Account Privacy

WHR Army Builder Privacy Notice

Last updated: 19 August 2026

This Privacy Notice explains how personal information is collected, used, stored and protected when you create or use a WHR Army Builder account.

WHR Army Builder is a free, unofficial fan project.

1. Who is responsible for your information?

WHR Army Builder is operated by Andrew Hicks, who is the data controller for the personal information described in this notice.

If you have any questions about this notice, want to exercise your data-protection rights, or have a concern about how your information is being used, you can contact us at:

2. What information we collect

Depending on how you use WHR Army Builder, we may collect and process:

• your email address;
• your chosen display name;
• account identifiers generated when your account is created;
• armies, rosters and related information that you choose to save;
• campaign information that you create or participate in, including campaign names and descriptions, campaign membership, campaign armies, territories, territory ownership and transfers;
• information about whether an army has been marked Private or Shared;
• account creation, login and last-active timestamps;
• authentication and security information associated with use of the service; and
• technical information recorded by our hosting and authentication services, which may include IP addresses, browser or device information, user-agent information, request information and security or authentication logs.

We do not require your real name, postal address, date of birth or other information that is not needed to provide the account service.

Please do not include unnecessary personal information about yourself or other people in army names, roster information or other user-created content.

3. How we obtain your information

Most of the personal information we process is provided directly by you when you:

• create an account;
• sign in;
• choose a display name;
• create or save an army;
• use sharing or campaign features; or
• contact us.

Some technical and security information is generated automatically when you use the service or is provided to us by the infrastructure and authentication services used to operate WHR Army Builder.

4. Why we use your information

We use personal information only where it is necessary for the operation, security and administration of WHR Army Builder.

This includes using information to:

• create and authenticate your account;
• allow you to sign in securely;
• provide cloud storage for your saved armies;
• associate saved armies and account settings with your account;
• provide sharing and campaign features that you choose to use;
• send messages necessary to operate or secure your account;
• identify inactive accounts;
• prevent unauthorised access, abuse or misuse of the service;
• investigate technical or security problems;
• maintain the security and integrity of the service; and
• comply with legal obligations where we are required to do so.

We do not use your account information for advertising or marketing unless we tell you separately and have an appropriate lawful basis for doing so.

We do not sell your personal information.

5. Our lawful bases for using your information

Different lawful bases may apply depending on why the information is being processed.

Providing your account and the service

Our lawful basis for processing the information necessary to create and operate your account is Article 6(1)(b) UK GDPR, performance of a contract.

This applies where processing is necessary to provide the account, cloud-storage, sharing and related services that you request by creating and using a WHR Army Builder account.

Security and service integrity

Where we process technical, authentication or security information to protect WHR Army Builder, prevent misuse, investigate security problems or maintain the reliability of the service, we may rely on Article 6(1)(f) UK GDPR, legitimate interests.

Our legitimate interests are protecting the service and its users, maintaining account security, detecting misuse and ensuring that WHR Army Builder operates reliably.

We only rely on legitimate interests where we consider that the processing is necessary and proportionate and where those interests are not overridden by your rights and interests.

Legal requirements

Where processing is necessary to comply with a legal obligation that applies to us, we may rely on Article 6(1)(c) UK GDPR, legal obligation.

6. Is providing your information compulsory?

You are not legally required to provide personal information to WHR Army Builder.

However, an email address and the information necessary to create an account are required if you want to use account-based features such as cloud storage.

If you do not provide this information, we will not be able to create or maintain an account for you.

Other information, such as the armies you choose to save or share, is provided voluntarily when you use those features.

7. Private and shared armies

Cloud-saved armies are Private by default.

You can choose to mark an army as Shared where the relevant sharing feature is available.

Shared content may be accessible to other users in accordance with the sharing options provided by WHR Army Builder.

Your email address is not intended to be displayed to other WHR Army Builder users. Sharing features use your chosen display name rather than your email address.

You should therefore avoid including information in Shared armies that you would not want other users to see.

8. Who processes or receives your information?

WHR Army Builder uses third-party infrastructure providers to operate the service.

Supabase

Account authentication, database functionality and cloud account data are provided using Supabase.

This means Supabase may process personal information on behalf of WHR Army Builder where necessary to provide authentication, database, storage, logging, security and related infrastructure services.

Resend

Transactional account emails, including email-verification and password-recovery messages, are delivered using Resend. Resend may process your email address and limited delivery, security and diagnostic information where necessary to send and monitor these messages.

GitHub

The WHR Army Builder website is hosted using GitHub Pages. GitHub may process limited technical information, such as IP addresses, browser or device information and request logs, as part of providing and securing the hosting service.

Other service providers

Other hosting, network, email-delivery, security or infrastructure providers may process limited personal information where this is necessary to operate the website or provide account functionality.

We only disclose personal information to other organisations where:

• they provide services necessary to operate WHR Army Builder;
• disclosure is necessary to protect the security of the service or its users;
• we are required to disclose the information by law; or
• you have specifically requested or authorised the disclosure.

