Privacy Policy
Last updated 4 November 2026
This policy explains what personal data Mordheim Manager collects, why, and what rights you have. Mordheim Manager (“the app”, “we”, “us”) is a tool for managing Mordheim tabletop warbands and campaigns, available at mordheimmanager.net.
1.Who is responsible for your data
The controller for your personal data is:
E.D. Wijninga
Contact: info@mordheimmanager.net
We are based in the Netherlands, so this app is governed by the General Data Protection Regulation (GDPR) and Dutch privacy law.
2.What data we collect
Account data. When you register, we collect your email address and a password (stored only in hashed form by our authentication provider — we never see it). You also choose a display name and an avatar style. Your email is used to sign you in, to send password-reset messages, and to contact you about your account if needed.
Warband and campaign data. Everything you create in the app: warband names and rosters, models, experience, injuries, equipment, gold, battle records (including dates, scenarios, opponents and results), campaigns you create or join, and campaign events (including dates, times and optional locations). This is the content the app exists to store for you.
Campaign membership. If you join a campaign, other members of that campaign can see your display name, your warband’s name, type and rating, and the shared battle log. Your private campaign objectives are not visible to other members — they are protected by database-level access rules, not just hidden in the interface.
Admin access to warbands and campaigns. The app admin can view any warband’s roster and any campaign’s content — standings, battle log, events and RSVPs, narrative log, territories and honours — including private ones, read-only. This is used to check how features are used and whether they work. Every such view is logged. The admin cannot change your warband or campaign, never sees a campaign’s join code, and your private campaign (Border Town Burning) objectives are never visible to the admin or anyone else.
Support reports. If you submit an issue report, we store the text you write together with technical context: the page you were on, the app version, your browser’s user-agent string, and a small amount of app context (for example, which warband type or unit you were viewing). This helps us reproduce and fix problems.
Why you deleted a warband. When you delete a warband, the app asks, optionally, why. If you answer, we store your answer and any note you add together with the warband’s type, its age, how many times it was edited and whether it was in a campaign — but not your name, your account or the warband itself, so the answer can’t be traced back to you. We use these answers only to improve the app. If you skip the question, nothing is stored.
Photos (planned feature). If and when photo uploads are enabled, any images you upload of your miniatures are stored on our behalf by our storage provider. Photos are kept in a private store and shown only to signed-in users; they are not exposed to anonymous visitors of the public gallery.
Your player profile. You can add a profile photo, a country, a short bio and a favourite warband type. All of these are optional. We store your country only — never a region, city or address. A profile photo is cropped and resized on your device before upload, and any location data embedded in the photo is removed in the process. Your profile, including your photo, is visible to every signed-in player; it is never shown to anonymous visitors or search engines. Your profile also shows counts of your battles, results, warbands and campaigns, but not their content.
The player directory and campaign invites. The player directory is opt-in and off by default. If you switch on “Show me in the player directory”, other signed-in players can find you by country, warband type and name, and campaign leaders can send you a direct campaign invite with an optional short message. When you’re listed, the directory shows your photo, display name, country, favourite warband type, number of public warbands, and whether you’re looking for a campaign. You can switch it off at any time; you then disappear from the directory and can no longer receive direct invites. If you decline an invite, nobody is told apart from the leader seeing that the invite is no longer open.
Technical data. Like any website, our hosting provider processes your IP address to deliver the app to you.
Analytics. We use PostHog to understand how the app is used so we can improve it. PostHog only runs if you agree to it via our consent banner. When you consent, PostHog collects usage data such as which pages and features you use and the actions you take, along with technical details like device type, browser, operating system, and an approximate location derived from your IP address, and it assigns a pseudonymous identifier to your browser. We use this only in aggregate to see which parts of the app are used and where problems occur; we do not use it for advertising. If you decline, PostHog is not loaded and no analytics cookies are set. You can change your choice at any time (see Section 10).
