Privacy Policy

Effective from 11 September 2026

This is an English translation provided for convenience. If it differs from the Hungarian version, the Hungarian version applies.

This policy explains what personal data Csatakalapács (csatakalapacs.hu) handles, what we use it for, who can see it, how long we keep it, and what your rights are. It follows the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Hungary’s Act CXII of 2011 on informational self-determination (Infotv.).

In short:

Csatakalapács is a free, ad-free matchmaking service. We don’t sell or rent your data, and we don’t use it for advertising.
What’s on your profile, in your posts and in your venue check-ins is public on purpose — that’s how finding opponents works. Section 4 lists exactly what shows.
Match chat, your notifications and tournament army lists are not public.
You can delete your account at any time, immediately, on the My account page.

1. Who is responsible for your data?

The controller is Csutorás Péter, who operates Csatakalapács (“we”, “us”).

Contact: support@csatakalapacs.hu — write here with any question or request about your data.

We are not required to appoint a data protection officer, so there isn’t one.

2. What we handle, why, and on what legal basis

We only handle what the service needs. The legal bases, under Article 6 GDPR:

Performance of a contract (Art. 6(1)(b)): what we handle because you asked for it — your account, profile, posts, games. The service can’t work without it.
Legitimate interests (Art. 6(1)(f)): security, community statistics, reviews and visitor statistics. You can object to these (Section 11).
Consent (Art. 6(1)(a)): push notifications. You can withdraw it any time.

Category	What data	Why, and who sees it	Legal basis and retention
Account and sign-in	Email address. With Discord: your Discord ID, username, display name, avatar and email. With Google: your Google ID, name, email and profile picture. Time, IP address and browser details of sign-ins, in the authentication log.	Creating your account, signing you in, preventing abuse, and emailing you when someone answers your post (you can turn this off in your settings). Other users never see your email.	Contract; logs on legitimate interests (security). Until you delete your account; logs briefly, per the provider’s settings.
Profile	Username, display name, profile picture, bio, location (county or Budapest district), languages, experience, Discord username (if you signed in with Discord).	So other players can decide whether to play you. Public; the picture is reachable by a public link.	Contract. Until you delete your account.
Armies	Game system, faction, name, points, paint status, photo, notes.	Part of your profile. Public.	Contract. Until you remove it, at the latest until you delete your account.
Posts	Game system, format, points, play style, factions, factions you’d like to face, experience, languages, notes, time slots, venues.	Finding and suggesting opponents. Public while open, and may appear in the chosen venues’ Discord channels (Section 5).	Contract. A post expires; after that only you see it, until you delete your account.
Games and results	Participants, time, venue, mission, scores, outcome, factions, battle report, the public or private setting.	Arranging and recording the game. Participants see everything; anyone can see a confirmed game marked public.	Contract. Kept after you delete your account, because it is your opponent’s result too — your side shows as “Deleted player”.
Match chat	Message, sender, time.	Arranging the game. The game’s participants see it; an admin looks only to investigate a report or abuse.	Contract. Until you delete your account.
Reviews	Whether the other player showed up, whether you’d play them again, whether their army was painted, a comment.	So people in the community can trust each other. Not anonymous: both the reviewer and the reviewed player can be identified, and other users can access them.	Legitimate interests. Until the reviewer or the reviewed player deletes their account.
Follows	Who you follow.	Your feed and notifications. Public.	Contract. Until either player deletes their account.
Venue check-ins	Venue, day, arrival and leaving time, game system, note.	So others know when and where to find an opponent. Public, and may appear with your name in the venue’s Discord channel (Section 5).	Contract. Until you remove it, at the latest until you delete your account.
Tournaments	Entry (faction, army, status, note, payment as recorded by the venue), army list (text or link), pairings and results.	Running the event. For published tournaments the field, pairings and results are public; your army list is seen only by you and the organising venue’s staff.	Contract. Results stay as part of the event’s history; when you delete your account, your army lists are deleted and your entry remains as “Deleted player”.
Notifications	What the notification says, and whether you’ve read it.	Telling you about applications, replies and results. Only you see them.	Contract. Until you delete your account.
Push notifications	Your browser’s push address and encryption keys, and the browser type.	Notifying you when the site isn’t open.	Consent — only if you turn it on. Until you turn it off or delete your account.
Venue staff	Role, title, who invited you.	Access to the venue’s management pages.	Contract. Until the role ends, at the latest until you delete your account.
Statistics	Win rate, streak, faction and system statistics, head-to-head records and leaderboard, computed from confirmed results; the community-wide summary.	Community statistics. Public. Private games count too, but only in totals — the game itself never becomes public.	Legitimate interests. As long as the results behind them exist; your own statistics end with your account.
Visitor statistics	The page address, where you came from, country, region and city, device type, operating system, browser, time. No cookies: visitors are identified by a hash made from the request, which is discarded after 24 hours.	Seeing which parts of the site people use. We only see totals.	Legitimate interests. In aggregate form, per the provider’s (Vercel’s) settings.
Server logs	IP address, browser, requested page, time, error messages.	Running the service, fixing faults, preventing abuse.	Legitimate interests. Briefly, per the hosting providers’ settings.
Feedback	Your message, the page you sent it from, the email address you gave, and your account if you were signed in.	Answering you and improving the service. It also reaches us by email; only admins can see it.	Legitimate interests. As long as needed to reply, at most 2 years; deleting your account deletes the feedback linked to it.
Emailing us	Your email address and message.	Answering your question or request.	Legitimate interests; for data protection requests, legal obligation (Art. 6(1)(c)). As long as needed to reply; for data protection requests, 5 years, so we can show how the request was handled.

