Privacy policy

You can browse the army lists, categories and reference material without an account, without signing in and without telling us anything about yourself. Reading pages creates no account, no anonymous record and no cookie; it is counted in the activity log described below, and nothing else. Everything in this section is collected only when you start an army list or create an account.

Account information

• Email address and display name. Typed by you when you sign up with a password, or supplied by your identity provider when you choose to sign in with Google or Discord.
• A password hash, if you created a password credential. We never store, see or log your password itself — only a one-way hash of it, from which the password cannot be recovered.
• A profile image URL, if your identity provider supplies one. We store the address, not a copy of the image.
• Whether your email address has been confirmed.

Sign-in with Google or Discord

If you choose to sign in with an identity provider, we ask that provider for the narrowest set of information that lets us identify you and give you your lists back:

• Google — the openid, email and profile scopes: a stable account identifier, your email address, your name and your profile picture. We do not request access to Gmail, Drive, Contacts, Calendar or any other Google service, and we could not read them if we tried.
• Discord — the identify and email scopes: your Discord user id, username, avatar and email address. We do not request access to your servers, your messages, your friends or your presence.

We store the provider name, the account identifier that provider gave you, the granted scopes and the tokens the sign-in produced. Tokens are used to complete the sign-in and to link your account; we do not use them to call the provider’s other APIs on your behalf. Signing in this way does not give us your password at that provider, and it does not let us post anything anywhere.

Session records

When you are signed in — or when you have saved a list without signing up, as described below — we store a session record so that the next request knows it is you. Each holds a session token, an expiry time, and the IP address and browser user agent string the session was created from. We disclose those last two because they are personal information, not because we analyse them; they exist so that a session can be attributed and, if necessary, revoked.

Your army lists

An army list you save holds a name you chose, a reference to the published army list it is built from, a compact record of the stands, options and battle cards you selected, the version of the underlying army data it was built against, and the times it was created and last changed. That is the whole of it. There is no free-text field we mine and nothing in a saved list identifies you beyond the fact that it is yours.

Confirming your address

An account created with a password must confirm its email address before it can be used: we send a link to the address you gave us, and there is no session until you follow it. This exists so that an address on an account means somebody proved they can read mail there, which is what stops a stranger claiming an address that is yours.

To do that — and to reset a forgotten password — we store a short-lived single-use token against your email address until it is used or expires. Confirmation and reset requests are rate-limited per address, per IP address and against a daily send budget, so neither can be used to flood someone’s inbox.

Browsing creates no record of you. The first time you start a list without being signed in — by pressing New list on an army, or by saving a list you had been building — we create an anonymous user record and place a session cookie in your browser. From then on the builder keeps that list up to date as you change it, without asking again. That record has no email address, no name and no password; the cookie is the only thing tying it to you, and it identifies a browser rather than a person. Against it we store your saved lists and a session record, which — as above — includes the IP address and user agent of the request that created it.

Three consequences follow, and all three are true by design:

• Anonymous lists are per-browser. Lists saved on your phone and lists saved on your laptop are separate, and clearing your cookies or site data loses the connection to them for good. We have no way to identify you and give them back, because we never knew who you were.
• Signing in claims them. When you later create an account or sign in to an existing one from the same browser, the lists held against the anonymous record are reassigned to your account and the anonymous record is deleted. We tell you in the interface when this happens.
• They do not last forever. An anonymous record that holds no lists is deleted, and an anonymous record untouched for 24 months is deleted along with the lists held against it. This is content we hold for someone who never registered and never agreed to anything, so we do not keep it indefinitely.

We keep a log of how the Website is used, so that we can tell how many people use it, which parts they use, and what to improve. It is a table in our own database, written by our own server. There is no analytics product behind it, no script from anyone else’s domain, and no cookie beyond the ones our cookie policy already lists.

What it records

• The actions you take. Signing up, confirming your address, signing in and how — with a password, Google or Discord — having an anonymous browser’s lists added to your account, and resetting a password. Creating, editing, renaming, duplicating and deleting a list, and making a share link. Adding, changing and removing an entry or a photo in your collection, and changing your preferences. It records what kind of action it was and when, never the contents of a list, an entry or a photo. The builder saves a list as you change it, so an edit is recorded at most once every few minutes for each list, not once per change.
• The pages you open, as the kind of page — “an army page”, /armies/[id] — and never the full address or anything in it after a ?.
• The filters you use on the army index: which filter, and which of its values you picked.

With every one of those we record:

• Your account or anonymous record, if you already have one, and whether it is anonymous. Opening a page or using a filter never creates one.
• Your IP address.
• The approximate location it resolves to — a country, a region and a city. We look it up on our own server, from a copy of the DB-IP database that ships with the app, so your address is never sent to anyone to look up. It is as rough as any IP location: often the city of your internet provider, not yours.

