PRIVACY POLICY

1. Information we collect

• Account data - username, sign-in email, name, birthdate/age result, optional private phone, avatar, bio, roles, and settings.
• Authentication and recovery data - provider-managed credentials, recovery requests and grants, security timestamps, sessions, and abuse-prevention signals. Optional phone numbers are not used to sign in or reset passwords.
• User content - strategies, notes, ratings, comments, messages, reports, images, videos, saves, and sharing choices.
• Activity and technical data - squad and match activity, quiz results, feature events, IP address, browser/device data, cookies, timestamps, and server/security logs.
• Payment and legal records - Stripe customer, Checkout, price, subscription, invoice, payment, refund and dispute identifiers; where native store purchases are available, App Store or Google Play product, transaction, renewal, expiry and purchase-status records linked to your account through RevenueCat; tier and payment status; amount/currency; legal-document versions; consent timestamps; and the exact recurring disclosure accepted. We do not receive full card numbers.

1a. Mobile app and your shared account - updated October 8, 2026

The Siege Codex mobile app uses the same account and service as the website. It sends sign-in credentials to Supabase over HTTPS and keeps the session on your device in secure platform storage. The app reads account and permitted strategy data, including squad lineups and operator loadouts. Choosing a strategy, assigning a player, requesting a brief or dismissing it sends the relevant squad, strategy, operator and account identifiers and interaction information to our service so the team can stay in sync. Video playback requests the available media from our hosting providers. The app also sends reports about strategies or creators, creators you block (which also hides their strategies from your catalog) and account-deletion requests or cancellations when you use those controls. To recover an interrupted deletion action and retry it using the same operation identifier, the app may keep a short record of a pending deletion action in secure storage on your device until Siege Codex confirms it and the app removes the record: the account and action identifiers, the kind of action, when it was saved and, briefly, whether it has finished, never your password, authenticator codes or session tokens. Our authentication and hosting providers may also process IP addresses, timestamps and security logs. Links opened in the website follow the website’s data practices described here.

When account creation is available in the app, it sends your name, birthdate, username, email, password, optional phone number and the acknowledgments shown on the form to the same account service as the website. Password-reset requests send your email to that service. Passwords and authenticator codes are not saved by the app.

When push notifications are available and you choose to enable them, we register a device push token linked to your account, device platform and notification preferences. We use Expo's notification service and Apple or Google delivery services to send enabled service alerts, such as squad invitations or operator briefs. Notification payloads include the alert text and an app destination and may appear on your lock screen according to your device settings. You can change notification categories in the app or disable permission in your device settings. Push notifications are optional and are not required to use your account.

If native Full Access purchases are available and you use them, RevenueCat and the relevant app store process account-linked purchase history and subscription status, including product, transaction, renewal, expiry, refund and restore information, so we can provide the correct access across your devices. Your payment-card details stay with the store's payment service. We do not use these records to track you for advertising. Store purchase and push delivery availability depend on the platform and service configuration; this disclosure does not mean they are currently enabled.

The native app does not include a third-party advertising or analytics SDK. This does not mean the shared backend collects no technical data. You can request deletion without the app using our account-deletion page.

2. How we use information

We use information to provide and secure accounts; host and display content to the audience selected; operate Team Up, chat, squads, matches, ratings, and quizzes; process subscriptions and purchases; provide cancellation, refunds, and support; prevent fraud and abuse; enforce rules; diagnose failures; improve the service; comply with law; and establish or defend legal claims.

2a. Professional esports data - added September 24, 2026

Siege Codex uses public professional player handles, team affiliations, match results and attributed performance statistics from Ubisoft R6 Esports and separately identified sources such as SiegeGG. We use these records to explain historical competition and support player scouting, not to make decisions about a player's employment or eligibility. We do not need players' private contact details or social profiles for this purpose.

