Privacy
The short version: we sell nobody's data. Google ads may appear on the site and they use cookies, but personalization can be turned off. Below is exactly what is stored, where, and how to get rid of it.
Without an account
Nothing reaches the server until you publish something yourself. Your browser's localStorage (not cookies) holds a random owner key — so your own entries look like yours — plus loadout and cargo drafts, the catalog view you picked and your language. None of that leaves your device.
What does reach the server is what you deliberately create: a tactical room, a build in the hub, a contract, a chat message. Each carries that same owner key — otherwise we could not give you, and only you, the right to edit it.
With an account
| Always | callsign, emblem, creation date |
| Steam sign-in | Steam ID, nickname and avatar — what Steam itself returns on confirmation |
| Discord sign-in | ID, nickname and avatar — what Discord returns on confirmation |
| If you choose | roles, hours in game, time zone, description, contact (Telegram or Discord) |
| Support form | request code, chosen tier and the Steam ID or Discord from your sign-in — so we can match the transfer and grant the perk. Only we see it |
| no longer collected: it remains only in old password accounts created before 25.09.2026 | |
| Cookies | technical only: __Host-wdst — 15 minutes while linking Steam, so nobody can swap the sign-in; __Host-wdtk — your tournament registration ticket in this browser; a service sign-in cookie — players never get it. For ad cookies see “Google ads” |
| Invite link | if you came through someone's /ref/… link — the __Host-wdref cookie for 30 days and the same code in browser storage (wd-ref). A streamer's link also stores wd-ref-pt — the streamer's code and name, valid just as long; only the “Support the project” form reads it. When you sign in through Steam we remember whose link brought you: that is how the person who invited you gets priority days. They see your nickname only once you count as active |
Only the callsign, emblem, faction, roles, description and contact ever become public — and only when you open a contract or join the reserve. The email is shown nowhere and handed to nobody.
Where it lives and for how long
Where
Pages are served by Cloudflare Pages. Data lives in Supabase (PostgreSQL). Traffic is counted by Cloudflare Web Analytics — a cookieless beacon with no identifiers; we only ever see anonymous totals.
Separately we count actions, not people: how many times a tactical room was built, a ready-made kit applied, cargo auto-packed. Such a record holds no key, no session and no address — only the name of the action, the page and the language, so there is nothing in it to reconstruct anyone's path from. The list of events is closed, and if your browser sends Do Not Track, we do not count even that.
The Steam player count comes from our own measurements through the public Steam API. That is a number about the game, not about people.
How long
A tactical room lives 14 days from its last edit, then goes away with its marks. A contract stays until you close or delete it. A published build stays until you unpublish it. An account stays until you ask us to delete it.
Getting your data out or deleted
Both are buttons — no asking, no waiting. At the bottom of your profile there is a “Your data” block: Download my data hands you a single JSON file with everything recorded against you, and Delete everything wipes the account, contracts, reserve listing, chat messages, builds and rooms. Deletion is confirmed by typing your callsign and cannot be undone.
Entries made without an account are yours too: rooms and builds are signed with your browser's key, and the same block takes them out or wipes them — even if you never created an account.
If you have lost access to the account and still need it gone, write to the community chat or the channel. We do it within 72 hours and confirm when it is done.
Third parties
Telegram and Discord are links and sign-in buttons: until you press one, nothing goes there. Steam only ever sees the sign-in confirmation itself. Trailers from YouTube and Twitch load only after you click the poster — which is exactly why the page carries a still image rather than a player. Streams in partner cards work the same way: the Twitch, YouTube or Kick player loads only after you press the frame, and the platform may set its own cookies.
Google ads
Ads may appear on this site. They are served by third-party vendors, including Google, which use cookies to choose ads based on your previous visits to this and other websites.
You can turn off personalized advertising in Google's ad settings, and Google explains how it uses this data. We run no ad trackers of our own.
Questions about data go to the chat. If this page changes, we will say so in the channel: no quiet edits to the policy.