Privacy Policy

Version 2.0 · Last updated 14 August 2026 · Effective immediately

1. Who we are and how to reach us

Warleague Corp (“Warleague”, “we”, “us”) is the data controller for personal data processed through this website. Under the EU General Data Protection Regulation and the UK GDPR, that means we decide why and how your data is used, and we are accountable for it.

EU and UK representative. Because we are established outside the EU and the UK but offer goods to people in both, Article 27 of the EU GDPR and of the UK GDPR require us to designate a representative in each. We are in the process of designating them, and this section will name them with their addresses as soon as they are appointed. In the meantime, EU and UK residents can exercise every right described in this policy by writing to privacy@warleague.net, and we will answer within the statutory one month.

What this policy does not cover. Our Kickstarter campaign page, our WhatsApp community and VIP channels, our Facebook VIP group and our YouTube channel are run on platforms that are separate controllers of anything you do there. Their own privacy policies apply. Links from our pages to those platforms are ordinary links; following one takes you out of this policy’s scope.

2. The short version

• You can read this whole site without giving us your name. We do not require an account to browse, and we do not ask for one.
• If you are in the EU, EEA, UK or Switzerland, advertising and analytics cookies are off until you accept them, and declining is one click in the same place as accepting.
• We measure attention on our own pages — how long a section was on screen, how far a slider was swiped, which button you used, where you stopped reading. That measurement is first-party, stays on our server, and records no IP address, no user-agent string and nothing you type.
• We do not sell personal data, and we do not send anyone your data for their own marketing.
• Payments are handled entirely by Stripe and PayPal. We never see or store your card number.
• Global Privacy Control and Do Not Track signals are honoured everywhere, not just in Europe.

3. What we collect, why, and on what legal basis

3.1 Simply visiting the site

Our server and our hosting provider record standard technical information for every request: IP address, the page requested, the time, the referring page and the browser’s user-agent string. These are ordinary server logs, used to keep the site running, to diagnose faults and to detect abuse. Legal basis: our legitimate interest in operating and securing the site (Art. 6(1)(f)).

3.2 First-party attention measurement

On our home page and our campaign landing pages we run our own measurement, built in-house. For a page view it records: which sections and elements were on screen and for how long, how far down the page you scrolled, how far you advanced an image slider, which link or button you used to move on, and which element you were looking at when the visit ended. Every timing is aggregated into daily totals so we can tell which parts of a page work.

This measurement deliberately does not record your IP address, your user-agent string, your form input, your name or your email address, and it is never sent to a third party. It is also never applied to the cart, checkout or account pages.

Two levels exist. The baseline level stores nothing at all on your device. The extended level additionally keeps one random identifier in your browser’s local storage, so a returning visit can be told apart from a new one, and so a visit can later be labelled as having come from someone who joined the waitlist or bought something. That identifier is a random string; it is not derived from anything about you and we hold nothing that connects it to a person. Legal basis: your consent in the EU, EEA, UK and Switzerland (Art. 6(1)(a)); elsewhere, our legitimate interest in understanding which parts of our own pages are read (Art. 6(1)(f)).

3.3 Buying something

When you place an order we collect your name, email address, billing and shipping address, telephone number, the items ordered, the amount, and the order’s status and history. We need these to take payment, to ship the goods, to answer questions about the order, and to keep the tax and accounting records the law requires. Legal basis: performance of your contract with us (Art. 6(1)(b)) and compliance with our legal obligations (Art. 6(1)(c)).

Card details never reach us. The payment form is served by Stripe, and PayPal handles its own checkout in its own window. They are the ones that receive and store your payment credentials; we receive only the result of the payment, the last four digits and card brand where the gateway supplies them, and the transaction reference.

3.4 Where your order came from

When you arrive from an advertisement, a search result or another site, your browser stores a small record of that origin — the source, campaign, medium and any click identifier — and attaches it to an order if you place one. This is how we tell which campaign paid for itself. It is stored against the order, next to your email address, so it is personal data. Legal basis: consent where required for the storage on your device; our legitimate interest in measuring our own advertising (Art. 6(1)(f)) for the use of the resulting record. See the note in section 5 about the current exception.

3.5 Contact form, waitlist and support requests

Our contact form collects your name, email address, subject and message. Our waitlist form collects your email address only. Our support forms collect a category, subject, message, any images you attach, and — if you are signed in — your username, display name and account email. Submissions are stored on our own server; the forms are not a third-party service.