3.Why we process your data, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account | Performance of a contract — you asked us to provide the service |
| Storing your warbands, campaigns and battles | Performance of a contract |
| Showing your profile photo, country and bio to signed-in players | Consent — these are optional fields you fill in yourself, and you can remove them at any time |
| Listing you in the player directory and letting leaders invite you | Consent — only when you switch it on, and you can switch it off at any time |
| Showing a warband in the public gallery | Consent — this only happens when you mark a warband “public”, and you can make it private again at any time |
| Analytics, to see how the app is used and improve it (PostHog) | Consent — analytics runs only if you accept it, and you can withdraw at any time |
| Handling your support reports | Legitimate interest — fixing and improving the app |
| Keeping the app secure and available | Legitimate interest — protecting users and the service |
4.The public gallery
Mordheim Manager has a public gallery that is readable without an account, including by search engines and anonymous visitors on the open internet. A warband appears there only if you choose to mark it public. When you do, the following becomes publicly visible: the warband’s name and type, its rating, and your display name. Your email is never shown. Because this is public to anyone, please avoid putting personal information you don’t want public into a display name or a public warband’s name and notes. You can remove a warband from the gallery at any time by setting it back to private.
5.Who we share your data with
We do not sell your data or share it for advertising. We use the following processors (“sub-processors”) to run the app:
- Supabase — provides authentication, database and (for photos) file storage. Your account and game data are stored here. Hosting region: EU (Ireland) — AWS eu-west-1, so your data stays in the EU.
- Cloudflare — hosting and content delivery for the website. Processes your IP address to serve pages.
- PostHog — product analytics, to help us understand and improve how the app is used. Active only with your consent. Hosting region: PostHog EU Cloud (eu.i.posthog.com) — data is kept in the EU.
We may also disclose data if legally required to do so.
6.International data transfers
Your account and game data (Supabase, EU — Ireland), our analytics (PostHog EU Cloud) and our fonts (self-hosted) all stay within the European Economic Area. The one provider that may process data outside the EEA is our hosting and content-delivery provider, Cloudflare, whose global network handles your IP address to serve the site. Where that involves a transfer outside the EEA, it is covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.
7.How long we keep your data
- Account and game data — kept for as long as your account exists.
- Deleted warbands — when you delete a warband it is first soft-deleted (hidden and recoverable), then permanently purged after 30 days, along with any associated photos.
- Campaign records — battle log entries and campaigns remain as shared history for the group; you can remove your own reported battles.
- Deleting your account — done from Account › Your data and immediate. It removes your account, profile, warbands (with their photos), collection, comments and log entries you wrote, your friendly games, and campaigns in which you are the only member. Battles you reported in a campaign, events you organised and awards you granted stay as the group’s shared history, without your name. A campaign you lead alone passes to the member who joined it first.
- Support reports — kept while they remain useful for fixing the issue.
You can delete your account and associated data at any time (see Section 8). You can also export all of your data to a JSON file from the app at any moment.
8.Your rights
Under the GDPR you have the right to:
- Access a copy of your data — the app’s JSON export gives you this directly.
- Rectify inaccurate data — you can edit essentially everything in the app yourself.
- Erase your data (“right to be forgotten”) — you can delete warbands, campaigns and your account (Account › Your data › Delete account).
- Restrict or object to certain processing.
- Data portability — again, the JSON export provides this in a machine-readable format.
- Withdraw consent — for anything based on consent (such as a public warband), by making it private again.
To exercise any right, contact us at info@mordheimmanager.net. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
9.How we protect your data
Access to your data is enforced at the database level (row-level security), not merely hidden in the interface. Private warbands are only readable by you, your campaign and the app admin (read-only, logged); campaign objectives are only readable by you. Photos are stored in a private bucket and served through time-limited signed links. All traffic is encrypted over HTTPS. Passwords are handled and hashed by our authentication provider and are never visible to us.
10.Cookies and local storage
Mordheim Manager stores two kinds of information on your device:
- Strictly necessary (no consent needed). A login session token so you stay signed in, and your theme preference. Under the EU ePrivacy rules these are exempt from consent, so they are always active.
- Analytics (consent required). PostHog uses cookies and local storage to measure how the app is used. These are not strictly necessary, so we ask for your consent before they load. When you first visit, a banner lets you accept or decline analytics, with declining just as easy as accepting. If you decline, no PostHog cookies are set and no analytics data is collected.
You can withdraw or change your consent at any time — in the app, on the Account screen under Analytics, or via the Cookie settings link in the site footer. We do not use advertising or cross-site tracking cookies.
11.Children
Mordheim Manager is intended for hobbyists and is not directed at young children. If you are under 16 (the GDPR age of digital consent in the Netherlands), please use the app only with the involvement of a parent or guardian. We do not knowingly collect data from children below that age without such involvement.
12.Changes to this policy
We may update this policy as the app develops (for example, when photo uploads launch). Material changes will be noted in the app’s changelog, and the “Last updated” date above will change.
13.Contact
Questions about your data or this policy: info@mordheimmanager.net.