If your browser sends a Global Privacy Control or Do Not Track signal, the pages you open and the filters you use are not recorded at all. The actions you take are recorded either way.

Who sees it

The log never leaves our server, and nobody outside the operator sees it. We read it only in aggregate, on an admin dashboard: totals, counts over time, the most used pages and filters, and where in the world visits come from, each split between accounts and anonymous visitors. The dashboard cannot show one person’s activity, and it shows no email address and no IP address.

Why, and for how long

We keep it on our legitimate interest in running and improving the Service: knowing whether anyone uses a feature is how we decide what to fix and what to build next, and a record of addresses is how abuse is traced. We keep the full IP address rather than a shortened one for those two reasons. The log is kept until further notice — we have not set an expiry, because the point is to compare one year with the next — and if we ever set one, this section will say so. You can object to it, or ask for what it holds about your account to be deleted, as described under your rights.

IP Geolocation by DB-IP, used under the Creative Commons Attribution 4.0 International License.

This list is short and specific, and worth stating plainly because people reasonably assume otherwise of any website:

• No analytics product. No Google Analytics, no Plausible, no Matomo, no session recording, no heatmaps. The activity log above is the whole of what we know about how the Website is used, and it is ours alone.
• No third-party tracking pixels or beacons, and no fingerprinting. The only beacon the Website sends goes to our own server, to record a page view or a filter in the activity log.
• No advertising, no ad networks and no advertising identifiers.
• No third-party scripts. The Website loads no code from anyone else’s domain. Web fonts are downloaded at build time and served from our own domain, so loading a page makes no request to a third party at all.
• No social media widgets — no like buttons, share buttons or embedded feeds, each of which would otherwise report your visit to its provider.
• No payment information. The Website is free and there is nothing to buy, so we hold no card details and no billing address.
• No location data beyond the approximate location we look up from your IP address, no device sensors, no contacts. The only photos we hold are the ones you add to your collection.
• No personal information bought, rented or obtained from data brokers, social platforms or any other outside source. Everything we hold about you, you gave us yourself or asked your identity provider to give us.

If this ever changes, this section changes with it, and the change will be visible in the revision date at the top of this page.

The Website is not directed at children. We do not knowingly collect personal information from anyone under 16, and if you are under 16 you should not create an account or save lists without the consent of a parent or guardian. If you believe a child under 16 has given us personal information, contact us and we will delete it.

Every use of your personal information falls under one of these:

• To create your account and let you sign in and out.
• To store your army lists and give them back to you on your next visit or another device.
• To send you the link that confirms your email address, and a password reset link when you ask for one.
• To keep the Service working and secure: rate-limiting sign-in, confirmation and reset requests, identifying and blocking abuse, and diagnosing errors.
• To understand, in aggregate, how the Service is used and what to improve, through the activity log.
• To answer you if you contact us for support.
• To comply with a legal obligation, if one ever arises.

We do not profile you, we do not make automated decisions with legal or similarly significant effects about you, and we do not use your information to market anything — to you or to anyone else.

Legal bases under the GDPR

• Performance of a contract — creating and running your account and storing the lists you asked us to store. Without this information there is no account and no saved list.
• Legitimate interests — keeping the Service available and free of abuse, and keeping the minimum session records needed to do that; and running and improving the Service, which is what the activity log is for. We have considered your rights, and we read the log only in aggregate and never let it leave our server.
• Consent — where you have given it, and you may withdraw it at any time.
• Legal obligation — where the law requires us to keep or disclose something.

We do not sell your personal information, we do not rent or trade it, and we do not share it for anyone else’s marketing. The complete list of third parties that ever touch it is:

That is the entire list. There is no analytics provider, no advertising partner, no CRM, no customer data platform and no affiliate.

A list you share is public

Sharing is never automatic: a short link exists only because you pressed Share link. From then on, anyone holding that link can read the list behind it — and a link pasted into a chat window is held by everyone who can read that window. The page shows the army list and nothing about you: not your name, not your email address, not the account it came from. What it shows is a copy taken when you pressed the button, so editing the list afterwards does not change what the link shows, and a link cannot be withdrawn once it is out.

What a link does not do is last forever unattended. Every time somebody opens one we note the day, and a link nobody has opened for 24 months is deleted along with the copy behind it. A link that is still being passed around never expires, however old it is; one that went into a dead chat window eventually goes away. Deleting your account does not take your shared copies with it — they carry nothing about you, and somebody else may still be holding the link — so tell us if you want those removed too.