The contact form is protected by Google reCAPTCHA and by our own content filter. A submission the filter scores as spam is quarantined rather than deleted, so a genuine message wrongly flagged can be recovered. Legal basis: your consent for the waitlist (Art. 6(1)(a)); performance of a contract or pre-contractual steps for order-related support (Art. 6(1)(b)); our legitimate interest in answering enquiries and in blocking automated spam (Art. 6(1)(f)).

3.6 Warleague Plus accounts

If you create a Warleague Plus account we hold your username, display name, email address, hashed password, account state and registration date, together with what you do in the member area: campaigns and journeys, mission records, saved army builds and loadouts, collections, showcase entries, community posts, tutorial progress, and any in-platform balances. Accounts are created locally on this site; we do not use social sign-in.

Entries you publish to the showcase or the community area are visible to other members, and are subject to moderation records that note whether an item was approved, held or removed. Treat anything you publish there as public within the member area. Legal basis: performance of the member-area contract (Art. 6(1)(b)); our legitimate interest in moderating a shared space (Art. 6(1)(f)).

3.7 Crowdfunding backers and fulfilment

If you backed Warleague on Kickstarter, we received your name, email address, shipping address, telephone number, pledge tier and add-on selections from the campaign and its pledge manager. We use them to pack and ship your reward, to produce customs and invoice paperwork, and to tell you when your parcel is on its way. Our internal fulfilment records also hold the box size, a packing checklist, notes, the tracking number and the date it shipped. Access is restricted to named staff, and packers see only the fulfilment screen. Legal basis: performance of the contract created by your pledge (Art. 6(1)(b)) and our legal obligations in tax, customs and export documentation (Art. 6(1)(c)).

3.8 Email we send you

We send order confirmations, shipping notifications with a tracking link, support replies and account emails. These are service messages tied to something you asked for, not marketing. Waitlist and campaign email goes only to people who asked for it, and every such message can be stopped by replying or by writing to us. Legal basis: performance of the contract (Art. 6(1)(b)) for service messages; consent (Art. 6(1)(a)) for campaign email.

4. Cookies and similar technologies

A cookie is a small file a website asks your browser to keep. Local storage does much the same thing without being sent back on every request. This section lists both. Durations are the maximum; a cookie can always be shorter-lived if your browser is set to clear it.

4.1 Strictly necessary and functional

These are set without asking, because the site cannot do what you asked of it without them. They are not used for advertising or analytics.

4.2 Analytics and advertising

In the EU, EEA, UK and Switzerland these are set only after you accept. Everywhere else they are set by default, and you can switch them off at any time using the control in section 5.

4.3 Local storage

Besides wlm_v above, we keep wlm_consent — your cookie decision and when you made it — so you are not asked again on every page. A handful of interface keys remember that a one-time message has already been shown, or the sort order you chose on a staff screen. None of these are sent to us or to anyone else.

4.4 Embedded video

Our pages include YouTube videos. Nothing loads from YouTube until you press play. When you do, an embedded player from www.youtube.com is loaded, and at that point Google may set its own cookies and receive your IP address, in line with Google’s privacy policy. If you never press play, no request goes to YouTube.

5. Your cookie choice, and how to change it

If your browser reports a time zone in the EU, EEA, UK or Switzerland, a banner asks you to accept or decline analytics and advertising cookies before any are set. Accept and Decline are the same size, in the same place, and one click each. If your time zone cannot be read, we show the banner anyway and treat you as not having consented until you answer. Nothing on this site is withheld if you decline — no video, slider, stock counter or checkout behaves differently. The only cost falls on us: we improve the pages without knowing what worked.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a refusal and stay at the baseline level, wherever in the world you are, without asking.

You can change your mind at any time, from anywhere:

The first button reopens the banner. The second deletes the random identifier from your browser and asks our server to delete the visitor record it belongs to. Because we deliberately hold nothing that links that identifier to a person, this is the only way that record can be found — which is why the control is in your hands rather than ours. The anonymous page-level totals survive, because after erasure they describe a page and connect to no one.

6. Advertising and measurement

We advertise on Meta (Facebook and Instagram) and we measure our traffic with Google Analytics 4. Where you have accepted — or where consent is not required — these tools tell the platform that a browser viewed a page, added an item to a basket, joined the waitlist or completed a purchase, together with the value and the items involved. Purchases are additionally confirmed from our server to Meta’s Conversions API, so that a purchase is counted once rather than twice; that server-side message contains the order value, the items and contact details in hashed form.

Meta and Google use this to attribute sales to advertisements, to build audiences and to optimise delivery. That is profiling for advertising purposes. It does not produce any legal or similarly significant effect for you: it changes which advertisements you see, and nothing about the price you pay, the service you receive or any decision we make about you. We do not carry out automated decision-making within the meaning of Article 22.

