Privacy Policy

SWGOH Teams is a fan-made reference tool run by one person in the United States. It is not affiliated with EA, Capital Games, Disney, or Lucasfilm, and it is not a company. The fastest way to reach the operator about anything in this policy is the contact form.

No tracking or advertising cookies are set, by this site or by anyone else. Two values are kept in your browser's local storage, and neither is sent anywhere on its own:

• swgoh-teams:lastAllyCode — the ally code you last looked up successfully, so you do not have to retype it on every page. Saved only after a lookup works.
• swgoh-teams:theme — whether you chose light, dark, or system.

If you sign in, a session cookie is added. It is what keeps you signed in between pages, it is marked HttpOnly so no script on the page can read it, and signing out deletes it. Signed-out visitors never receive one.

All three exist only to do the thing you asked this site to do, so there is no consent banner: there is nothing here to consent to. Clearing this site's data in your browser removes them immediately.

• Cached rosters. When an ally code is entered, this site asks swgoh.gg's API for that player's public profile and stores the result: ally code, player name, galactic power, account level, and each unit's stars, gear, relic level, and power. It is refreshed if it is more than 24 hours old, and deleted entirely 30 days after its last refresh. This cache is not publicly readable — only this site's own server can read it.
• Rate-limit records. To stop one visitor from overwhelming swgoh.gg, the site counts recent lookups per visitor. It identifies the visitor by a salted SHA-256 hash of the IP address — the address itself is never written down — and the record is deleted within a day. Sign-in emails are counted the same way and for the same reason, so that one address cannot be flooded with codes; the email address is hashed exactly as an IP is, and is not stored.
• Contact-form messages. Whatever you type: your message, plus your name and email address if you choose to give them. No IP address, browser fingerprint, or anything else is attached. Deleted after 180 days.
• Your account, if you make one. An account stores an account id, the email address the sign-in went through, the ally code you save against it, and the display name you choose — and nothing else. No password is ever created here, so there is none to be stolen from this site. A display name is always one you type: none is taken from your Discord name or from your email address. If the name you type is already in use, a four-digit number is stored with it to tell the two of you apart, and it is shown wherever your name is. Unlike everything above, an account is kept until you delete it, which you can do yourself on your profile page at any time.
• Teams you build, if you build any. A team is a name, some notes, and the units and targets you picked, inside a list you name. All of it is private to your account, and readable by nobody else, until you turn on a team's Share switch — and the list's own name stays private even then, unless you separately switch that list on as a heading for your author page. See below for what sharing publishes. Kept until you delete the team, the list, or the account.
• Your author page, if you open one. A short description you write, and a handle for each site you chose from a fixed list: YouTube, Twitch, Discord invite, X, TikTok, Instagram, Bluesky, Reddit, Patreon, swgoh.gg. Both are public the moment the page is on, and both are optional — a page can be nothing but your name and your shared teams. You never give a web address: you give a handle, and the link is built from it. Kept until you remove them or delete the account.
• Likes. Which shared teams you have liked, so the button knows and so a team cannot be liked twice by one member. Who liked what is readable only by you — not by the public, and not by the team's author, who sees a count and no names. Removed when you unlike, and when the account goes.
• A supporter tier, if you are given one. Which tier your account has, when it runs out if it does, and a short note saying why it was granted — nothing more. It is set by hand by the site's operator and is private to your account: it appears on your profile page and nowhere public, so nothing on this site shows other visitors whether you pay for it. No payment details of any kind reach this site. Kept until the tier is removed or the account is deleted, though the record that it was set, note included, stays in the audit log described under Security.

Deletion of the first three is automatic, run by a scheduled job in the database rather than by hand.

Sharing is off until you turn it on, one team at a time, and it cannot be turned on at all until you have chosen a display name. What becomes public is the team's name and notes, the units and targets in it, and that display name. Anyone can see it, signed in or not.

An author page is a second, separate switch, and it is off until you turn it on too. You can share teams for years and never have one. Turning it on publishes the description and links described above at an address made from your display name and its tag, and gathers the teams you have already shared there — it does not publish a single team that was not already public, and it is not a way to publish one. Each of your lists then has a switch of its own, also off by default, deciding whether that list’s name appears as a heading on the page. Nothing else about a list is ever published, and the teams under a heading are exactly the ones you had already shared. Turning it off takes the page down straight away, and so does clearing your display name, because the address is made from that name.

What stays private is the rest: your ally code, your email address, your Discord name, and every team you did not share. A list name is private too, and stays private unless you switch that particular list on as a heading — so a list called something you would rather nobody read stays yours even when a team inside it is public, which is exactly why that switch is per list rather than one for all of them.

One technical detail, stated rather than buried. A shared team carries the random identifier your account is keyed by, because grouping an author's teams under one byline is the point of having a byline — and, if you have opened a page, that grouping is literally a page, which is the whole of what the identifier does here. It is an opaque string that unlocks nothing on its own and reveals nothing about you; every row it touches is guarded by the database, not by the identifier being secret. Nothing published anywhere shows it.

