Privacy Policy

In short

• Without an account your village data stays on your device, except the player tag: when you add a village from an export or tap “Show league and clan”, it goes to the server, linked to an anonymous guest ID, to fetch league and clan. Enabling push stores the device details and reminders needed to deliver notifications.
• With an account the same data is also stored at Supabase so several devices show the same state.
• No advertising or tracking cookies, no sharing for advertising, no selling of data.
• Visitor counting works without cookies and does not recognise you again. That is why there is no cookie banner here.

Data you enter yourself

Account: if you register, Supabase stores your e-mail address, a hash of your password and the times you sign in and out. Without an account none of this happens, apart from the anonymous guest ID for league and clan described under the official Clash of Clans API below.

Village data: the game export contains your buildings, levels, running timers, troops, heroes and your player tag. Your settings are added to that — offline windows, language, time zone, reminders and your plan.

This data lives in your browser (IndexedDB). With an account it is also stored as one document in the table “app_state”, which row level security restricts to your own account.

Push notifications: switching them on stores your device's address at your browser vendor's push service (Google, Mozilla or Apple), the keys that go with it and your browser identification — plus the sentences of the reminders still ahead and when they are due, until they have been sent. Without an account this hangs on an anonymous identifier created for this device alone, holding nothing about you. Switching push off deletes the subscription and everything not yet sent.

Contact form: if you send a message from the support page, its text, the topic you chose, what you say about your device and use (phone, tablet or computer; browser or installed app; language) and, if you leave it ticked, the build, browser name and window size are stored. Your email address is required, so that I can reply or ask back; it is stored with the message. If you are signed in to the tracker, your account's address is filled in for you. The message is mailed to the operator's mailbox and kept in the database as a safety copy. Your IP address is not stored with it; a salted hash of it only counts how many messages one network may send.

Data that arises from running the app

• Server logs: when the page is loaded, Cloudflare and Supabase log technically necessary details such as IP address, time, requested address and browser identifier. They serve operation and abuse prevention.
• Official Clash of Clans API: when the app refreshes your player name, league, clan or hero levels, your player tag goes to Supercell — technically via RoyaleAPI's proxy, because Supercell binds API keys to fixed IP addresses. A player tag is read from the API at most once every 10 hours; the answer is cached per player tag. Every call that actually goes out is recorded with account id, player tag and time so that one account cannot exhaust the shared quota; those rows are deleted after a week. Without an account, tapping “Show league and clan” or adding a village from an export creates, after a security check, the same anonymous guest ID that push uses. It can show league and clan for at most five player tags; each tag stays linked to the ID until 30 days after its last use. A guest's calls are counted, and those counts are deleted after two days. A guest ID without push that goes unused for 30 days is deleted. To limit abuse, new guests are counted per network and day, using a salted hash of their IP address; those counts are deleted after two days.
• Visitor counting: Cloudflare Web Analytics counts page views, rough origin and device type. It sets no cookies and stores nothing on your device; a visit is grouped by a server-side hash that changes every day.

What is stored on your device

The app keeps a few entries in browser storage without which it would not work. These are not cookies, and they are used neither for advertising nor for statistics:

• IndexedDB: your villages, plans and settings.
• localStorage: “coc-theme” (light or dark), “coc-account-offer” (whether you dismissed the account question), “coc-sync-rev-…” (state of the last sync) and, with an account or a guest ID, “coc-auth” (your Supabase session token).
• sessionStorage: which reminder has already been shown in this session.
• Cache Storage: the app itself and the game images, so it runs offline.

All of this is required for the service you asked for, so no consent is needed. You can delete these entries at any time in your browser settings — the app is then empty on that device.

Legal bases

Where the European General Data Protection Regulation applies: account and sync rest on Art. 6(1)(b) GDPR (performance of the user relationship); operation, security, visitor counting and answering contact messages on Art. 6(1)(f) GDPR (legitimate interest in a working service that is not abused).

For Switzerland the revised Data Protection Act (DSG) applies; processing there serves the user relationship and an overriding interest in running the app.

Processors and recipients

• Cloudflare, Inc., USA — hosting, delivery of the site and visitor counting.
• Supabase Inc., USA — sign-in, database and the function that queries the game API.
• Resend (Plus Five Five, Inc.), USA — delivery of confirmation and password-reset emails and of contact form messages to the operator, processing recipient addresses, message content and delivery status. Open and click tracking is disabled for these emails.
• Cloudflare Turnstile — protection of account forms, guest push registration and guest lookups of league and clan against automated abuse using technical browser signals. Supabase checks the result during sign-in and email requests.
• RoyaleAPI — proxy for the official Clash of Clans API; it sees the requested player tag.
• Supercell Oy, Finland — operator of the official game API.

No data is passed on beyond that. There is no selling and no profiling for advertising.

Transfers abroad

Cloudflare and Supabase are based in the USA; depending on the chosen region, data is processed there or in the EU. This rests on both providers' data processing agreements and standard contractual clauses.

Resend is based in the USA too. The emails are sent from its EU region, but Resend processes the data in the USA as well, on the basis of its data processing agreement and the standard contractual clauses.

How long data is kept

• Account and synced village data: until you have the account deleted.
• Game API cache: until the next refresh of the same player tag, at most 30 days.
• Log of API calls: one week.
• Guest call counts: two days.
• Counts of new guests per network (salted hash of the IP address): two days.
• Contact form messages: 30 days in the database, 90 days if the email could not be delivered. The email itself stays in the operator's mailbox until it is deleted there.
• Counts of contact form messages per network (salted hash of the IP address): two days.
• Guest links to player tags: 30 days after last use.
• Server logs: according to the providers' retention periods, usually a few days to weeks.
• Data on your device: until you delete it.

Your rights

You can ask what data is held about you, have it corrected or deleted, restrict its processing, receive it in a portable format and object to its processing.

Much of that works straight away in the app: in the profile you can delete villages, sign out and take your data with you via “data transfer” or the calendar export. To delete the whole account, write to the e-mail address above — it is then removed together with the stored state.

If you live in the EU or EEA you can complain to your country's data protection authority. In Switzerland the Federal Data Protection and Information Commissioner (FDPIC) is responsible.

Children and young people

You should be at least 16 to create an account. If you are younger, use the app without one — it can do everything except sync — or ask your parents.

Changes

When the app changes, this page changes with it. The date above says when it was last adjusted.