live where comments.enabled is true. This notice covers Comments, Community Picks, and account data, including sign-in, moderation, privacy, account export, and account deletion controls.

Who runs this site

FightCardIQ is an independent, fan-made MMA editorial site. For privacy, account, export, deletion, or removal requests, use the contact path published on the site or email the operator at privacy@fightcardiq.com. We act as the controller for data we collect directly through the site.

Our legal bases are: legitimate interests for site operation, security, abuse prevention, moderation, and privacy-preserving analytics; contract or account-service necessity for signed-in comments, saved Community Picks, sessions, exports, and deletion requests; consent or your deliberate action where you choose to sign in with Google or activate an embedded YouTube video, X post, or Reddit post; and legal obligation where we must preserve, disclose, or remove information to comply with law.

Analytics

Signed-out reading is cookieless. We use two privacy-focused analytics tools to understand which pages are useful: our own Umami analytics server, hosted by Hostinger in the United States, records page views, the referring site, approximate location (country, region and city), browser and device type, screen size, language and a few interactions such as opening or sharing a video; Cloudflare Web Analytics measures page visits, the referring site, approximate country, browser and device type, and page loading speed. Neither uses cookies, ad tracking, profiling or cross-site identifiers. Both see your IP address when your browser contacts them. Our Umami server uses it to work out your approximate country, region and city; Cloudflare uses it to work out your approximate country. Location is estimated from the IP address and can be wrong. Visitors' analytics, including visitors from the UK and the EU, are stored on that server in the United States with Hostinger (Hostinger International Ltd., Cyprus), under the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. We keep detailed analytics records for 25 months and backups for 35 days. Cloudflare keeps full Web Analytics data for 7 days, then aggregates it down to about 10%, which can be viewed for up to 6 months.

Your analytics choice

You can turn analytics off for this browser at any time, free. Your choice is saved in this browser's local storage, so clearing site data resets it. Turning analytics off changes nothing else on the site. Analytics also stays off if your browser sends Do Not Track or Global Privacy Control.

This switch needs JavaScript and our analytics script. Without them, no analytics run in this browser.

Embedded media

YouTube embeds use the privacy-enhanced youtube-nocookie.com host where possible and do not load a player until you choose to play a video. Once you play or open a YouTube video, Google/YouTube may process data under its own privacy terms.

X posts stay static until you choose to open an inline photo or video. On activation, we load X's official post widget with Do Not Track requested; X may still process data under its own privacy terms. If X cannot load the post, we show the captured text and a link to the original post instead.

Reddit posts stay static until you choose to open an inline post. On activation, we load Reddit's official widget only; Reddit may process data under its own privacy terms. We never directly hotlink signed Reddit video URLs. If the widget cannot load or cannot identify the exact post, we show the captured title/body, attribution, and a link to the canonical Reddit post instead.

Comments and Community Picks accounts

If you sign in to comment or make a Community Pick, authentication uses Google Sign-In. We store the Google account subject identifier (google_sub), account metadata needed to operate the account, a generated public display name, session records, Community Picks you save, your profile and sharing settings, comments, votes, reports you file, and moderation/audit targets linked to comments or accounts. We do not publish your email address.

Comments and Community Picks use strictly necessary cookies only: __Host-session for the signed-in session and __Host-gnonce for sign-in nonce protection. Signed-out visitors do not receive these account cookies from FightCardIQ.

What becomes public

Visible comments you post are public on their fight pages; they appear on your profile only if you enable “Show my comments on my profile.” When public Community features are enabled, your public profile appears only if you turn on “Make my profile public.” Individual Picks appear on that profile only when both profile visibility and “Show my individual Picks on my profile” are on. Community rankings are separate: your record appears on the rankings board only if you enable “Show my record in Community rankings,” even when your profile is off. These profile, Picks, and rankings choices are off by default and can be changed in your sharing settings.

A Community Pick is the fighter you choose to win a fight. Account Community Picks remain private by default. If you explicitly copy or share a Picks link, the link contains that event's picks and anyone who has it can view and forward them, including before the event locks. That link cannot be revoked. The URL contains no account identity, and the picks snapshot is encoded in the URL fragment rather than stored by FightCardIQ. Guest drafts stay in the current page and are not saved to an account unless you sign in and choose Save. Other account metadata, reports, votes, moderation notes, sessions, and security logs are not public except where disclosure is required to handle abuse, legal requests, or site security.

Abuse prevention and moderation

We may use Cloudflare Turnstile, Google Sign-In signals, IP hash checks, nonce checks, and rate limits to prevent spam, abuse, credential misuse, and automated attacks. IP addresses are transformed with an IP_HASH_SALT; salt rotation limits long-term linkability. Rate-limit/security logs are kept for 2 days unless needed for an active abuse investigation.

Reports and moderation actions may include filing age, reporter account id, reported comment id, target account id, status, moderator notes, and audit timestamps. Report filing-age retention may be longer than the public comment so repeat-abuse handling and safety decisions remain accountable.

Retention

Comments remain public until removed by the author, by moderation, or as required by law. Deleted comments may be replaced with a removal marker where needed to preserve thread context. Picks saved to an account are kept until the account is deleted; deleting the account removes them. Guest drafts and link snapshots are not stored by FightCardIQ. When you delete your account, your comment text is blanked and the comments are marked deleted, so they no longer appear in public comment lists. Their author reference is replaced with a neutral deleted-user identifier. Session and nonce data expire with the session/security window. Rate-limit/security logs are retained for 2 days. Resolved or closed reports are deleted after 180 days from filing age / created_at. Separate moderation audit events and account-safety records may be retained for up to 365 days to handle repeat abuse, disputes, and accountability.

Cloudflare D1 backup/time-travel residual copies may persist for up to about 30 days after deletion before aging out of backup systems.

Your choices and rights

You may request export, correction, deletion, or removal of account, comment, or Community Picks data through the contact path above. Where UK GDPR or EU GDPR applies, you may also object to processing, restrict processing, request portability, and lodge a complaint with your local supervisory authority. In the UK, that supervisory authority is the Information Commissioner's Office; in the EU, it is the relevant data protection authority for your member state.

Processors

Processors and external services may include Cloudflare for hosting, D1 storage, security, logs, Turnstile, Web Analytics and storage of encrypted analytics backups (R2); Google for Google Sign-In and YouTube embeds; X and Reddit for visitor-activated post embeds; and Hostinger for hosting our analytics server in the United States. These services may involve cross-border or international transfers, including processing in the United States. Where applicable, we rely on processor terms, safeguards, and transfer mechanisms offered by those providers.

FightCardIQ is independent and fan-made, not affiliated with, endorsed by, or sponsored by the UFC. Image credits · Terms.