Privacy Policy

This website embeds no third-party scripts, fonts or tracking pixels. The following sections explain which technical providers are involved in hosting and individual features. On the server, successful requests to fixed feature categories are counted only as anonymous daily totals. Separate cross-visit analytics are used only after express consent and confirmation that the user is at least 16 years old.

Controller

1. Accessing the website (server logs)

When you access the website, technically necessary data is processed: IP address, time, requested address, amount of data transferred, browser type and operating system. This is necessary to deliver the website and defend it against attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the stable and secure operation of the service. This data is not combined with other sources and is not used to analyse your behaviour.

nginx access and error logs are rotated and compressed daily. No more than 14 rotated daily files are retained; older logs are deleted automatically.

To protect data-intensive player, clan, deck and leaderboard features from automated mass requests, we limit calls per IP address within a one-minute window. The IP address and counter used for this purpose exist only temporarily in memory, are not written to analytics or a separate dataset, and are discarded after the window expires. The legal basis is also Art. 6(1)(f) GDPR; our interest is protecting the service and external interface against abuse and overload.

2. Hosting and delivery

The server is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, at the Falkenstein data centre in Germany.

Cloudflare acts as a caching layer and protection against overload attacks. In particular, Cloudflare processes IP addresses and technical access data. The processor is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Because Cloudflare operates a global network, processing outside the EU cannot be ruled out. Cloudflare relies on its certification under the EU-US Data Privacy Framework and, where required, EU Standard Contractual Clauses in its Data Processing Addendum for transfers to the USA. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure, fast and reliable delivery during traffic peaks.

3. Player data from the Clash Royale API

When you enter a player or clan tag, our server requests the result from the official Clash Royale API operated by Supercell Oy in Finland, within the EU. Your IP address is not sent to Supercell; the request is made by our server, not your browser.

A player tag is a public identifier from the game. Supercell provides associated data such as name, trophies, battles and cards through its official interface. Responses are cached briefly: profiles and battle logs for 60 seconds, leaderboards for 5 minutes and the card catalogue for 60 minutes. They are then discarded. Requested player profiles are not stored permanently in a separate profile database.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is providing the requested statistics and tools using game data publicly supplied through the official API.

When you display a deck QR code, the generated Clash Royale deck link is sent to our own server and processed in memory only to create the QR image. It is not written to analytics or a separate QR dataset and is not transmitted to an external QR provider. Sections 1 and 2 continue to apply to technical infrastructure data.

4. Storage in your browser

For requested lists, settings and session features, the website uses localStorage, sessionStorage and one technically necessary cookie. Entries that are solely local are not transmitted to us. Lobby session data is sent to our server when you expressly use the multiplayer feature. Access to your device is based on Section 25(2)(2) TDDDG where the entry is strictly necessary for a feature you requested.

The following are stored in localStorage in particular:

recentPlayers

recently searched players

favoritePlayers

players you marked as favourites

recentClans

recently searched clans

savedDecks

decks you saved

mtArenaBuild

your Merge Tactics build

playerTrophyRoadBests

your previously observed trophy high

geier-identity-v1

your chosen display name and avatar; sent to our server when you use a lobby

geier-chat-style-v1

your selected lobby chat appearance

giveaway-entered

which Giveaway you have already entered

challenge-board:v1:…, streak-overlay:v3:… and merge-overlay:v1:…

state of configured plug-in trackers; the key may contain the player tag you selected

These local entries are not part of our analytics. You can delete them in your browser settings; local lists, tracker state and settings will then be reset.

The following are stored in sessionStorage for the lifetime of the browser tab:

geier-lobby-session-v1

lobby code, participant identifier and session token, sent to our server to authenticate lobby actions

geier-join-request-v1

identifier of a pending private-lobby request, sent to our server to check its status

The cr_gift_notify cookie remembers for one year that you closed the Reward notification prompt. It only contains the value 1 and is not used for identification or analytics.