Turning the switch off withdraws the team immediately, as does deleting it or deleting your account. What someone has already read or copied is outside the reach of any switch, here or anywhere.

These services, and no advertisers, analytics vendors, or data brokers of any kind:

• Vercel hosts the site. Like every web host, its servers log requests — including IP addresses — under its own policy and retention, which this site does not control.
• Supabase provides the database holding everything described above.
• swgoh.gg is where roster data comes from. Entering an ally code sends that code to them.
• Resend delivers email: the notification for a contact-form message, and the sign-in code, if you sign in that way. Delivering a message means handling the address it is going to.
• Discord handles signing in, and only if you choose to make an account. It tells this site an account id and an email address; this site tells it nothing about you. Signing in with an emailed code involves neither: the address is yours to give, the code goes to it, and no other account anywhere is touched.

Not on that list: any AI service. This site was built with the help of an AI assistant, which the terms say plainly — but that help was in writing the code, before any of it was deployed. Nothing you type, look up, or publish is sent to an AI service, none is involved in serving a page, and none has access to anything described on this page.

Data is stored and processed in the United States — the database is in Oregon. If you are in the EEA or the UK, that means what this site holds about you is transferred to the United States, which is worth knowing even though the retention is short and the content is already public on swgoh.gg.

Where the GDPR or UK GDPR applies, the lawful basis for caching rosters and for the rate-limit records is legitimate interests (Article 6(1)(f)): running a working, publicly useful tool without hammering someone else's API. The data cached is already public on swgoh.gg, the retention is short, and no profiling or automated decision-making is done with it. For a contact-form message, the basis is your own request to be answered.

For an account, the teams in it, and anything you choose to publish, the basis is the performance of what you asked for (Article 6(1)(b)): none of it exists unless you make an account, and nothing is published unless you turn a switch on. The rate-limit records that bound sign-in emails are legitimate interests again — an address that can be flooded with codes by anyone who types it is a problem for whoever owns that address.

The admin audit log, which is kept after an account is deleted, rests on legitimate interests as well: a record of what was done to an account, and when, is how a moderation or supporter-tier decision can be checked or explained later. It holds identifiers, dates and short reasons, and nothing you wrote.

Anyone can enter any ally code — this site has no way to tell whose it is. What comes back is the same public profile anyone can see on swgoh.gg. If a cached roster is yours and you would rather it were not here, say so through the contact form and it will be deleted; include the ally code so the right one is found.

Wherever you live, you can ask for a copy of what is held about you, ask for it corrected, or ask for it deleted — and, in the EEA and UK, restrict or object to processing, receive your data in a portable form, and complain to your national data-protection authority. California residents have equivalent rights to know, delete, and correct.

Personal information is never sold or shared — including for cross-context behavioural advertising, which this site does not do in any form.

If you have an account, deletion is self-service: the button on your profile page removes the account, the ally code saved to it, your display name, your author page with its description and links, every page, list and team in it — shared ones included — your likes, and any supporter tier, immediately, with nothing to wait for. The one exception is the audit log described under Security, which keeps its records of actions taken on an account after the account is gone. To withdraw a published team without losing the account, turn its Share switch off.

For anything else, use the contact form. Without an account the ally code is usually the only way to find your data, so please include it. Most requests are answered well inside 30 days.

This site is not directed at children under 13, and accounts are only for people 13 or older, as the terms say. It asks for nothing about anyone's age or identity, so it cannot check. If a child under 13 has made an account or sent something through the contact form, use the contact form and it will be deleted.

Everything is served over HTTPS. The database tables holding personal data — cached rosters, rate-limit records, contact messages, accounts, pages, lists, teams, likes, author page links, and supporter tiers — are unreadable by the public key that this site's pages use. No account can read another account's row, and that is enforced by the database rather than by the application remembering to ask correctly.

Shared teams and author pages are the deliberate exceptions, and narrow ones: a team is public only while its Share switch is on, with the units under it readable only through that team, and an author page only while you have it switched on. Your pages, your lists, your unshared teams, your supporter tier and the rest of your profile stay closed by the same rules that refuse everyone else.

The operator has an admin area, and what it shows is limited on purpose. It holds messages sent through the contact form, which is the point of sending one. It shows anything you have published — the team, its notes, and the display name on it — because a complaint about something public cannot be acted on without reading it. And it can look up a single account by display name or ally code, which shows that account's display name, ally code, whether its author page is on, and its supporter tier. It never shows an email address, the account you signed in with, or anything about a team you did not share.

From there the operator can withdraw a shared team, clear a display name, take down an author page and the description and links on it, or set a supporter tier, and nothing else. Taking a page down leaves the teams that were on it shared, since those are a separate decision. Each of these actions is written to an audit log with a date, and those records are kept after the account they concern is deleted: a record that vanished along with its subject would not be one. The log holds identifiers, not names, and the note kept with a supporter tier is a short reason or a reference number, never a name or a contact detail.

Beyond that, the admin area shows only counts, such as how many accounts exist and how many have saved an ally code.

If this policy changes, the date at the top changes with it. Anything that materially affects what is collected will be called out on the site rather than slipped in quietly.