Privacy Policy

In effect 5 September 2026

The short version

There is no analytics, no advertising and no tracking of any kind.
No third-party script runs on this site. The fonts are compiled into the site at build time, so loading a page contacts nobody but this server.
Without an account, your warbands never leave your browser. Nothing is sent anywhere.
With an account, the only personal detail stored is your email address — used to sign you in, and nothing else.
Your data is never sold, rented, or shared for anyone’s marketing.
Ask at admin@trenchline.app and your account and everything attached to it will be deleted.

If you never make an account

You can build warbands, run a campaign and use the combat companion without signing in. All of it is stored by your own browser, in local storage, under keys beginning tc_ — your warbands, the active one, your campaign, any custom units or wargear, your theme and your ruleset choice.

None of that is transmitted. It is on your device, it is readable by you and by anything else with access to that browser profile, and clearing your site data deletes it permanently. There is no copy elsewhere to restore from, which is the trade for not having to trust anyone with it.

If you make an account

What is stored about you

Email address — your identifier. It is what you sign in with and where a password-reset link would go. It is never shown to other users and never used for marketing.
Password — stored only as a bcrypt hash. The password itself is never written down, and it cannot be recovered from the hash. If you sign in with Google, there is no password at all.
Display name and avatar — only if Google supplies them, or you set them. The display name is the credit shown beside a warband you publish to the directory.
Account housekeeping — when the account was created and last updated, whether the address has been verified, a counter used to sign you out everywhere after a password reset, and whether the account is an administrator.

Signing in with Google

Google sign-in is optional; email and password works without it. If you use it, Google tells this site your Google account id, your email address, and your name and profile picture if you have them, and the site stores those together with the access tokens Google issues so the sign-in can be completed. Nothing is ever read from or written to your Google account beyond that, and this site sends Google nothing about what you do here.

Email we send you

Address verification and password reset, and nothing else. There is no newsletter and no announcement list. A reset or verification link is stored only as a SHA-256 hash with an expiry, so someone reading the database — a backup, a log — cannot use it to take an account. Links expire and work once.

What you choose to sync

Syncing is a thing you do, not a thing that happens. When you sync a warband or publish a campaign, a copy is stored on the server against your account:

Warbands — the roster: its name, faction, ducat limit, treasury, glory, every model with its wargear and advances, the armoury stash, and your notes on it.
Campaigns — the campaign name and settings, its invite code, the members and their warband names, the territory map, the match records, and any narrative log your group writes into it.
Custom rules — any unit, weapon, armour or equipment you define yourself, if you sync it.

A campaign is shared by design: other members of a campaign you join can see your warband name, faction, glory, rating and results, because that is what a campaign table is. They cannot see your email address.

The public directory

A synced warband is private by default. It appears in the public directory only if you change its visibility to public yourself. When it does, exactly these fields are published and no others: the warband name, its faction, its ducat limit, its glory, the number of models in it, its motto if you wrote one, the date it was created, and your display name — or “Crusade Commander” if you have not set one.

Your email address is not in that list and cannot be reached through it. Set the warband back to private and it leaves the directory.

Bug reports

The in-app bug reporter sends a title, a description, a severity and the area of the app. If you are signed in it is linked to your account, so a follow-up is possible; if you are not, it is anonymous. Whatever you type into the description is what gets stored — so please do not paste anything into it that you would not want kept.

Cookies

One cookie, set only after you sign in: the session cookie that keeps you signed in. It is set by the server, marked HTTP-only and secure, and it holds nothing but your signed session. There are no advertising, analytics or preference cookies — your theme and settings are kept in local storage on your own device, not in a cookie, and are never sent.

Who else can see it

Four companies, each because the site cannot run without them, and each seeing only what that role requires:

Vercel — hosts the site. Serving a page necessarily means Vercel handles the request, including your IP address, as any web host would.
Neon — hosts the database, so it holds the account and sync data described above, encrypted in transit.
Cloudflare — runs the domain’s DNS, and forwards mail sent to the address below to the operator’s inbox. So if you write in, Cloudflare handles that message in passing, the way any mail relay does. Cloudflare does not sit in front of the site: page requests go straight to Vercel, and Cloudflare sees none of them.
Google — only if you choose Google sign-in, and only for that sign-in.

Nobody else. Your data is not sold, not rented, not shared with advertisers or data brokers, and not used to train anything. It would be disclosed only if a valid legal order required it.

How long it is kept, and how to delete it

Account data is kept for as long as the account exists. Delete a warband or a campaign in the app and the server copy goes with it.

Delete account is in the account menu, at the top right. It shows you exactly what will be destroyed before you confirm — your warbands, your custom rules, the campaigns you play in, and any campaign you run, which is deleted for every player in it — and then does it immediately. There is no waiting period and no recovery: a warband you had published to the directory leaves it at the same moment.

Bug reports are the one exception, and they survive without you: the report stays so the problem can still be fixed, with the link to your account removed. Nothing in it identifies you unless you typed something identifying into the description.

If you would rather not do it yourself, or the button will not work for you, mail admin@trenchline.app from the address on the account and it will be done for you.

Your rights

You can ask for a copy of what is stored about you, ask for it to be corrected, or ask for it to be erased. Mail admin@trenchline.app from the account address. There is no charge and no account is closed or degraded for asking.

If you are in the UK or the EEA and are not satisfied with the response, you may complain to your national data protection authority. The operator of this site is in Australia.

Children

This site is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has made an account, write to admin@trenchline.app and it will be removed.

Security

Every connection is HTTPS, enforced by HSTS for two years.
Passwords are bcrypt-hashed; verification and reset links are stored hashed and expire.
Every request for a warband or campaign is checked against the account that owns it, on the server, on every call.
Account and invite endpoints are rate-limited.

No system is perfect and this one is maintained by one person. If you find a security problem, please report it to admin@trenchline.app rather than publicly, and you will get a reply.

Changes

If this policy changes in a way that matters, the date at the top changes with it and the previous wording stays in this project’s public history. Continuing to use the site after a change means the new version applies.

The companion document is the terms of use.