Privacy Policy

You can browse the entire site without an account. We do not sell personal data, we do not run tracking pixels of our own, and the only personal data we store is what you give us when you create an account, save an army list, or post a comment.

Creating an account stores your email address, a display name, and a salted hash of your password (we never store the password itself). Accounts exist so you can save army lists and post comments. You can request deletion of your account and its data via the contact route on our corrections page.

• Session cookies: wh_user_session (signed-in visitors, 7 days) and wh_admin_session (site editors). A non-identifying hint cookie tells the page a session may exist. These are essential and set only after you log in.
• Preview access: while the site is in private preview, entering the preview password sets wh_gate (30 days) so you are not asked again. It contains no personal data.
• Local storage: some tools keep data on your device only: saved generator names, your tier-list ballot, and an anonymous random voting ID. None of it identifies you and it never leaves your browser except as described under “Tier-list votes.”
• Analytics: Google Analytics sets first-party cookies (_ga and _ga_*, up to 2 years) to tell repeat visits from new ones. They hold a randomly generated id, not your name or email.

We set no advertising cookies ourselves.

Community votes are anonymous. Your browser generates a random ID which is sent with your vote and stored only as a one-way SHA-256 hash, so one browser gets one changeable vote per list. We do not store your IP address with votes; IP addresses are used transiently for rate limiting.

Comments require an account, are held for moderation before they are shown, and are stored with your account. Saved army lists are stored with your account; a shared army-list link encodes the list itself in the URL, so share links only with people you want to see them.

We use Google Analytics 4 to understand which pages people read and how they arrive. It sets the first-party cookies described above and sends Google your page URL, referrer, approximate location derived from your IP, and general device and browser details. We do not send it your name, email, or account id.

Where enabled we also run Cloudflare Web Analytics alongside it, which is cookieless and does not track you across sites.

Browser “Do Not Track” and tracker-blocking extensions both stop Google Analytics loading, and nothing on the site depends on it.

Advertising is not currently active. If we enable ads (Google AdSense), the ad provider may use cookies or similar technologies subject to its own policies; this policy and the site will be updated first, including any consent controls required in your region.

Some outbound links may be affiliate links, labeled as such. See the affiliate disclosure. Clicking an affiliate link takes you to the retailer, whose own privacy policy then applies. We receive no personal data back from retailers beyond aggregate commission reporting.

The site runs on Cloudflare (hosting, media storage, and transient request logs used for security and rate limiting) with a database hosted by Neon. These providers process technical request data (such as IP addresses) as processors on our behalf.

Account data is kept until you ask us to delete it. Moderation and security records are kept only as long as needed for those purposes. For any privacy request, use the route on the corrections page.