Your privacy choice is stored as cookieConsent with version, choice and time. A positive choice additionally contains only ageConfirmation: 16plus, not your date of birth. The choice is requested again after no more than six months. Only after consent do analyticsVisitor and the current 30-minute analyticsSession exist. After withdrawal, the former identifier may temporarily be stored as analyticsDeletionPending solely to retry a deletion request after a network failure; it is removed after confirmation.

5. Anonymous feature counters without a browser identifier

For fixed tool endpoints defined in the program, the server only counts how many successful requests occur per calendar day. Examples include player profiles, Battle Logs, clan profiles, leaderboards, the Deck Builder and starting a Mini Game round. Only the date, fixed feature category and count are stored. These are request counts, not visitor counts.

Nothing is stored in or read from the browser for this counter. No IP address, header, cookie, session, query parameter, request body, player or clan tag, name, device or age enters the counter. The total therefore cannot be assigned to a person, visit or age group. In particular, we cannot determine whether a minor used a feature. Separate technical server and Cloudflare logs are described in Sections 1 and 2.

The purpose is solely to determine quantitatively which features are used overall. Daily totals are automatically deleted after 24 months. As no personal data enters this counter, it does not create a personal analytics dataset. As a precaution, we additionally rely on Art. 6(1)(f) GDPR; our interest is improving the service according to demand while minimising data.

6. Detailed analytics – only from age 16 and with consent

We want to understand which tools are actually used so we can develop the right ones. We therefore record how you move through the website only after you consent in the privacy banner and confirm that you are at least 16 years old. Users under 16 must not enable detailed analytics. We do not request a date of birth and only store the 16+ confirmation as part of the consent record.

We do not use an external analytics service such as Google Analytics or Matomo. Our own software stores and analyses the data solely on the Hetzner server. Delivery technically runs through Cloudflare as described in Section 2. Analytics are not used for advertising, sold or combined with other datasets.

The following is recorded:

Random identifier

a random string created in your browser (analyticsVisitor); it contains no name or contact details but links visits over time and is created only after consent

Consent record

version, time and confirmed 16+ statement associated with a measured session; no date of birth or exact age

Session and time

a second random value linking page views and tabs within a visit, and the server time of each event; a new session begins after 30 minutes without measured activity

Source

broad source and medium such as Google, Instagram, TikTok, YouTube, Discord, direct or another referral; for tagged links, technical UTM source, medium and campaign plus landing page; no full referring URL, external path or search term

Device group

broad device type, operating-system family and browser-width band; no full user agent or exact screen resolution

Opened sections and active time

main and sub-sections opened and active time in them; hidden tabs and longer periods without mouse, keyboard or scroll activity do not count as active time

Viewed profile metrics

trophy, rank and medal bands, Ranked status, league and King Level of the viewed profile; these describe the viewed account, not you

Viewed clan metrics

member count and War Trophy bands plus public join type; no clan name or clan tag

Search and tool use

source area, search type and result without entered text; opened sub-sections; favourites; saving, removing or transferring a deck by QR with deck source; Deck Builder steps, mode, level mode, orientation, name of the first requested card, counts of requested and banned cards and only whether a player tag was used; Reward filters and categories, opened plug-ins, and for Geier mode, action type, player/bot/spectator counts, round settings, duration, completion or abandonment. Geier names, lobby codes, chat messages, card picks and blocks are not recorded

Errors

area and fixed technical error code when an error is visible; no free-form error message or stack trace

Expressly excluded from detailed analytics are entered search text, player and clan tags, player and clan names, IP address, full user agent, exact screen resolution, Geier identity and communications, email addresses and complete decks of viewed players. Technical server and Cloudflare data remain separate as described in Sections 1 and 2.

