Privacy Policy

1. Controller

2. Website delivery and hosting

This website is delivered using Vercel. When a website is accessed, technically necessary connection data is processed. This may include the IP address, time of access, requested resource, referrer, browser and device information. Where required for secure and reliable website operation, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure and functional operation of the website.

Provider: Vercel Inc. Please refer to Vercel's privacy information for further details about its processing activities.

3. Database and technical services (Supabase)

We use Supabase for database, API and administrative authentication functions. Public guide content is delivered through this technical infrastructure. We currently do not offer public user accounts. Authentication data is processed for administrative access.

Provider: Supabase, Inc. Processing for website operation and security is based on Art. 6(1)(f) GDPR; where processing is necessary for performance of a contract, Art. 6(1)(b) GDPR may apply.

We use shared request counters to protect admin sign-in and roster lookup. Our server hashes the IP address using a secret key (HMAC). A private Supabase table stores only this hash, the request scope, the minute window and the number of attempts. The counter table contains no raw IP addresses, email addresses, passwords or ally codes. Stale counters are cleaned up by subsequent requests; there is no scheduled deletion when no further requests occur.

4. Google AdSense and consent management

Google AdSense integration is prepared for advertising on this website. Depending on the choices you make in the consent dialog, Google and other advertising partners listed there may use cookies or similar technologies and process personal data such as device identifiers, IP address, usage and interaction data.

For users in the European Economic Area, the United Kingdom and Switzerland a consent management platform (CMP) provided by Google is planned. Where consent is required, the relevant processing takes place on the basis of Art. 6(1)(a) GDPR. Once the Google dialog is available, you can change or withdraw your choices for the future via “Privacy & cookie settings” in the footer.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The list of advertising technology providers and purposes displayed in the consent dialog forms part of the consent information.

5. Cookies and similar technologies

Technically necessary storage may be used without consent where legally permitted and necessary to provide a service requested by you. Non-essential advertising or personalisation technologies are controlled according to your CMP choices where consent is required.

When you check off Conquest feats, this website stores the completed feat identifiers for each cycle in your browser (Local Storage). This information is not sent to our server or synced between devices. You can reset progress on the cycle overview or remove it by clearing this website’s browser data. It remains stored until removed.

Roster matching

When you fetch your roster using an ally code and confirm the preview, only unit IDs, imported upgrade levels, lookup time and the complete/partial roster setting are saved locally in this browser. When you start a lookup, the server sends the entered code to the configured Comlink service. The server uses an in-memory cache keyed by the code; cached results are valid for five minutes. No player profile is stored in our database. Your browser roster contains no profile names, ally codes, guild details or mod data. Remove this data with “Remove roster” on the roster page or by clearing this website’s browser data.

6. Recipients and international transfers

When the services above are used, data may be disclosed to affiliated companies or subprocessors and may be processed outside the EU or EEA. According to their own privacy information, the providers rely on the applicable legal transfer mechanisms, such as adequacy decisions or standard contractual clauses. Please consult each provider's privacy information for details.

7. Retention

We retain personal data only for as long as necessary for the relevant purpose or as required by statutory retention obligations. Retention by Google, Vercel and Supabase is also governed by their respective settings and privacy terms.

8. Your rights

Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, data portability and objection. Consent can be withdrawn at any time with effect for the future. You also have the right to lodge a complaint with a competent data protection supervisory authority.

9. Changes to this privacy policy

We update this policy when the website, the services we use or the applicable legal requirements change.

Last updated: October 2026