3. Where the data comes from

Mostly from you. Also:

from Discord or Google, if you sign in with them — only what Section 2 lists;
from other players: your opponent can record the result of a game you played together, and can review you;
from venues: a venue running a tournament can record the status of your entry and whether you paid the entry fee.

4. What is public?

Anyone can see these, even without an account:

your profile (display name, username, picture, bio, location, languages, experience, Discord username), your armies and who you follow;
your open posts, with their times and venues;
your venue check-ins: where you’re going and when;
reviews you gave and received;
your confirmed games marked public, your statistics and your leaderboard position;
for published tournaments, your name in the field, your pairings and your results.

Profile and post pages ask search engines not to list them. Listing pages — open posts or tournaments, for example — can appear in search results, and may show your display name.

Don’t put anything on your profile you wouldn’t want public. Your display name can be a nickname — whatever people call you at the club.

5. Announcements on Discord

Venues and the community use Discord servers. When you post a game, or say you’re going to a venue, Csatakalapács may send a short message to that venue’s — or the community’s — Discord channel: your display name, the game system, points, venue and day, and a link.

These messages live on Discord’s servers under Discord’s terms, and anyone with access to that channel can see them. Deleting the post or check-in doesn’t remove them, and we can’t remove them afterwards — the server’s moderators can. Write to us if you need help with that.

6. Who else handles data

Processors — they work on our behalf and on our instructions:

Supabase, Inc. (USA) — database, sign-in, file storage (profile pictures). The database is in the European Union, in Frankfurt.
Vercel, Inc. (USA) — serving the website and visitor statistics. Server-side code runs in Frankfurt; static content is served from a worldwide network.
Resend, Inc. (USA) — delivering sign-in links, feedback and notifications by email.

Independent controllers — they handle data under their own terms:

Discord, if you sign in with it, and for announcements on Discord (privacy policy);
Google, if you sign in with it (privacy policy);
your browser’s push service (Google, Mozilla, Apple or Microsoft, depending on the browser), if you turn on push notifications — the notification’s content passes through it encrypted;
the venue running a tournament, which uses your entry and army list to run the event.

If your profile picture comes from Discord or Google, visitors’ browsers load it directly from Discord’s or Google’s servers.

