Privacy Policy

Last updated October 25, 2026. Plain-language summary of what the Cambria Combat Simulator ("we", "the site") collects and why. This is a small fan project, not a company, and this page is not legal advice.

1. What we collect

Without an account: nothing on our servers beyond what our host needs to deliver pages (see section 3). Your saved calculator builds, sound and animation choices and tutorial progress stay in your own browser's local storage and never leave your device.

With an account:

• Account name (public) and email address (private, never shown to other users).
• Password, stored only as a salted, slow hash (scrypt). We can't see it. When you choose a password we check it against known data breaches using Have I Been Pwned's k-anonymity service: only the first 5 characters of a SHA-1 hash leave our server, never the password.
• Two-factor details if you turn them on: your authenticator secret, hashed backup codes, and passkey public keys. Passkeys never give us your fingerprint or face data.
• Sessions: a random sign-in cookie, plus the browser/device name and a shortened network address (the last part of your IP address is removed, e.g. 203.0.113.0) so you can review and sign out devices.
• Security activity log: sign-ins, failed sign-ins, password and 2FA changes, with time, device name and shortened network address. We email you a sign-in alert with the same details.
• Forum content: posts, attached builds, comments, votes and reports.
• Genie Access payments: the blockchain, transaction hash, amount and dates, and your receipt ID.
• Build Genie questions are answered on our server by our own rules engine and are not stored and not sent to any AI company. We only remember whether you have used your one free answer.

We also keep short-lived technical records: one-time email codes, login and passkey challenges, and rate-limit counters (stored as one-way hashes) that stop spam and password guessing.

2. Why we use it

To run your account, keep it secure (sign-in alerts, 2FA, abuse limits), send emails you asked for (verification, password reset, security alerts), show your forum posts, and confirm Genie Access payments. We don't send marketing email, build profiles or show ads.

3. Who else is involved

• Netlify hosts the site and stores our data. Like any web host it processes your IP address to deliver pages and may keep short-term server logs. Our own logs record event types only, without your IP, device or name.
• Brevo sends our emails, so it receives your email address and the message. We ask Brevo not to track opens or clicks.
• Have I Been Pwned receives a 5-character hash prefix when you set a password (see above).
• Blockchain networks (Ethereum, Solana) and the node providers we query receive the transaction hash you submit so we can confirm a payment.
• Fonts, images and scripts are all served from our own site. There are no third-party analytics, ad networks, social widgets or AI services.

We share data with nobody else unless the law requires it.

4. What's public

Your account name, and anything you post, comment or attach in the forum, can be seen by anyone. Vote counts are public; who voted is not shown. Your email, payments and security details are never public. The site admin can see reports and the security activity log (with shortened network addresses) to deal with abuse.

5. How long we keep it

• Sign-in sessions: up to 30 days, or until you sign out or revoke them.
• Your security activity log: 90 days. The site-wide admin security log: 30 days.
• Email codes: 15–30 minutes. Login and passkey challenges: 5 minutes. Rate-limit counters: deleted once their window (15 minutes to 24 hours) ends.
• A daily clean-up job removes anything past these limits.
• Account, forum content and payment records: until you delete your account (see below).

6. Your choices and rights

• See and download your data: Account page → Your data → Download my data gives you a JSON file of everything tied to your account.
• Correct it: change your email and password on your account page, and edit or delete your posts and comments in the forum.
• Delete your account: Account page → Delete account (needs your password, and your 2FA code if 2FA is on). This immediately deletes your email, password hash, sessions, 2FA secret, backup codes, passkeys, activity log and votes, and removes you from reports you filed. Your forum posts and comments stay up but show the author as [deleted]; delete them first if you want them gone. Your account name is kept on its own, with no other data, so nobody can register it and impersonate you. Remaining paid time is lost (no refunds).
• For anything else, or if you can't log in, email us (section 10). We may ask you to prove the account is yours.

7. Payments and the blockchain

Crypto payments are recorded on a public blockchain that anyone can read and nobody, including us, can change or erase. When you delete your account we keep a minimal record of the transaction (hash, amount, date) so it can't be reused and for our no-refund accounting, but we remove the link to your account name. The blockchain itself will still show your wallet address and the payment.

8. Children

Accounts are for people aged 13 or older (16 or older in the EU/UK). If you think a younger child has an account, email us and we'll delete it. The calculator works without an account for everyone.

9. Security

HTTPS everywhere, strict security headers, hashed passwords, optional 2FA and passkeys, sign-in alerts and rate limits. No system is perfectly secure; if something goes wrong that affects your data we'll tell affected users by email.

10. Contact and changes

Privacy questions or requests: kovocollector+privacy@mail.grokbot.com. We'll aim to reply within 30 days. If this policy changes we'll update the date above, and for big changes we'll put a notice on the site.