The legal basis is your consent under Art. 6(1)(a) GDPR together with Section 25(1) TDDDG. You may withdraw it at any time under “Manage Cookies” in the website footer. Withdrawal stops collection immediately. The former random identifier is sent once to our deletion endpoint, all associated analytics events are removed from daily files, and the identifier is deleted from your browser. If transmission temporarily fails, the browser retries only this deletion request. Withdrawal does not affect the lawfulness of processing before withdrawal. We request a new choice after no more than six months.

If you do not withdraw earlier, detailed analytics data is automatically deleted 14 months after collection, one day file at a time.

7. Giveaway entries

If you enter a Giveaway, we store your player tag, associated player name, email address and entry time.

The sole purpose is conducting the Giveaway: the tag ensures one entry per person and the email address is used only to notify winners. No newsletter or advertising is sent to that address and it is not disclosed to others.

The legal basis is Art. 6(1)(b) GDPR. Data is automatically deleted 90 days after the relevant Giveaway ends. Entries remain while a Giveaway is active. You may request earlier deletion by emailing the address above.

8. Notifications about new Rewards

If you sign up for notifications about new free Rewards, we store your email address, confirmation time and a random unsubscribe token. Before being added, you receive a four-digit confirmation code by email. Unconfirmed codes are valid for 15 minutes and are then removed. Confirmed addresses remain until you unsubscribe through the link in each message or request deletion.

The sole purpose is the requested message when a new Reward goes live. There is no general newsletter or other advertising. The legal basis is consent under Art. 6(1)(a) GDPR, which you may withdraw through the unsubscribe link or by email.

Messages are sent using Resend, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. In particular, recipient address, message content and technical delivery data are sent to Resend. Resend relies on the EU-US Data Privacy Framework and additionally on EU Standard Contractual Clauses for transfers to the USA.

9. Feedback and bug reports

When you use the feedback form, we store the selected message type, feedback or bug categories, your respective free-form text, current route, active section and submission time. You may voluntarily add an email address, Reward preference and screenshot. The submission is not linked to your analytics identifier. IP address and user agent are not added to the feedback record; Section 1 still applies to necessary server data.

An original screenshot may be up to 12 MB and must be PNG, JPEG or WebP. The browser attempts to reduce larger images to no more than 1600 × 1600 pixels. The server checks and decodes the image again, limits it to the same dimensions and writes a new WebP file without the original metadata. Please still check that it contains no visible passwords, private messages or unnecessary personal data.

To prevent automated mass submissions, we limit submissions per IP address within a ten-minute window. The address exists only temporarily in memory and is not written to feedback or analytics; it is discarded when the window expires. The legal basis is Art. 6(1)(f) GDPR and our interest in protecting the service against abuse and unnecessary storage.

The purpose is handling your report, fixing errors and improving the website. The legal basis is Art. 6(1)(f) GDPR. If you request a response or possible voluntary recognition through a Reward, email address and Reward preference are also processed under Art. 6(1)(b) GDPR to handle your request. A Reward is not guaranteed.

The submission, voluntary contact details and screenshot are automatically deleted no later than 180 days after receipt. Factual findings may first be transferred to product planning without email address, screenshot or other personal content. You may request earlier deletion by email using the reference number shown after submission.

10. Geier lobbies

You choose a display name for shared game modes. Lobby and names exist only in server memory, never on disk. After six hours without lobby activity they are removed during the next fifteen-minute cleanup, and therefore no later than six hours and fifteen minutes after the last activity. A real name is not required.

11. Advertising

At present, no advertising is delivered and no advertising networks are integrated. Before that changes, this Policy will be updated and consent obtained where required.

12. Your rights

You have rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). Contact us informally using the email address above.

You may also complain to a supervisory authority. Our competent authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

13. Changes

If the website gains features that process data differently, this Policy will be updated beforehand. The version published here at the relevant time applies.

This is an independent fan project. This material is unofficial and is not endorsed by Supercell. See Supercell's Fan Content Policy.

Last updated: 13 August 2026 · Legal Notice · Terms of Service