Privacy Policy

ClashRecord is a free, fan-made Clash of Clans tracker run by two people. We never ask for your real name, email address or phone number. If you create an account, the only things tied to you are a username you choose (it doesn't have to be your real name), a scrambled copy of your password, the villages you save with their game data, and anything you send us or share yourself, like feedback or base layouts. Your IP address is used briefly to keep the site safe and is never stored. There are no ads, no tracking across other sites or apps, and we never sell your data or share it beyond the services that run the site, listed below. You can delete any of it, or your whole account, yourself at any time.

ClashRecord is run by Emirhan Gani and Hamza Şimşek, Turkey, who are jointly responsible (the "data controller") for the personal data described here. Reach us at clashrecorddev@gmail.com or through the feedback form on your account page.

You can browse players, clans, and wars without signing up. The player and clan tags you search are sent to the official Clash of Clans API to fetch public game data; we don't link them to you.

Your IP address is used transiently in memory to rate-limit requests and prevent abuse. It is not written to a database or used to profile you.

We store:

• Your username and a hashed version of your password (bcrypt). We never store your password in plain text, and we don't ask for an email address.
• The villages you save: player tags, optional nicknames, and which one is primary.
• Progress snapshots of your saved villages - public game data (levels, trophies, war stars) fetched from the official API so you can see changes over time.
• Building and upgrade levels you enter manually or import, since the official API doesn't expose them.
• Feedback you submit through the feedback form, and our replies to it. A reply is shown only to the account that sent the message.
• Base layouts you share: the screenshot, in-game link, Town Hall level and tags. These become public once we've reviewed and approved them. Ratings on them are stored under a one-way hash of your account, never your username. If you report a base, the reason is stored under the same kind of one-way hash.
• Activity tied to your account: the days you used the site while signed in and the contribution standing worked out from them.

The in-game village export you paste is parsed in your browser. Only the resulting building and upgrade levels are saved to your account (and only for villages you've saved) - the raw JSON file itself is never uploaded or stored on our servers. If you import without signing in, those levels stay in your browser's local storage and are sent nowhere; they reach our servers only if you later sign in and choose to merge them into a saved village, and you can discard them instead.

We set two cookies, both strictly necessary: the session cookie that keeps you signed in, and a signed pass cookie, valid for 30 days, that records you've completed the anti-bot check. There are no advertising or tracking cookies.

Preferences like your theme, tracker settings, and Gold Pass selection are kept in your browser's local storage and stay on your device.

Because we don't track anyone across other sites, we treat every visitor the same way whether or not their browser sends a "Do Not Track" signal.

• Supercell's Clash of Clans API - receives the player and clan tags you look up, and returns public game data. Game content is owned by Supercell; see their Fan Content Policy.
• Railway - hosts the site and its database in the United States, so account data is processed and stored on their infrastructure there.
• Cloudflare Turnstile - the anti-bot check shown on your first visit. Cloudflare receives your IP address and browser details to decide whether the request comes from a person, and we pass it your IP address when verifying the result. See Cloudflare's privacy policy.
• Supercell's image server (api-assets.clashofclans.com) - clan badges and league icons are loaded directly from Supercell, so your browser sends your IP address to that server when it displays them.
• Cloudflare Web Analytics - counts page views, referring sites and visitor countries so we can see how people find ClashRecord. It sets no cookies and doesn't track you across sites; your browser sends the page address and browser details to Cloudflare. See Cloudflare's privacy policy.

We don't share or sell your data to anyone else.

Under the GDPR and Turkey's personal data law (KVKK), we rely on:

• Providing the service you asked for (contract) - your account, saved villages, building levels, feedback and the bases you share.
• Our legitimate interest in keeping the site safe and working - rate limiting, the anti-bot check, and keeping view, download and rating counts honest.
• Our legitimate interest in understanding how the site is used - counting page views without cookies or cross-site tracking.

• Your account and everything saved under it: until you delete it, or the village or account it belongs to.
• Base layouts you share: until you or we remove them.
• Feedback sent while signed out isn't linked to anyone and is kept while it's useful for the issue it reports.
• IP addresses: only in memory, for minutes to hours, for rate limiting and fair counting. Never written to our database.
• The session cookie lasts up to 30 days; the anti-bot pass cookie 30 days.

You can remove any saved village from your account page at any time - this also deletes its progress snapshots and saved building levels. You can also delete your entire account yourself from the account page. That permanently removes the account, your saved villages, their snapshots and levels, your activity history, your contribution standing and the feedback messages you sent. Base layouts you shared publicly stay published without your name, because others have rated and copied them; delete them from the base's popup first if you want them gone too.

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Much of this you can do yourself on your account page; for anything else, email clashrecorddev@gmail.com and we'll answer within one month.

If you think we've handled your data wrongly, you can complain to the data protection authority where you live, or in Turkey to the Personal Data Protection Authority (KVKK).

Our hosting (Railway) and Cloudflare's services run in the United States, so your data is transferred outside Turkey and the EU. We rely on these providers' data protection terms, including the EU Standard Contractual Clauses where they apply, to protect it.

The site is served over HTTPS, passwords are hashed with bcrypt, and sign-in attempts are rate-limited. No system is perfectly secure, but we keep the amount of data we hold deliberately small.

ClashRecord accounts are for people aged 13 and over, and we don't knowingly collect personal information from children under 13. An account only requires a username, which doesn't need to identify you. If you believe a child under 13 has created an account, delete it from its account page or tell us through the feedback form and we'll remove it along with all associated data.

If this policy changes, we'll update this page and the date at the top. Significant changes will also be noted in the change history.

Questions about this policy? Reach us through the feedback form on your account page, or email clashrecorddev@gmail.com.