Privacy policy

Who we are

This site, warincwiz.com, is operated by Wicked Sick Ltd. We are the data controller for personal data collected through this site.

Contact: hello@warincwiz.com.

What we collect and why

• Account details (email, name, password hash). Used to provide your account and saved lineups. Legal basis: contract.
• OAuth profile data from Google or Discord if you sign in that way (your email and display name). Legal basis: contract.
• Discord account link, only if you connect Discord. We store your Discord user ID and username, optionally your in-game name, and whether you are a member of our Discord server. The membership answer is obtained from Discord and refreshed once a day for accounts that have connected; it exists so your clan can rally you and so we do not invite you to a server you already joined. You can remove all of it at any time with Disconnect on your security settings page. Legal basis: contract (clan features) and legitimate interest (not sending you invitations you do not need).
• Uploaded screenshots and lineup data. Used to extract heroes from your screenshots and save your lineups. Imported screenshots and the hero crops cut from them may also be retained to check and improve our hero-recognition model. Legal basis: contract (extraction) and legitimate interest (model improvement).
• Poll votes, only if you vote in a site poll. We store your answer, the time, and either your account (when you are signed in) or a scrambled form of the random id in the wiw_poll_voter cookie (we never store the id itself). Everyone sees only the totals; our admins can see which account picked which answer. Legal basis: legitimate interest (learning what our visitors want).
• IP address and basic request metadata. Used for rate-limiting, anti-abuse, and security logs. Legal basis: legitimate interest.
• Session and CSRF cookies. Strictly necessary for the site to work. Legal basis: strict necessity.
• Newsletter email, only if you submit our newsletter popup. Stored by Mailchimp. Legal basis: consent.
• Usage analytics, only if you allow analytics cookies. We use Google Analytics. Nothing is sent to Google before you allow it, and we never allow advertising use. After you allow it, Google receives the pages you view (with email addresses and similar personal details removed from page addresses), your approximate location (city, worked out from your IP address), browser and device details such as device model and screen size, whether you are signed in (yes or no, never who you are), and an analytics cookie identifier. Legal basis: consent. Withdraw it any time with Cookie settings in the footer; that deletes the analytics cookies from your browser and stops new collection.
• Visit counts without cookies. Cloudflare Web Analytics counts page loads without setting cookies and without identifying you. Legal basis: legitimate interest.

Third parties we share data with

• Cloudflare (CDN, security and cookie-free visit counts). Receives request metadata for every page load.
• Mailchimp (Intuit Inc., USA — newsletter platform). Only loads after you accept marketing cookies. Receives your IP, page URL, and any email you submit through the popup. Operates under the EU–US Data Privacy Framework.
• Google (OAuth login). Only if you choose that sign-in option.
• Google Analytics (Google Ireland Limited, with Google LLC in the USA), as our service provider. The tag is not added to the page until you allow analytics cookies, and Google's advertising features (Google signals, ads personalisation) are switched off. Transfers to the USA rely on the EU–US Data Privacy Framework and Standard Contractual Clauses. Our Analytics account also lets Google use this data to improve its own products and services; for that use Google decides how the data is handled (it is a separate controller), and Google says it does not use it for its own ad personalisation or ad targeting. Google's published position is that Google Analytics does not store full IP addresses. Google's privacy policy.
• Discord (Discord Netherlands B.V.). If you sign in with Discord, or connect it to an existing account. Beyond sign-in we also ask Discord, about once a day, whether connected accounts are members of our server, and we may grant such members a role there. Stops entirely when you disconnect.
• Our email delivery provider, for system emails such as password resets. The site itself runs on our own servers.

How long we keep data

• Account data: until you ask us to delete it.
• Imported screenshots and hero crops kept for recognition model improvement: retained until no longer needed for that purpose.
• Public lineup share-cards: indefinitely (they're part of the public site).
• Security and request logs: 30 days.
• Newsletter subscriptions: until you unsubscribe (handled by Mailchimp).
• Google Analytics: detailed analytics data is kept for 14 months and then deleted by Google; the period restarts when you visit again. Summary totals, such as visits per day, do not identify you. Withdrawing consent deletes the analytics cookies on your device and stops new collection.

Your rights

Under GDPR and UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Have it corrected if it's wrong.
• Have it deleted ("right to be forgotten").
• Receive a copy in a portable format.
• Object to processing based on legitimate interest.
• Withdraw consent at any time (this doesn't affect processing already done).
• lodge a complaint with your local data-protection authority (in the UK, the ICO).

Email hello@warincwiz.com to exercise any of these.

Cookies

See the cookie policy for a full list of cookies set by the site.

You can change your cookie preferences at any time via the "Cookie settings" link in the page footer.

Children

This site is intended for users aged 16 and over. We don't knowingly collect data from anyone younger. If you believe we have, please contact us and we'll delete it.