We may disclose personal information where the law requires it — to comply with a court order or similar legal process, or where we believe in good faith that disclosure is necessary to protect our rights, investigate fraud or respond to a lawful government request. If the Website is ever transferred to someone else, your account and lists would move with it, and we would say so on the Website before it happened.

Your personal information is held in a single database file on a volume attached to a server we run and operate ourselves in the European Union. Backups are snapshots of that volume, kept in the same place. The database is not hosted with a third-party database provider and is not replicated anywhere else.

Requests reach that server through Cloudflare’s global network, which means request metadata may be processed at a Cloudflare location outside the European Economic Area. That processing is covered by Cloudflare’s data processing terms and the European Commission’s Standard Contractual Clauses. If you sign in with Google or Discord, or receive an email through Resend, information travels to those providers under their own terms and safeguards.

We do not keep an archive of deleted accounts. The activity log outlives the lists it describes — a deleted list is still counted as having been created — and that is the only record that does.

If you are in the European Economic Area or the United Kingdom, the GDPR gives you the rights below. We extend them to everyone who uses the Website, because operating two standards for a hobby project would be a poor use of everyone’s time.

• Access — to be told whether we hold personal information about you and to receive a copy of it.
• Rectification — to have inaccurate information corrected and incomplete information completed.
• Erasure — to have your personal information deleted.
• Portability — to receive the information you gave us in a structured, commonly used, machine-readable format.
• Restriction — to have processing limited in the circumstances the GDPR sets out.
• Objection — to object to processing carried out on the basis of our legitimate interests, on grounds relating to your situation.
• Withdrawal of consent — at any time, where processing rests on consent. This does not affect processing carried out before you withdrew it.
• Complaint — to lodge a complaint with your local supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP). We would rather you raised it with us first, but it is your right either way.

How to exercise them

The Account page lets you see and change the ways you can sign in — connecting or disconnecting Google and Discord — without asking us. For everything else, email us at [email protected] from the address on your account. There is no self-service account deletion or account export screen, so those are handled by hand, and we would rather say so than imply a button exists. We will confirm receipt and respond within one month, as the GDPR requires; if a request is complex we may extend that and will tell you why.

We may need to verify that the request comes from you before we act on it, particularly for erasure. An anonymous record has no identity attached to it, so we cannot verify a request about one or match it to you; the way to remove those lists is to delete them in the app from the browser that holds them, or to leave them to the 24-month sweep described above.

Deletion removes your account record, your sign-in credentials and provider links, your sessions, the army lists held against your account and the activity log’s record of it. Copies behind short links you shared are separate, and go only if you ask for those too. It cannot reach into backups that have already been taken; those rows disappear as the snapshots age out.

The Website sets only cookies that are strictly necessary for it to work — keeping you signed in, holding a saved list against your browser, and securing the sign-in exchange with Google or Discord. There are no analytics or advertising cookies, which is why you are not asked to accept anything. The one other thing stored in your browser is your light or dark theme preference, which is kept in local storage and never sent to us. Our cookie policy describes each cookie individually.

Some browsers send a Do Not Track or Global Privacy Control signal. The Website does not track you across other websites under any circumstances, with or without one. What it does turn off is the part of the activity log that records the pages you open and the filters you use.

The Website links to resources we do not control, including the Washington Grand Company’s site, the Meshwesh army list data project and our source code repository. We are not responsible for their privacy practices, and we encourage you to read their policies when you follow a link.

Traffic to the Website is encrypted in transit. Passwords are stored only as one-way hashes. Sign-in, confirmation and password reset endpoints are rate-limited. Sessions are held in cookies that JavaScript cannot read, marked secure and same-site. Access to the server is restricted to the operator.

No service can promise perfect security, and this one is run by one person on self-hosted hardware rather than by a company with a security team. We think that is the right trade for an army list builder, and we would rather you knew it than assumed otherwise. Please use a unique password and keep the device you sign in from secure.

If we become aware that personal information has been exposed, we will investigate, take reasonable steps to contain it, and — where there is a risk to your rights and freedoms — notify the relevant supervisory authority within 72 hours and tell affected users directly and by a notice on the Website.

We may update this Policy. When we do, we will revise the date at the top of this page, and the updated version takes effect when it is posted. If a change is material — if we start collecting something new, or share information with someone not named above — we will not apply it to information already collected without telling you first. Continuing to use the Website after a change means you accept the revised Policy.

Questions, requests or complaints about this Policy or about your personal information: [email protected]

Saltares Marquez David Persoana Fizica Autorizata, operator of triumph.saltares.dev. We will make every reasonable effort to resolve complaints and to honour your rights as quickly as possible, and in any event within the timescales set by applicable data protection law.