Privacy Policy

Last updated 29 September 2026

Dilectus (dilectus.app) is run by Adam Probert in the UK, who is the data controller. We collect as little as we can.

What we collect

• Account details — your email address, display name and, if you use email sign-in, a hashed password. If you sign in with Google or Discord we receive your name, email address and profile picture from them.
• Profile picture — optional. If you upload one, your browser crops and shrinks it first; we keep only that small square, on Vercel's storage, until you remove it or delete your account.
• Your army lists — saved in your browser, and on our servers if you sign in so they sync between devices.
• Live lists and battles — while a list or battle is open, our servers note that a device of yours has it open (a random id for the browser tab, not the device itself), so that it can go live if another of your devices opens it too; the note goes when the page closes, or stops counting after 15 minutes and is deleted soon after. When a list or battle is open on more than one of your signed-in devices, they connect to each other directly, so each learns the other’s IP address. The short messages that introduce them pass through our servers and are deleted within minutes. To find a route between them, your browser asks a public server run by Cloudflare or Google for its own IP address, and devices that can’t connect directly relay through Cloudflare.
• Battles against another player — when you invite someone with a code, or join their battle, your opponent sees your display name and profile picture (never your email), the list you play and your battle as it goes, and you see theirs. Your devices connect to theirs directly in the same way, so each of you learns the other’s IP address unless the connection is relayed. The match, its round and victory points are kept on our servers with your account; codes that find nothing are counted for a day to stop guessing.
• Sessions — a sign-in cookie, plus the IP address and browser type of each session, for security.
• Bug reports — what you write in Report a bug is posted publicly on the project’s GitHub page, without your name or email. To limit abuse we keep a scrambled form of your IP address, which can’t be turned back into the address, for a day.
• Usage — anonymous, cookie-free page view statistics via Vercel Analytics.
• Performance — anonymous, cookie-free page speed measurements (how long pages take to load and respond) via Vercel Speed Insights.

How we use it

Only to run the service: signing you in, syncing your lists, sending account emails (verification and password reset) and preventing abuse. We never sell your data or use it for advertising. Our legal basis is providing the service you asked for, and our legitimate interest in keeping it secure.

Who processes it

Vercel (hosting, file storage and analytics), Neon (database), Resend (email), Cloudflare and Google (connecting your devices in live battles), and Google or Discord if you choose to sign in with them. Some are based outside the UK and are covered by standard data protection safeguards.

How long we keep it

Until you delete your account, which you can do at any time from your account page. That deletes your account details, profile picture and saved lists.

Your rights

Under UK GDPR you can ask to access, correct, export or delete your data, or object to how we use it. Email us to do so. You can also complain to the ICO.

Children

Dilectus is not intended for children under 13.

Changes

We'll update this page if anything changes.

Contact

hello@dilectus.app · See also our Terms of Service.