Privacy summary

Privacy

Warlord TCG Collector stores the account, collection, deck, forum, bounty, and security data needed to run the archive and protect collectors.

Privacy request Profile settings

Account data

Accounts use email, username, password hash, email verification status, and profile preferences.
Login attempts may record IP address, user agent, approximate location label, and failure reason for abuse prevention.
API tokens may be created for mobile access and can be revoked from your profile.
You can delete your account from profile settings after confirming your password. Account-owned data is removed together so a partial deletion cannot leave an active profile behind.
Failed-login evidence may remain until the configured security cleanup date, but the deleted email is replaced with a non-login deletion reference.
Active username, email, and IP bans remain enforceable after deletion. All other retained account audit events remove username, email, IP address, user agent, and profile links.

Collections are private unless you choose to make them public.
Public profiles only show collections and activity you have chosen to expose.
Private notes, condition, storage details, and private collection data stay hidden from public binder views.

Forum posts, replies, dispatch comments, bounty submissions, and linked contact forms are removed when their owner deletes an account.
Moderation action names and timestamps may remain for accountability, but records targeting the deleted account are stripped of identity and request details.
Admins can review reports, bans, moderation records, and security events when needed.
Contact admin2@mudhaven.net for correction, removal, or account questions.

The site records first-party page-view analytics so admins can understand visitor counts, popular pages, referrers, and member-versus-guest activity.
Traffic analytics use hashed visitor and browser identifiers instead of storing raw visitor IP addresses.
Authenticated page-view records linked to an account are removed when that account is deleted.
Admin pages, API routes, assets, health checks, and obvious bot traffic are excluded from these visitor reports.