Privacy Policy

1. Who we are

Kingshot KVK Prep Scheduler (kingshotprep.com, the “Service”) is a free, fan-made scheduling tool for the mobile game Kingshot, run as a hobby project. For the purposes of the EU and UK General Data Protection Regulation (GDPR), the operator of the Service is the data controller for the data described in this policy, reachable through our contact form.

2. What stays in your browser

Importing a CSV of form responses, estimating points, filling slots, editing, and downloading a save file all happen entirely in your browser. The file you import is parsed locally and is never uploaded to us. It only leaves your device if you sign in and choose “save to account” or “publish a link”.

The Service keeps a few small settings in your browser’s local storage: your light/dark theme choice and whether you dismissed the kingdom-number prompt. These stay on your device and contain no personal information.

3. Information we collect and store

Account data (optional). If you sign in with Discord or Google, our authentication provider (Supabase) stores your account ID, the email address and display name shared by that provider, and an avatar URL if one is provided. We never see or store a password.

Kingdom numbers (optional). After signing in you may be asked which kingdom(s) you schedule for. This is used only to understand overall usage of the tool, is never shown to other users, can be skipped, and can be changed or cleared any time in Settings.

Saved schedules. A schedule you save to your account stores the full schedule: the in-game data submitted by your players through your sign-up form (in-game names, player IDs, alliance tags, Town Center tier, pledged resources and speedups, availability, and form comments), plus slot assignments and your edits. It is associated with your account and visible only to you.

Published share links. Publishing creates a read-only snapshot containing only the schedule title and each slot’s player name and player ID. Resources, availability, and comments are not included. The snapshot is visible to anyone who has the link. Links use random IDs, cannot be listed or guessed in practice, and are excluded from search-engine indexing.

Aggregate schedule statistics. When you publish and save a schedule, we also store a small statistical summary of it — counts and totals such as roster size, slots filled, projected point totals, and stage and resource distributions. These summaries contain no player names, player IDs, or alliance tags, and we use them to understand overall usage and improve the Service.

Technical data. To protect the Service from abuse we rate-limit requests using your IP address (or your account ID when signed in). These identifiers are held briefly in server memory and are discarded within minutes; we do not write IP addresses to a database or to logs. Our hosting provider (Section 6) processes IP addresses as part of delivering the site, under its own policies.

4. Cookies

The Service sets only strictly necessary cookies: the session cookies that keep you signed in (set by our authentication provider, Supabase). There are no advertising or tracking cookies, which is why there is no cookie consent banner. If you never sign in, browsing the scheduler and published schedule pages works without any identifying cookies.

5. Analytics

When enabled, the Service uses Umami, a privacy-focused analytics tool, through its hosted service Umami Cloud (Section 6). It is cookie-free, does not build visitor profiles, and records anonymous page views and feature-usage events (for example, “a CSV was imported” or “a link was shared”). It never records the contents of a schedule or any player data. We do not use Google Analytics or any advertising tracker.

6. Who processes data on our behalf

We do not sell personal information, share it for advertising, or give anyone access to it beyond the service providers needed to run the site:

• Supabase: database and authentication (accounts, saved schedules, share snapshots, kingdom numbers).
• Discord / Google: sign-in providers. They tell us who you are; we do not receive your contacts, messages, or any other data from them, and they learn only that you signed in to this site.
• Hostinger: the hosting provider whose server the Service runs on. Like any host, it sees the traffic that reaches the site.
• Umami Software, Inc.: hosted analytics (Umami Cloud). It receives the anonymous page views and feature-usage events described in Section 5, and no account or schedule data.

Two things are hosted on Tally.so: the sign-up form templates and our contact form. Your players’ form responses go to your own Tally account. The Service never connects to Tally and only receives that data if you export the CSV and import it yourself. What you submit through our contact form goes to our Tally account and is handled under Tally’s own privacy policy; submit only what you are comfortable sending. We would disclose data if legally required to, and have never been asked to.

7. Information about other players

Schedules are built from data that kingdom organizers collect from their players through sign-up forms. If an organizer saves or publishes a schedule, the in-game information described in Section 3 is stored with it. The organizer is responsible for collecting that data with their players’ knowledge, as our Terms of Service require.

If you are a player who appears in a saved or published schedule and you want your information removed, ask your schedule organizer, or reach us through our contact form (any report type works) with the share link and your in-game name or player ID in the description, and we will remove it.

8. How we use information

• to provide the Service: saving schedules, serving published links, keeping you signed in;
• to protect the Service: rate limiting and abuse prevention;
• to understand aggregate usage: anonymous analytics and optional kingdom numbers;
• to respond when you contact us.

For readers in the EEA/UK, the legal bases are performance of a contract (providing the Service you asked for), legitimate interests (security, abuse prevention, and anonymous usage statistics), and consent where we ask for something optional, which you may withdraw at any time.

9. Retention and deletion

Saved schedules and account data are kept until you delete them. Deleting a schedule also deletes any share links published from it; a deleted or revoked link stops working within about a minute. Deleting your account removes your profile and every schedule and share link it owns.

You can delete individual schedules from your account page, and you can delete your account itself from the Settings page. Deletion is immediate and irreversible, and removes your profile and every schedule and share link the account owns. If you cannot sign in, you can instead request deletion through our contact form (any report type works; just say in the description that it is an account-deletion request), and we will confirm the request comes from the account owner before acting on it. Rate-limiting data expires from memory within minutes on its own.

10. Your rights

Depending on where you live, you may have the right to access, correct, export, delete, or restrict the processing of your personal data, and to object to processing based on legitimate interests. If you are in the EEA or UK, you also have the right to lodge a complaint with your data protection authority. If you are a California resident, you have the rights to know, delete, and correct, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as defined by the CCPA, and we do not use it for cross-context behavioral advertising.

To exercise any of these rights, use our contact form. Any report type works; describe the request in the description field. We will not discriminate against you for doing so.

11. International transfers

The Service’s providers may store or process data outside your country, including in the United States and the European Union. Where required, transfers rely on safeguards such as the providers’ standard contractual clauses.

12. Security

All traffic is encrypted with HTTPS. Saved schedules are protected by database-level row security so that only your own account can read them, published snapshots expose only the minimal fields described above, and the application runs with restrictive browser security headers. No system is perfectly secure, but the Service is designed to store as little as possible in the first place.

13. Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the Service evolves. The “Last updated” date at the top reflects the current version, and material changes will be reflected here before they take effect.

15. Contact

Privacy questions and requests: use our contact form. More about the project is on the About page.