Privacy Policy
Last updated 7 September 2026
This policy explains what personal data Mordheim Manager collects, why, and what rights you have. Mordheim Manager (“the app”, “we”, “us”) is a tool for managing Mordheim tabletop warbands and campaigns, available at mordheimmanager.net.
1.Who is responsible for your data
The controller for your personal data is:
E.D. Wijninga
Contact: info@mordheimmanager.net
We are based in the Netherlands, so this app is governed by the General Data Protection Regulation (GDPR) and Dutch privacy law.
2.What data we collect
Account data. When you register, we collect your email address and a password (stored only in hashed form by our authentication provider — we never see it). You also choose a display name and an avatar style. Your email is used to sign you in, to send password-reset messages, and to contact you about your account if needed.
Warband and campaign data. Everything you create in the app: warband names and rosters, models, experience, injuries, equipment, gold, battle records (including dates, scenarios, opponents and results), campaigns you create or join, and campaign events (including dates, times and optional locations). This is the content the app exists to store for you.
Campaign membership. If you join a campaign, other members of that campaign can see your display name, your warband’s name, type and rating, and the shared battle log. Your private campaign objectives are not visible to other members — they are protected by database-level access rules, not just hidden in the interface.
Support reports. If you submit an issue report, we store the text you write together with technical context: the page you were on, the app version, your browser’s user-agent string, and a small amount of app context (for example, which warband type or unit you were viewing). This helps us reproduce and fix problems.
Photos (planned feature). If and when photo uploads are enabled, any images you upload of your miniatures are stored on our behalf by our storage provider. Photos are kept in a private store and shown only to signed-in users; they are not exposed to anonymous visitors of the public gallery.
Technical data. Like any website, our hosting provider processes your IP address to deliver the app to you.
Analytics. We use PostHog to understand how the app is used so we can improve it. PostHog only runs if you agree to it via our consent banner. When you consent, PostHog collects usage data such as which pages and features you use and the actions you take, along with technical details like device type, browser, operating system, and an approximate location derived from your IP address, and it assigns a pseudonymous identifier to your browser. We use this only in aggregate to see which parts of the app are used and where problems occur; we do not use it for advertising. If you decline, PostHog is not loaded and no analytics cookies are set. You can change your choice at any time (see Section 10).
3.Why we process your data, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account | Performance of a contract — you asked us to provide the service |
| Storing your warbands, campaigns and battles | Performance of a contract |
| Showing a warband in the public gallery | Consent — this only happens when you mark a warband “public”, and you can make it private again at any time |
| Analytics, to see how the app is used and improve it (PostHog) | Consent — analytics runs only if you accept it, and you can withdraw at any time |
| Handling your support reports | Legitimate interest — fixing and improving the app |
| Keeping the app secure and available | Legitimate interest — protecting users and the service |
4.The public gallery
Mordheim Manager has a public gallery that is readable without an account, including by search engines and anonymous visitors on the open internet. A warband appears there only if you choose to mark it public. When you do, the following becomes publicly visible: the warband’s name and type, its rating, and your display name. Your email is never shown. Because this is public to anyone, please avoid putting personal information you don’t want public into a display name or a public warband’s name and notes. You can remove a warband from the gallery at any time by setting it back to private.
5.Who we share your data with
We do not sell your data or share it for advertising. We use the following processors (“sub-processors”) to run the app:
- Supabase — provides authentication, database and (for photos) file storage. Your account and game data are stored here. Hosting region: EU (Ireland) — AWS eu-west-1, so your data stays in the EU.
- Cloudflare — hosting and content delivery for the website. Processes your IP address to serve pages.
- PostHog — product analytics, to help us understand and improve how the app is used. Active only with your consent. Hosting region: PostHog EU Cloud (eu.i.posthog.com) — data is kept in the EU.
We may also disclose data if legally required to do so.
6.International data transfers
Your account and game data (Supabase, EU — Ireland), our analytics (PostHog EU Cloud) and our fonts (self-hosted) all stay within the European Economic Area. The one provider that may process data outside the EEA is our hosting and content-delivery provider, Cloudflare, whose global network handles your IP address to serve the site. Where that involves a transfer outside the EEA, it is covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.
7.How long we keep your data
- Account and game data — kept for as long as your account exists.
- Deleted warbands — when you delete a warband it is first soft-deleted (hidden and recoverable), then permanently purged after 30 days, along with any associated photos.
- Campaign records — battle log entries and campaigns remain as shared history for the group; you can remove your own reported battles.
- Support reports — kept while they remain useful for fixing the issue.
You can delete your account and associated data at any time (see Section 8). You can also export all of your data to a JSON file from the app at any moment.
8.Your rights
Under the GDPR you have the right to:
- Access a copy of your data — the app’s JSON export gives you this directly.
- Rectify inaccurate data — you can edit essentially everything in the app yourself.
- Erase your data (“right to be forgotten”) — you can delete warbands, campaigns and your account.
- Restrict or object to certain processing.
- Data portability — again, the JSON export provides this in a machine-readable format.
- Withdraw consent — for anything based on consent (such as a public warband), by making it private again.
To exercise any right, contact us at info@mordheimmanager.net. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
9.How we protect your data
Access to your data is enforced at the database level (row-level security), not merely hidden in the interface. Private warbands and campaign objectives are only readable by the people entitled to see them. Photos are stored in a private bucket and served through time-limited signed links. All traffic is encrypted over HTTPS. Passwords are handled and hashed by our authentication provider and are never visible to us.
10.Cookies and local storage
Mordheim Manager stores two kinds of information on your device:
- Strictly necessary (no consent needed). A login session token so you stay signed in, and your theme preference. Under the EU ePrivacy rules these are exempt from consent, so they are always active.
- Analytics (consent required). PostHog uses cookies and local storage to measure how the app is used. These are not strictly necessary, so we ask for your consent before they load. When you first visit, a banner lets you accept or decline analytics, with declining just as easy as accepting. If you decline, no PostHog cookies are set and no analytics data is collected.
You can withdraw or change your consent at any time — in the app, on the Account screen under Analytics, or via the Cookie settings link in the site footer. We do not use advertising or cross-site tracking cookies.
11.Children
Mordheim Manager is intended for hobbyists and is not directed at young children. If you are under 16 (the GDPR age of digital consent in the Netherlands), please use the app only with the involvement of a parent or guardian. We do not knowingly collect data from children below that age without such involvement.
12.Changes to this policy
We may update this policy as the app develops (for example, when photo uploads launch). Material changes will be noted in the app’s changelog, and the “Last updated” date above will change.
13.Contact
Questions about your data or this policy: info@mordheimmanager.net.