Legal
Privacy Policy
Effective date: July 5, 2026. This Policy describes how AlbionZVZ ("we", "us") collects, uses, and shares personal data when you use our website and services (the "Service").
Who is responsible
The Service is operated by Viktor and the AlbionZVZ project. See About AlbionZVZ for background. Contact us at support@albionzvz.com or via Contact us. If you need a legal entity name or postal address for data-protection requests, ask through that channel and we will provide it where required.
Data we collect
Depending on how you use the Service, we may process:
- Account data — When you sign in (for example with Discord), we receive and store identifiers and profile details allowed by that provider (such as user id, username, avatar).
- Guild and gameplay-organizing data — Information you or your guild adds: memberships, events, signups, compositions, builds, weapon mastery progression, and similar operational data.
- Guest event participation — If you sign up for a public event without an account, we store a display name you provide and a token cookie so we can recognize your signup on return visits.
- Albion Online public data — Character, guild, battle, and market information we fetch from public game APIs when you or your officers link accounts, verify rosters, or use related features (for example battle boards or market estimates).
- User-uploaded images — When officers use optional AI-assisted objective import, a screenshot you upload is sent to our vision provider to suggest form fields; we do not use it to train models. Custom build-sheet backgrounds you choose in the browser stay on your device and are not uploaded to our servers.
- Guild clips and embeds — URLs you save to your guild library; viewing a clip may load a third-party player (for example YouTube, Twitch, or Medal) under that provider's terms.
- Public blog — Our blog posts show an author name; reading posts does not require an account.
- Technical and usage data — Logs and metadata needed to run the site securely: IP address, approximate location from IP, device and browser type, timestamps, and diagnostic information when something fails. When configured, our self-hosted analytics (Rybbit) also receives cookieless page views, performance metrics (Web Vitals), and aggregated product events (for example that a signup or guild action occurred, with counts or guild slugs — not message content, emails, or Discord display names). When configured, Google Analytics (GA4) may also receive page views and engagement metrics subject to your consent choices (see cookies below).
- Cookies and similar technologies — See Cookies and similar technologies below.
Why we use data
- To provide, secure, and improve the Service.
- To authenticate you and enforce guild and event permissions.
- To communicate about the Service (for example support responses).
- To comply with law and respond to lawful requests.
- To measure traffic, performance, and product usage via our self-hosted Rybbit instance when enabled (see processors below).
- To measure audience and ad performance via Google Analytics (GA4) and Mediavine Grow when you consent to optional cookies (see processors below).
- To fund the Service through display advertising (Google AdSense) on public pages, subject to your consent where required.
Legal bases (EEA, UK, and similar)
Where GDPR-style laws apply, we rely on:
- Performance of a contract — Providing the Service you asked for.
- Legitimate interests — Security, abuse prevention, improving the product, and cookieless analytics via our self-hosted Rybbit instance (traffic, performance, aggregated usage — see processors below), balanced against your rights.
- Consent — Where required, for Google Analytics, Google AdSense, Mediavine Grow, and other optional cookies when you make a choice in our consent interface (Google Privacy & messaging / IAB TCF v2.3).
- Legal obligation — When the law requires retention or disclosure.
Display advertising
We may show third-party display ads on public pages (blog, docs, marketing pages, and some logged-in surfaces) through Google AdSense. Google and its partners may use cookies or similar technologies to serve ads based on your visits to this and other sites, and to measure ad performance. You can learn how Google uses data at Google's partner sites policy and opt out of personalized advertising via Google Ads Settings. In the EEA, UK, and Switzerland we use Google's certified consent management platform (IAB Transparency & Consent Framework v2.3) before serving personalized ads. Guild workspaces on the Crystal supporter tier do not show in-app display ads.
Cookies and similar technologies
Strictly necessary cookies are used to run the Service (for example keeping you signed in or remembering a guest signup). They do not require consent, but we list them here for transparency. When Google's certified CMP is not yet enabled, we show our own cookie banner for Google Analytics (GA4) only — choose Necessary only or Accept analytics. You may still have the AdSense client id on the site for verification during this phase. After we enable Google's certified Privacy & messaging platform (IAB TCF v2.3), that banner replaces ours for analytics and ads together. In the EEA, UK, and Switzerland you will see a consent message before optional cookies are set; elsewhere optional cookies may be enabled by default until you change your choice. Our self-hosted Rybbit analytics are cookieless and are not controlled by these choices. Reopen preferences via Cookie settings in the site footer when GA4, Google ad services, or Grow are enabled.
| Name / prefix | Purpose | Essential? | Typical duration |
|---|---|---|---|
sb-*-auth-token (and chunk suffixes) | Login session (Supabase Auth) | Yes | Session / refresh lifetime |
sb-*-auth-token-code-verifier | OAuth PKCE during Discord sign-in | Yes | Short-lived (sign-in flow) |
albionzvz_guest_token, albionzvz_guest_name | Remember guest identity on public event signups | Yes (feature) | Up to about 12 months |
albionzvz_party_player_token | Item Guesser Party session | Yes (feature) | Up to about 4 hours |
consent_jurisdiction | Remember whether your region uses opt-in or opt-out defaults for optional cookies | Yes (preference storage) | Session / about 12 months |
analytics_cookie_consent (localStorage) | Remember your GA4 analytics choice (interim banner before Google AdSense CMP) | Yes (preference storage) | Until you clear site data (we suggest ~12 months) |
| Google AdSense / GA4 cookies (when you consent) | Display advertising, ad measurement, and analytics (Consent Mode v2) | No — optional; only with consent where required | Per Google documentation |
| Mediavine Grow cookies (when you consent) | First-party audience measurement for Journey eligibility (when configured) | No — optional; only with consent where required | Per Mediavine Grow documentation |
Processors and sharing
We use service providers that process data on our instructions and under contractual safeguards, including:
- Supabase — authentication and database hosting.
- Application hosting — self-hosted on a Hetzner VPS (Docker / reverse proxy); database and auth remain on Supabase.
- Rybbit — self-hosted, cookieless page analytics, Web Vitals, and aggregated product usage events (when configured).
- Google (AdSense, Analytics, Privacy & messaging) — display advertising on public pages, optional GA4 analytics, and consent management when configured.
- Mediavine Grow — first-party audience measurement for Journey eligibility when you consent to optional cookies (when configured).
- Google (Gemini API) — when configured, processes uploaded images for optional objective screenshot import to extract form fields; we send each image for that request only.
- Discord — when you sign in with Discord; also subject to Discord's privacy policy.
We do not sell your personal data. We may share data if required by law or to protect rights, safety, and integrity of users and the Service.
Retention
We keep data as long as your account or guild needs it for the Service, and afterward only as long as necessary for legal, security, or backup purposes. Plan-based retention (for example event history) may delete older records automatically.
Your rights
Depending on where you live, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You may also lodge a complaint with a data protection authority.
How to exercise your rights: contact us at support@albionzvz.com or via Contact us with enough detail to find your account (for example the email on your account or your Discord username). We aim to respond within about 30 days where GDPR-style laws apply. Use Cookie settings in the footer to change optional cookie choices when Google ad services or Grow are enabled. To object to or restrict Rybbit processing where your law provides that right, contact us at support@albionzvz.com or via Contact us. To opt out of personalized Google ads, visit Google Ads Settings.
International transfers
Our providers may process data in countries other than your own. We use appropriate safeguards (such as standard contractual clauses) where required.
Children
The Service is not directed at children under 16. We do not knowingly collect personal data from children.
Changes to this Policy
We may update this Policy and will post the new version here with an updated effective date.