Privacy Policy

You can browse without an account. We store account details, submitted contributions, corrections, saved lists and preferences needed to run the service. Optional Google Analytics is off until you opt in through Privacy choices in the footer. Advertising is separately controlled.

Sign-in uses Discord. We store your Discord identifier, email address, display name and avatar URL, together with your site account and contributions. We do not receive your Discord password. Your display name, approved contributions and public profile are visible to others; your email address is not published. You can request account deletion through our corrections and contact page.

• Session cookies: wh_user_session (signed-in visitors, 7 days) and wh_admin_session (site editors). A non-identifying hint cookie tells the page a session may exist. These are essential and set only after you log in.
• Preview access: while the site is in private preview, entering the preview password sets wh_gate (30 days) so you are not asked again. It contains no personal data.
• Local storage: some tools keep data on your device only: saved generator names, your tier-list ballot, and an anonymous random voting ID. None of it identifies you and it never leaves your browser except as described under “Tier-list votes.”
• Optional analytics: after you opt in, Google Analytics sets first-party cookies (_ga and _ga_*, up to 2 years) to tell repeat visits from new ones. They hold a randomly generated id, not your name or email.

Privacy choices are saved locally for 180 days. Article proposals are autosaved in this browser tab’s session storage while you write. This local draft is not sent to the server until you submit it.

Community votes are anonymous. Your browser generates a random ID which is sent with your vote and stored only as a one-way SHA-256 hash, so one browser gets one changeable vote per list. We do not store your IP address with votes; IP addresses are used transiently for rate limiting.

Comments require an account, are held for moderation before they are shown, and are stored with your account. Edit and article proposals are private until accepted; accepted changes are credited in public history. Saved army lists have shareable links that may be opened by anyone who has the link. Some tool share links encode the list itself in the URL. Do not put private information in lists you share.

If you opt in, we use Google Analytics 4 to understand which pages people read and how they arrive. It sets the first-party cookies described above and sends Google your page URL, referrer, approximate location derived from your IP, and general device and browser details. We do not send it your name, email, or account id.

We also use cookieless aggregate traffic measurement from Ahrefs and, where enabled, Cloudflare Web Analytics. Requests to these providers include technical connection information such as your IP address.

Do Not Track and Global Privacy Control signals keep optional Google Analytics and advertising off. You can withdraw optional analytics in Privacy choices; this disables collection and removes its site cookies. Nothing on the site depends on opting in.

Advertising is disabled unless the site explicitly activates it with a publisher account and certified consent configuration. The footer’s Privacy choices can keep it paused. Allowing the advertising message does not itself consent to advertising cookies: Google’s certified consent message separately records those choices before ads can load. Eligible ad placements include a link to manage that consent.

Some outbound links may be affiliate links, labeled as such. See the affiliate disclosure. Clicking an affiliate link takes you to the retailer, whose own privacy policy then applies. We receive no personal data back from retailers beyond aggregate commission reporting.

The site runs on Cloudflare (hosting, media storage, and transient request logs used for security and rate limiting) with a database hosted by Neon. These providers process technical request data (such as IP addresses) as processors on our behalf.

We may record search terms and result counts to identify gaps in the archive. Avoid entering personal or sensitive information into search. Rate limiting uses request information to prevent abuse. Moderation retains submissions and decisions so corrections and attribution can be traced. Publication history may remain after an account is removed, with account links removed where applicable.

Account data is kept until you ask us to delete it. Moderation and security records are kept only as long as needed for those purposes. For any privacy request, use the route on the corrections page.