Privacy & consent

Optional analytics and commercial data sharing are separate choices and are off until you turn them on. Strictly necessary processing (login, security, cart, payments, CSRF, remembering your choice) always runs because the site cannot work without it. Declining optional processing never restricts your access.

Analytics Commercial data sharing Preferences Save choices

Your data requests

Log in to file a data subject request (access / export / erasure).

What we collect, why and for how long

• Necessary: session/auth cookies, CSRF tokens, cart, consent record, short-lived security logs. Kept only as long as needed (security logs typically 30–90 days).
• Analytics (consent): page path without query string, page category, referrer host, coarse device/browser/OS, bucketed screen/viewport, language, timezone, connection type, page-load timing, scrubbed errors, truncated IP network + country. Raw events are short-lived and then aggregated.
• Commercial (consent): only aggregated trends (counts, conversion rates, average order value ranges, product popularity, geographic/device distributions). No account IDs, character names, emails, Discord IDs, IPs or payment data.

Who receives it

Operational data stays on our servers. Aggregated commercial datasets may be shared with the processors listed in our Data Processing Register. A current processor list is available on request.

Your rights

You can withdraw optional consent at any time using the buttons above; withdrawal stops all future optional telemetry. Logged-in users can also request access, portability or erasure above. Where data has already been aggregated, erasure applies to the raw data that can still be linked to you.

Policy versions

Consent version 2, Privacy Policy version 1, Cookie Policy version 1.