PRIVACY POLICY

1. Information we collect

• Account data - username, sign-in email, name, birthdate/age result, optional private phone, avatar, bio, roles, and settings.
• Authentication and recovery data - provider-managed credentials, recovery requests and grants, security timestamps, sessions, and abuse-prevention signals. Optional phone numbers are not used to sign in or reset passwords.
• User content - strategies, notes, ratings, comments, messages, reports, images, videos, saves, and sharing choices.
• Activity and technical data - squad and match activity, quiz results, feature events, IP address, browser/device data, cookies, timestamps, and server/security logs.
• Payment and legal records - Stripe customer, Checkout, price, subscription, invoice, payment, refund and dispute identifiers; tier and payment status; amount/currency; legal-document versions; consent timestamps; and the exact recurring disclosure accepted. We do not receive full card numbers.

2. How we use information

We use information to provide and secure accounts; host and display content to the audience selected; operate Team Up, chat, squads, matches, ratings, and quizzes; process subscriptions and purchases; provide cancellation, refunds, and support; prevent fraud and abuse; enforce rules; diagnose failures; improve the service; comply with law; and establish or defend legal claims.

3. Providers and disclosures

Supabase provides database, authentication, and storage services; Vercel hosts the application; Cloudflare R2 stores and serves media; and Stripe processes payments. These providers receive information needed to perform their services. We may disclose information when required by law, to protect users or the service, in a business transaction, or with your direction. We do not sell personal information.

We use Google Analytics to measure how the site is used. It receives the page path you visit (not the page's full address), the page title, the referring page, words you type into the site's search boxes, basic interactions such as scrolling, and device, browser and approximate-location data, and may set analytics cookies. Sign-in, account, billing and staff pages are not measured. Google signals and ad personalisation are turned off. For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics cookies are off by default and Google receives only cookieless, aggregated measurement. Google's use of this data is described at policies.google.com/technologies/partner-sites, and you can opt out with Google's browser add-on.

4. Advertising

Free-tier accounts may see first-party Siege Codex promotions. Those house placements do not load a third-party ad network. A third-party provider such as Google AdSense or Nitro will remain disabled until the provider approves the site, this Policy and our technical disclosures identify the provider, required consent controls are active, and sensitive routes are excluded. Paid accounts are intended to receive no third-party ad requests. If a third-party network is activated, its technology may collect device, cookie, approximate-location, and ad-interaction data under its own privacy terms and your available consent choices.

5. Retention and account deletion

Account and user content are generally retained while the account is active. A completed deletion removes or de-identifies active account data through the protected cleanup process. Restricted recovery backups may retain account data after active-account deletion. Billing consent, payment, tax, refund, dispute, fraud-prevention, and legal records may be kept in pseudonymous form for up to seven years after the transaction or longer when law or an active claim requires it. Security records are kept only as long as reasonably needed to investigate and prevent abuse. Public content or messages already received by another user may not disappear from that user's records immediately.

6. Your choices and requests

Settings provides controls for profile data, email, password, optional phone, subscription management, and account deletion. Email changes may require confirmation through both the current and new inboxes. Password resets use emailed, time-limited grants. Depending on where you live, you may request access, correction, deletion, portability, or an appeal by emailing support@siegecodex.com. We may verify identity before acting. We do not discriminate for exercising applicable privacy rights.

7. Children

Siege Codex is not directed to children under 13, and signup enforces that minimum. Purchases are restricted to account holders age 18 or older. If you believe a child provided information contrary to these rules, contact us for review and removal.

8. Security and international processing

We use HTTPS, access controls, row-level database security, signed payment webhooks, rate limits, and restricted administrative functions. No security measure is perfect. Information may be processed in the United States and other locations where our providers operate, subject to their contractual and legal safeguards.

9. Changes and contact

We will date material updates and provide additional notice or consent where required. Questions and privacy requests may be sent to support@siegecodex.com. See the Terms of Use.