Privacy notice
How 40K Playbook handles your data, and what you can do about it.
The short version
You can use 40K Playbook without an account, and if you do, nothing about you leaves your device. Signing in stores your name, email address and profile picture so your rosters can follow you between devices — nothing more. There is no analytics, no tracking and no advertising anywhere in this app, and nothing is sold or shared for marketing.
Without an account
Rosters are saved in your browser’s local storage and never sent anywhere. Roster files you import (.rosz / .ros) are unzipped and read entirely in your browser — they are not uploaded. Clearing your browser data deletes all of it, and there is nothing on our side to delete.
What is stored if you sign in
Signing in with Google or Discord stores, in a MongoDB Atlas database: your name, email address and profile picture URL as supplied by that provider; an access token identifying the connection to them; your active sessions; and the rosters you save. Your password is never seen by this app — authentication happens with the provider.
Why, and on what basis
The only purpose is to let you sign in and sync rosters across your devices. The lawful basis is your consent, given by choosing to create an account; you can withdraw it at any time by deleting the account, which is immediate and complete.
How long it is kept
Your account data is kept until you delete it. Sessions expire on their own and are removed. Deleting your account removes your profile, your provider connection, every session and every roster saved to the account, straight away and permanently — there is no soft-delete and no backup copy retained for this purpose.
Who else is involved
Google or Discord, whichever you sign in with, and who tell us only your name, email and picture. MongoDB Atlas, which hosts the database. Vercel, which hosts the site and processes requests. Each of these processes data on our behalf; none of them receives anything about you for their own marketing.
Your rights
Under UK GDPR you may ask for a copy of your data, ask for it to be corrected or erased, or object to it being processed. Erasure is built in: use Delete my account. For anything else, message me on Discord and ask — say if you would rather correspond privately and a private address will be provided rather than discussing it in the open. You can also complain to the Information Commissioner’s Office at ico.org.uk.
Cookies
One cookie, set only when you sign in, which keeps you signed in. There are no advertising or analytics cookies, so there is nothing to consent to and no banner to dismiss. Your light or dark theme preference is stored in your browser, not in a cookie.