Collection Forge

Privacy Policy

Last updated: 31 July 2026

Collection Forge is a private, non-commercial hobby project for tracking Warhammer 40,000 army lists. This page explains what it stores and why. It is intentionally short because the project collects as little as possible.

When an account is created

Simply browsing the site does not create an account. An account is only created the moment you first create something (for example your first army). At that point you receive a recovery phrase — twelve words that are the only way to sign in on another device.

What is stored

• A username (auto-generated, changeable by you) and its public profile slug.
• The armies, units, notes and images you create.
• Friend connections you make.
• A per-device session token, stored only as a cryptographic hash, plus your browser's user-agent string. Your recovery phrase is likewise stored only as a hash and can never be read back.

Cookies

A single first-party cookie, cf_account, keeps you signed in on your device. It is HttpOnly, Secure and SameSite=Lax. No other cookies are set.

Visibility of your data

Armies you mark as public are visible to everyone; unlisted and private armies are not. Your username and public armies appear on your public profile.

Hosting

The site runs on a private server in Germany. Data is not sold or shared with third parties.

Deleting your data

You can ask for your account and everything in it to be permanently deleted, and the site administrator can remove accounts and content. Because sign-in relies solely on your recovery phrase, keep it safe — if you lose it, your data cannot be recovered.

Contact

Questions about this policy: noah@thiering.org.