Privacy Policy

Last updated 10 October 2026

Dilectus (dilectus.app) is run by Adam Probert in the UK, who is the data controller. We collect as little as we can.

What we collect

• Account details — your email address, display name and, if you use email sign-in, a hashed password. If you sign in with Google or Discord we receive your name, email address and profile picture from them.
• Profile picture — optional. If you upload one, your browser crops and shrinks it first; we keep only that small square, on Vercel's storage, until you remove it or delete your account.
• Your army lists — saved in your browser, and on our servers if you sign in so they sync between devices.
• Live lists and battles — while a list or battle is open, our servers note that a device of yours has it open (a random id for the browser tab, not the device itself), so that it can go live if another of your devices opens it too; the note goes when the page closes, or stops counting after 15 minutes and is deleted soon after. When a list or battle is open on more than one of your signed-in devices, they connect to each other directly, so each learns the other’s IP address. The short messages that introduce them pass through our servers and are deleted within minutes. To find a route between them, your browser asks a public server run by Cloudflare or Google for its own IP address, and devices that can’t connect directly relay through Cloudflare.
• Battles against another player — when you invite someone with a code, or join their battle, your opponent sees your display name and profile picture (never your email), the list you play and your battle as it goes, and you see theirs. Your devices connect to theirs directly in the same way, so each of you learns the other’s IP address unless the connection is relayed. The match, its round and victory points are kept on our servers with your account; codes that find nothing are counted for a day to stop guessing.
• Sessions — a sign-in cookie, plus the IP address and browser type of each session, for security.
• Bug reports — what you write in Report a bug goes to the project’s maintainers, without your name or email. To limit abuse we keep a scrambled form of your IP address, which can’t be turned back into the address, for a day.
• Usage — which pages are visited, and when lists and battles are created, edited or deleted (the game and army, never their contents), without cookies. A visit is counted with a scrambled form of your IP address and browser that changes every day and can’t be turned back into either, so you can’t be followed from one day to the next. If you’re signed in, this activity is linked to your account. We also use Vercel Analytics for anonymous, cookie-free page view statistics.
• Performance — anonymous, cookie-free page speed measurements (how long pages take to load and respond) via Vercel Speed Insights.

How we use it

To run the service: signing you in, syncing your lists, sending account emails (verification and password reset) and preventing abuse; and to understand how Dilectus is used so we can improve it. The site owner can see accounts, their saved lists and battles, and usage, in a read-only admin view. We never sell your data or use it for advertising. Our legal basis is providing the service you asked for, and our legitimate interest in keeping it secure.

Who processes it

Vercel (hosting, file storage and analytics), Neon (database), Resend (email), Cloudflare and Google (connecting your devices in live battles), and Google or Discord if you choose to sign in with them. Some are based outside the UK and are covered by standard data protection safeguards.

How long we keep it

Until you delete your account, which you can do at any time from your account page. That deletes your account details, profile picture and saved lists, and unlinks your usage from you: what remains can’t be tied back to you. Usage that was never linked to an account is kept without a time limit.

Your rights

Under UK GDPR you can ask to access, correct, export or delete your data, or object to how we use it. Email us to do so. You can also complain to the ICO.

Children

Dilectus is not intended for children under 13.

Changes

We'll update this page if anything changes.

Contact

hello@dilectus.app · See also our Terms of Service.