Historical results remain in dated snapshots while needed to explain the archive and check corrections. Where applicable, our basis is the legitimate interest in providing accurate esports reference information, subject to players' rights and interests. Public availability does not waive those rights. A player or representative can request a source, correction, objection review or removal through support@siegecodex.com. Please identify the handle, record and requested change. We review applicable rights and source accuracy before deciding how to correct or retain a record.

3. Providers and disclosures

Supabase provides database, authentication, and storage services; Vercel hosts the application; Cloudflare R2 stores and serves media; and Stripe processes website payments. When enabled for the native app, Expo and Apple or Google deliver push notifications, and RevenueCat helps verify purchases processed by the App Store or Google Play. These providers receive information needed to perform their services. We may disclose information when required by law, to protect users or the service, in a business transaction, or with your direction. We do not sell personal information for money. Advertising-related sale or sharing, where applicable, is described below.

We use Google Analytics to measure how the site is used. It receives the page path you visit (not the page's full address), the page title, the referring page, words you type into the site's search boxes, basic interactions such as scrolling, and device, browser and approximate-location data, and may set analytics cookies. Sign-in, account, billing and staff pages are not measured. Google signals and ad personalisation are turned off. For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics cookies are off by default and Google receives only cookieless, aggregated measurement. Google's use of this data is described at policies.google.com/technologies/partner-sites, and you can opt out with Google's browser add-on.

4. Advertising

Free-tier accounts may see first-party Siege Codex promotions. Those house placements do not load a third-party ad network. Nitro is our planned third-party advertising provider for eligible public pages shown to signed-out visitors on a separate public host. Third-party advertising remains disabled until provider coverage, consent controls, privacy disclosures and account protection have been verified. Signed-in application pages and Full Access accounts do not load the third-party advertising network. If a third-party network is activated, Nitro and its advertising partners may process IP addresses, browser/device information, cookies and device identifiers, approximate location and ad interactions to select, deliver and measure advertising. See Nitro's privacy policy for its processing and advertising partners.

Advertising-related disclosure of information may count as a sale or sharing under applicable US state privacy laws. Use Do Not Sell or Share My Personal Information to save an opt-out in this browser, even before ads are enabled. We recognize Global Privacy Control as an opt-out. The choice is stored in a first-party cookie and must be repeated on other browsers or devices, or after clearing cookies. On pages where Nitro ads are enabled, visitors in regions that require consent can also review or change their choices using the consent manager's footer link. Rejecting optional advertising consent does not prevent account access.

5. Retention and account deletion

Account and user content are generally retained while the account is active. A completed deletion removes or de-identifies active account data through the protected cleanup process. Restricted recovery backups may retain account data after active-account deletion. Billing consent, payment, tax, refund, dispute, fraud-prevention, and legal records may be kept in pseudonymous form for up to seven years after the transaction or longer when law or an active claim requires it. Security records are kept only as long as reasonably needed to investigate and prevent abuse. Public content or messages already received by another user may not disappear from that user's records immediately.

6. Your choices and requests

Settings provides controls for profile data, email, password, optional phone, subscription management, and account deletion. Email changes may require confirmation through both the current and new inboxes. Password resets use emailed, time-limited grants. Depending on where you live, you may request access, correction, deletion, portability, or an appeal by emailing support@siegecodex.com. We may verify identity before acting. We do not discriminate for exercising applicable privacy rights.

7. Children

Siege Codex is not directed to children under 13, and signup enforces that minimum. Purchases are restricted to account holders age 18 or older. If you believe a child provided information contrary to these rules, contact us for review and removal.

8. Security and international processing

We use HTTPS, access controls, row-level database security, signed payment webhooks, rate limits, and restricted administrative functions. No security measure is perfect. Information may be processed in the United States and other locations where our providers operate, subject to their contractual and legal safeguards.

9. Changes and contact

We will date material updates and provide additional notice or consent where required. Questions and privacy requests may be sent to support@siegecodex.com. See the Terms of Use.