We only give data to authorities where the law requires it. We don’t sell or rent data, and we don’t share it with anyone for advertising.

7. Transfers outside the EU

Supabase, Vercel and Resend are US companies. Although the database is in the EU, these providers may access data from the United States while operating or supporting their services. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses included in the providers’ data processing agreements.

8. How long we keep data

Your account and everything that belongs to it: until you delete the account.
Games and tournament results: longer, because they are part of your opponents’ records — your side stays as “Deleted player”, separated from your name.
Expired posts: until you delete your account; only you see them.
Logs: briefly, per the providers’ settings.

Deleted data can remain in the providers’ backups for a while, until they are overwritten. We don’t restore it from there or use it.

9. Deleting your account

Delete your account on the My account page; it takes effect immediately.

Deleted: your profile and picture (including the stored file), your bio, armies, posts, follows, venue check-ins, chat messages, the reviews you gave and received, your notifications, push subscriptions, tournament army lists, and the sign-in itself.

Kept: the games you played and tournament results, with your side marked “Deleted player” — they are part of your opponents’ results. Announcements already posted on Discord don’t disappear either (Section 5).

10. Cookies and data stored in your browser

Name	What for	How long
`sb-…-auth-token`	Keeps you signed in. You can’t sign in without it.	Up to 400 days; removed when you sign out.
`sb-…-auth-token-code-verifier`	Completing sign-in securely while Discord, Google or the email link sends you back.	Until sign-in completes.
`CSK_LOCALE`	Remembers the language you chose.	1 year.
`csk-theme`	Remembers the light or dark theme.	1 year.

We use no advertising or tracking cookies, and the visitor statistics use no cookies at all. The cookies above are needed for the service to work or to remember settings you chose, so we don’t ask for separate consent.

If you turn on push notifications, your browser installs a small background script (a service worker) used only to receive them.

11. Your rights

Access (Art. 15 GDPR): ask what data we hold about you, and get a copy.
Rectification (Art. 16): edit your profile yourself; we’ll correct anything you can’t.
Erasure (Art. 17): delete your account yourself, or ask for particular data to be deleted.
Restriction (Art. 18): ask us to only store data while something is in dispute.
Portability (Art. 20): get the data you gave us in a machine-readable format (JSON).
Objection (Art. 21): object to processing based on legitimate interests — statistics, reviews, visitor statistics, logs.
Withdrawing consent (Art. 7(3)): turn push notifications off at any time.

Send requests to support@csatakalapacs.hu, ideally from the email address on your account, so we can check it’s really you. We reply within one month; where justified this can be extended by two more months, and we’ll tell you if so. Requests are free.

If you think we’ve infringed your rights, contact us — or complain to the Hungarian data protection authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH; 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu; naih.hu), or to the supervisory authority where you live. You can also go to court; in Hungary you may bring the case before the regional court of your place of residence or stay.

12. How we protect data

Every connection is encrypted (HTTPS).
We store no passwords: you sign in with Discord, Google or a single-use email link.
The database controls access row by row: each piece of data can only be read by the people it’s meant for — match chat only by the game’s participants, for example.
Admins — the operator and the people the operator appoints — can access all data on the site, including private chats, notifications and army lists. They use that only to investigate reports, deal with abuse, fix problems or meet legal obligations. Push notification keys and Discord webhooks stay out of their reach too.
In a personal data breach we follow the GDPR: where required we notify the NAIH within 72 hours, and we tell you if the breach is likely to put you at high risk.

13. Children

Csatakalapács is for people aged 16 and over; you can’t create an account if you’re younger. If we find that such an account exists, we delete it.

14. Automated decision-making

Suggestions — who fits you — are made automatically from the game system, time, venue and play style. They only put options in order; we make no automated decision with legal or similarly significant effects on you (Art. 22 GDPR).

15. Changes

When the service changes, we update this policy; the date the current version took effect is at the top of the page. We announce significant changes on the site in advance.