Privacy Policy

Information we handle

Information you provide

• Account details. If you sign in, we receive your email address and basic account identifiers through Supabase authentication (email/password or Google sign-in).
• Your tracking choices. Sprite collections, quest checkmarks, Battle Pass claims, map markers, remembered player lookups, and Wishlist items you choose to save.
• Sharing choices. If you publish a Wishlist link, the display name you choose and the items you publish.

Technical information

• Standard web-server logs from our hosting provider (requests, IP addresses, timestamps) used to operate and protect the site.
• Temporary, in-memory rate-limiting counters keyed by IP address on our API, used to prevent abuse.
• No analytics or advertising trackers. We do not run an analytics service, advertising network, or cross-site tracking pixel of our own. The third-party services listed below may process your requests under their own privacy policies.

Guest and local storage

Most tracking features work without an account. As a guest, your progress is stored in your browser using IndexedDB and localStorage rather than in our database. Your browser still makes normal network requests — to load Fortnite data, artwork, and the site itself — but your tracking choices aren't sent to our servers without an account. Local storage means:

• Guest progress is only available in the browser and device where you created it.
• Clearing your browser data, using private browsing, or switching devices may remove guest progress — it cannot be recovered.
• We do not set our own tracking cookies — your sign-in session is kept in browser storage. Third-party services you interact with (such as Google sign-in) may set their own.

Signed-in accounts and cloud sync

Signing in is optional. With an account, supported progress (Sprite collection, map markers, Battle Pass claims, quest checkmarks, and Wishlist items) synchronizes to our Supabase database so it follows you between devices.

• Synced records are scoped to your account and protected by Supabase row-level security, which is designed to restrict each record to its owner.
• Changes made offline sync when you reconnect; sync is best-effort, not a backup guarantee.
• Your password is handled by Supabase authentication — we never see or store it ourselves.

Public Wishlist sharing

• Wishlists are private by default. Publishing a link is always an explicit action you take.
• Anyone with the link can view the published items and your chosen display name — treat it as public.
• You can unpublish the link or reset it at any time. Resetting invalidates the previous link permanently.
• Social-media previews, screenshots, or copies others make may persist after you unpublish — we can't control what happens to a link once it's shared.
• Published Wishlists reflect your cloud-synced items, so publishing requires a signed-in account.

Third-party services

CAHCH Plays relies on a small set of services to operate:

• Supabase — account authentication and cloud database for synced progress.
• Hostinger — website hosting and standard server logs.
• api-fortnite.com and Epic Games services — Fortnite data (Sprites, quests, Item Shop, player stats, map, Battle Pass, news) and artwork served from Epic-operated CDNs.
• Google sign-in — only if you choose it as your sign-in method.
• Google Fonts — page typography, loaded when you visit.

When your browser talks to these services (for example, loading artwork or signing in with Google), those providers see your request under their own privacy policies. Fortnite content, statistics, and artwork belong to their respective owners.

Data security

Accounts are protected by authentication, synced data is isolated per account using Supabase row-level security, and the site is served over HTTPS with standard security headers and API rate limiting. No system is perfectly secure — we protect what's reasonable for a small fan project, but we can't guarantee absolute security.

Retention and deletion

Guest data lives in your browser and is removed when you clear your browser storage. Synced account data is kept while your account exists so your progress remains available. There is currently no self-service account-deletion control — email cahchplays@gmail.com to request deletion of your account and synced data. We may need to verify that the request comes from the account owner before acting. We'll process requests manually and remove what we control, but we can't guarantee immediate or complete deletion of server logs, backups, or records held by third-party services. Unpublished or reset Wishlist links stop resolving publicly, though copies others made may persist.

Children's privacy and your rights

CAHCH Plays is a general-audience fan project and isn't directed at children. We don't request age information and don't operate age verification. Depending on where you live, you may have rights to access, correct, or delete your information — contact us and we'll do our best to help.

Changes to this policy

We may update this policy from time to time. The current version is always posted at this URL with its "Last updated" date, and material changes will be called out on this page.

Contact

Privacy questions or requests: cahchplays@gmail.com