You can also control this at the source: Meta ad preferences and Google My Ad Center.

7. Who we share data with

We do not sell personal data and we do not disclose it for anyone else’s marketing. We share it only with the providers we need to run the business, each under a contract that limits them to our instructions, except where they are named below as a controller in their own right.

We will also disclose data where we are legally required to, or where it is necessary to establish, exercise or defend legal claims. If the business is ever sold or reorganised, personal data may transfer with it, and this policy will apply until the acquirer publishes its own.

8. International transfers

We are based in the United States and our website is hosted there, so personal data of EU, EEA, UK and Swiss residents is transferred to the United States as a matter of course. Some fulfilment, invoicing and customs work is carried out in Türkiye, so backers’ and customers’ names, addresses, telephone numbers and email addresses are transferred there too.

Neither the United States nor Türkiye is the subject of a general adequacy decision. We rely on:

• the EU-US and UK-US Data Privacy Framework where the recipient is certified under it (this covers our major platform providers);
• the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where the UK GDPR applies, for other recipients including our Türkiye-based fulfilment and invoicing work; and
• Article 49(1)(b) — transfer necessary to perform the contract you entered into — where we must send your address to a carrier or a customs authority to deliver goods you ordered.

You can ask us for a copy of the safeguards in place by writing to privacy@warleague.net.

9. How long we keep things

Where a record must be kept for tax or legal reasons, we keep only that record and delete the rest — an erasure request will not be refused simply because an invoice has to survive it.

10. Your rights

If the EU GDPR or the UK GDPR applies to you, you have the right to:

• Access — get a copy of the personal data we hold about you, and be told what we do with it.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — have data deleted where we no longer need it, where you withdraw consent, or where you successfully object.
• Restriction — have us pause processing while a dispute about accuracy or legitimate interests is resolved.
• Portability — receive the data you gave us in a machine-readable format, and have it sent to another controller where technically feasible.
• Object — to processing based on our legitimate interests, and at any time and without giving a reason to processing for direct marketing.
• Withdraw consent — at any time, as easily as you gave it. Withdrawal does not affect what was lawful before it.
• Complain — to a supervisory authority. In the UK that is the Information Commissioner’s Office; in the EU it is the authority in the country where you live, work, or where the issue arose (the list is at edpb.europa.eu). We would rather you came to us first, but you do not have to.

Write to privacy@warleague.net. We answer within one month, and will tell you if we need the extra two months the law allows for a complex request. There is no charge. We may ask you to confirm something only you would know about your order or account — not to obstruct you, but because handing your data to someone impersonating you is the worse failure.

One honest limit. For our anonymous attention measurement we hold nothing that links its random identifier to a name or an email address. That is by design, and it means neither we nor anyone else can look up “your” measurement data on request. The button in section 5 is the only route to it, and it works because your own browser is the only place that identifier is kept.

11. Notice for US residents

We do not sell personal information for money. However, allowing Meta and Google to receive site activity for advertising counts as “sharing” for cross-context behavioural advertising under the California Consumer Privacy Act, and as “targeted advertising” under comparable state laws.

You can opt out with the Change my cookie choice button in section 5, which works from any country, and we honour Global Privacy Control signals automatically as a valid opt-out. California, Colorado, Connecticut, Virginia and other state residents also have rights to know, delete, correct and obtain a copy of their personal information, and not to be discriminated against for exercising them. Use the same address: privacy@warleague.net. We do not process sensitive personal information for the purpose of inferring characteristics, and we do not knowingly sell or share the personal information of anyone under 16.

12. Children

This site and the Warleague Plus member area are not directed at children. We do not knowingly collect personal data from anyone under 16, and accounts are not intended for them. If you believe a child has given us personal data, write to privacy@warleague.net and we will delete it.

13. Security

The whole site is served over HTTPS. Passwords are stored only as salted hashes. Staff access is restricted by role, so that people who pack parcels see the fulfilment screen and nothing else, and administrative screens are separately gated. Payment credentials never touch our systems. Exports containing customer data are generated on demand, streamed to the person who asked for them, and never written to a public location.

No system is perfect. If you find a security problem on this site, please tell us at privacy@warleague.net before telling anyone else, and we will act on it.

14. Changes to this policy

When we change how we use personal data, we update this page and change the version and date at the top. If a change materially affects you — a new purpose, a new category of recipient, a new basis — we will say so prominently on the site, and where consent is the basis we will ask again rather than assume the old answer carries over. Previous versions are available on request.