We do not sell personal information to third parties.

9. International transfers

Some of the service providers used to operate WHR Army Builder may process or store personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we take steps to ensure that the transfer is made in accordance with UK data-protection law.

Depending on the country, service provider and processing involved, this may include relying on applicable UK adequacy regulations or appropriate contractual and other safeguards recognised under UK data-protection law.

You can contact us at swigglitz@gmail.com if you would like further information about international transfers relating to your personal information and the safeguards that apply.

10. How long we keep your information

We do not intend to retain account information indefinitely.

Account information and cloud-saved armies are kept while your account remains active, unless you delete particular content or request deletion of your account earlier.

Inactive accounts

An account that has not been actively used for 18 months will be treated as inactive.

The 18-month period is intended to give occasional users a reasonable opportunity to return to their saved armies while preventing dormant account information from being retained indefinitely.

When an account reaches 18 months of inactivity, we will normally send a warning to the registered email address and schedule the account for deletion 30 days later.

Signing in during that 30-day period will cancel the scheduled deletion and reset the inactivity period.

If there is no sign-in during the warning period, the account and associated WHR Army Builder cloud data will be deleted.

Deleted accounts and backups

When an account or saved content is deleted, it is removed from the live WHR Army Builder service.

Residual copies may remain temporarily within backups, security logs, audit records or other infrastructure systems.

Where this occurs, the information is retained only for the applicable backup, security, logging or disaster-recovery period and is subsequently deleted or overwritten in accordance with the relevant provider's retention arrangements.

Information retained solely within backups is not intended to be restored to the live service or used for ordinary account processing except where necessary for legitimate disaster recovery, security or legal purposes.

We periodically review our retention arrangements and will update this notice if the periods or criteria materially change.

11. Account and security logs

Our authentication and infrastructure providers may generate technical logs when you use WHR Army Builder.

These may include information such as:

• account or user identifiers;
• login and logout events;
• authentication attempts;
• timestamps;
• IP addresses;
• browser or user-agent information;
• password reset or email-verification events; and
• security and diagnostic information.

These records are used to operate and secure the service, investigate faults and detect or respond to misuse or unauthorised access.

They are not used for advertising or behavioural profiling.

12. Account deletion

You can delete individual saved armies through WHR Army Builder where that functionality is available.

You can delete your account directly through the account settings in WHR Army Builder. You can also request deletion of your account by contacting swigglitz@gmail.com.

Deleting your account removes the live account and associated WHR Army Builder cloud data, subject to the limited backup, security, legal and technical retention described elsewhere in this notice.

13. Your data-protection rights

Depending on the circumstances and the lawful basis being used, UK data-protection law may give you rights over your personal information.

These may include the right to:

• ask us for a copy of personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete your personal information;
• ask us to restrict how your information is used;
• receive certain information you provided to us in a portable format;
• object to processing in circumstances where the right to object applies; and
• complain about how your personal information has been handled.

Some of these rights are subject to legal conditions and do not apply in every circumstance.

To exercise any of these rights, contact swigglitz@gmail.com.

We may need to take reasonable steps to confirm your identity before acting on a request.

14. Browser storage and similar technologies

WHR Army Builder uses browser storage and similar technologies where necessary to provide account sessions, remember application state and support functionality such as locally saved army data.

These technologies are used to provide and secure the service. They are not used by WHR Army Builder for behavioural advertising or cross-site tracking.

15. Automated decision-making and profiling

WHR Army Builder does not use your personal information to make solely automated decisions that have legal or similarly significant effects on you.

We do not use your personal information for behavioural advertising or marketing profiling.

16. Security

We take reasonable technical and organisational measures designed to protect the personal information processed through WHR Army Builder.

These measures include, where appropriate:

• account authentication;
• encrypted network connections;
• database access controls;
• limiting access to account information;
• security and authentication logging;
• separation of private account data between users; and
• security measures provided by our infrastructure providers.

Database permissions are designed so that users cannot directly access or modify another user's private account information.

Authentication credentials are handled through the authentication service and passwords are not stored in WHR Army Builder's ordinary application database tables.

No internet-connected service can guarantee absolute security. We therefore review our security arrangements as the service develops and respond to identified security risks where appropriate.

17. Data breaches

If we become aware of a personal-data breach, we will assess the incident and take appropriate steps in accordance with applicable data-protection law.

Where the law requires us to notify affected users or the Information Commissioner's Office, we will do so.

18. Changes to this Privacy Notice

We may update this Privacy Notice where WHR Army Builder changes, where our service providers or data-processing arrangements change, or where this is necessary to reflect legal or regulatory requirements.

The latest version will be made available through WHR Army Builder and the date at the top of this notice will show when it was last updated.

19. Complaints

If you have concerns about how we use your personal information, please contact us first at swigglitz@gmail.com.

You also have the right to make a complaint to the UK data-protection regulator:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint