Privacy Policy
Who we are
40K Team Forge (40kteamforge.com) is a hobby project operated by Msales Norway AS (org. no. 919 627 433, Kristiansand, Norway), the controller for personal data on the site. Questions about this policy or your data: [email protected], or the Feedback button on the site.
What we store
- The team builder needs no account. Your comps live in your browser (localStorage) and in the share links you create — not in our database.
- Account data (only if you sign up for the team calendar): your email address, and — if you sign in with Discord — your Discord display name and avatar.
- Team data: teams you create or join, member lists, invite links, calendar events and RSVPs.
- Billing: payments are processed by Stripe. We store your team's subscription status and Stripe reference IDs. We never see or store card numbers.
- Technical: the site is served through Cloudflare, which processes IP addresses to run its network. The feedback form uses Cloudflare Turnstile to stop spam. We run no advertising trackers.
- Analytics: Google Analytics 4, described below. Only with your consent.
Our word of honor
We will never look at your team's data. Team comps, events, notes, rosters and RSVPs stored in a team are read by our systems only to show them to your team's members. No human on our side browses them — not out of curiosity, not for analysis, not ever. The only exceptions: you explicitly ask us to look while we help you with a support issue, or the law requires it.
Full disclosure: the person behind this site (Kjetil, mSales Norway) is involved with Team Norway for Warhammer 40,000 WTC purposes. That is exactly why this pledge exists and is absolute: nothing your team stores here will ever be viewed or used for anyone's competitive advantage. Word of honor.
Where your data lives
The database and authentication run on Supabase, hosted in the EU (AWS eu-north-1, Stockholm). Payments run on Stripe. The site and its API are delivered via Cloudflare and DigitalOcean (EU).
Your rights
Under the GDPR you can access, export, correct and delete your data. Team owners can delete their team (which removes its events, invites and memberships); anyone can leave a team at any time. For account deletion or a data export, email [email protected] and we'll sort it out promptly. You can also complain to the Norwegian Data Protection Authority, Datatilsynet.
Analytics (Google Analytics)
We use Google Analytics 4 to see how the site is used, such as which pages are read and where visitors come from. Google cookies are only set if you click "Accept". Our team data pledge above still holds: analytics never sees the contents of your team.
If you click "Decline", or make no choice, no cookies are set. Google still receives basic, anonymous signals without cookies or identifiers (Google Consent Mode), used to estimate overall traffic. Google Analytics does not store IP addresses.
Google Ireland Ltd. is our processor. Data may be transferred to the US under the EU–US Data Privacy Framework. Analytics data is kept for 14 months. The legal basis is your consent (GDPR art. 6(1)(a)), which you can withdraw at any time.
Cookies & local storage
_gaand_ga_*(Google Analytics, 2 years). Only with consent.msale_consent_v1(stored in your browser). Remembers your choice so we don't ask on every page.- Browser storage for your builder state and your sign-in session.
No advertising or cross-site tracking cookies. You can change your choice at any time with Cookie settings, also linked at the bottom of every page.
Changes
If this policy changes in a way that matters, we'll say so on the site. The effective date above always reflects the current version.