Privacy and account data

Local play and saved work

Local teams, portable files and anonymous play do not require an account. Saved teams, full local game reports and local playtest measurements stay in browser storage unless you choose to export or share them through a connected feature. Completed games started while signed in also contribute their win/loss result and opponent type to your private account game record. Clearing browser storage can remove those local copies.

An essential random browser cookie helps prevent the same browser from taking a second seat in anonymous private rooms. It is used only for online room requests, lasts no more than one year, and is not used for activity tracking.

Optional accounts and sync

When account service is available, a configured sign-in provider identifies your account. Pennant Run stores its provider identifier and display name, linked sign-in methods, private session records, and the reference-only teams or workspaces you explicitly upload. Signing in alone uploads nothing. Accounts are not merged merely because providers report the same email address.

Sync copies contain selected player references and setup choices, not source datasets, live game state, room credentials or played results. Changes are explicit; conflicting versions require review. The ten most recent retained item versions support recovery. Export account data before deleting your account if you want to keep a copy.

Game records count individual completed games against human or AI opponents. Local results are reported by the device where each game was played; online results come from the game server. Retries do not add another result. Signing in does not claim earlier anonymous games or imported reports.

Optional activity measurement

Activity measurement is off until you opt in under Account & sync. Qualifying actions are intentionally opening analytical detail or a saved team, sharing a workspace, and using the marked game-start or in-game controls. Page loads, asset downloads and changes to appearance do not count. Known automated browsers, deployment checks and operator validation are excluded; these checks cannot prove that every event came from a human.

We retain one activity day per consenting identity, in UTC, for 35 days. Daily and calendar-month active accounts are reported separately from random browser-installation identifiers. A browser installation is not a person; the same person may use several installations or appear in both groups after signing in. We do not add those counts together or fingerprint devices. Older or incomplete reporting periods are labeled accordingly.

Activity records do not include player selections, roster content, game decisions, IP addresses or referrers. The service stores a keyed hash of the account or random installation identifier and the active date. Consent remains recorded until revoked. Turning measurement off stops this browser immediately and requests deletion of the applicable stored activity; if offline, deletion must be retried when connected. Account deletion also removes that account’s activity.

Deletion, security and service providers

Account deletion removes account identity, active sessions, synced items, retained item versions and locally reported game results from the live account service. Private online competition history and completed game results are retained separately with an opaque account reference. A newly created account cannot inherit it. Copies you downloaded or saved locally remain on your devices. Private recovery backups can retain older snapshots. A separate private record retains hashed account deletions and consent revocations so recovery can honor those requests; restored sessions are invalidated. We keep seven daily backup generations. The newest verified recovery copy is retained until replaced, which can take longer during an outage. Hashed deletion and consent-revocation records are retained to protect recovery for as long as this recovery system operates. Recovery requires the latest verified revocation record; if that authority cannot be verified after an incident, account recovery stays unavailable.

Cloudflare provides the site’s network and anti-abuse services. Sign-in providers process authentication under their own policies. The contact form sends your message and email privately to the Pennant Run team. Private account routes and API responses are not public search content.

For access, recovery or privacy questions, contact [email protected] or use the contact form. Account & sync provides available consent, export and deletion controls.