Privacy Policy

SWGOH Teams is a fan-made reference tool run by one person in the United States. It is not affiliated with EA, Capital Games, Disney, or Lucasfilm, and it is not a company. The fastest way to reach the operator about anything in this policy is the contact form.

No tracking or advertising cookies are set, by this site or by anyone else. Two values are kept in your browser's local storage, and neither is sent anywhere on its own:

• swgoh-teams:lastAllyCode — the ally code you last looked up successfully, so you do not have to retype it on every page. Saved only after a lookup works.
• swgoh-teams:theme — whether you chose light, dark, or system.

If you sign in, a session cookie is added. It is what keeps you signed in between pages, it is marked HttpOnly so no script on the page can read it, and signing out deletes it. Signed-out visitors never receive one.

All three exist only to do the thing you asked this site to do, so there is no consent banner: there is nothing here to consent to. Clearing this site's data in your browser removes them immediately.

• Cached rosters. When an ally code is entered, this site asks swgoh.gg's API for that player's public profile and stores the result: ally code, player name, galactic power, account level, and each unit's stars, gear, relic level, and power. It is refreshed if it is more than 24 hours old, and deleted entirely 30 days after its last refresh. This cache is not publicly readable — only this site's own server can read it.
• Rate-limit records. To stop one visitor from overwhelming swgoh.gg, the site counts recent lookups per visitor. It identifies the visitor by a salted SHA-256 hash of the IP address — the address itself is never written down — and the record is deleted within a day. Sign-in emails are counted the same way and for the same reason, so that one address cannot be flooded with codes; the email address is hashed exactly as an IP is, and is not stored.
• Contact-form messages. Whatever you type: your message, plus your name and email address if you choose to give them. No IP address, browser fingerprint, or anything else is attached. Deleted after 180 days.
• Your account, if you make one. An account stores an account id, the email address the sign-in went through, the ally code you save against it, and the display name you choose — and nothing else. No password is ever created here, so there is none to be stolen from this site. A display name is always one you type: none is taken from your Discord name or from your email address. If the name you type is already in use, a four-digit number is stored with it to tell the two of you apart, and it is shown wherever your name is. Unlike everything above, an account is kept until you delete it, which you can do yourself on your profile page at any time.
• Teams you build, if you build any. A team is a name, some notes, and the units and targets you picked, inside a list you name. All of it is private to your account, and readable by nobody else, until you turn on a team's Share switch — and the list's own name stays private even then, unless you separately switch that list on as a heading for your author page. See below for what sharing publishes. Kept until you delete the team, the list, or the account.
• Your author page, if you open one. A short description you write, and a handle for each site you chose from a fixed list: YouTube, Twitch, Discord invite, X, TikTok, Instagram, Bluesky, Reddit, Patreon, swgoh.gg. Both are public the moment the page is on, and both are optional — a page can be nothing but your name and your shared teams. You never give a web address: you give a handle, and the link is built from it. Kept until you remove them or delete the account.
• Likes. Which shared teams you have liked, so the button knows and so a team cannot be liked twice by one member. Who liked what is readable only by you — not by the public, and not by the team's author, who sees a count and no names. Removed when you unlike, and when the account goes.
• A supporter tier, if you are given one. Which tier your account has, when it runs out if it does, and a short note saying why it was granted — nothing more. It is set by hand by the site's operator and is private to your account: it appears on your profile page and nowhere public, so nothing on this site shows other visitors whether you pay for it. No payment details of any kind reach this site. Kept until the tier is removed or the account is deleted.

Deletion of the first three is automatic, run by a scheduled job in the database rather than by hand.

Sharing is off until you turn it on, one team at a time, and it cannot be turned on at all until you have chosen a display name. What becomes public is the team's name and notes, the units and targets in it, and that display name. Anyone can see it, signed in or not.

An author page is a second, separate switch, and it is off until you turn it on too. You can share teams for years and never have one. Turning it on publishes the description and links described above at an address made from your display name and its tag, and gathers the teams you have already shared there — it does not publish a single team that was not already public, and it is not a way to publish one. Each of your lists then has a switch of its own, also off by default, deciding whether that list’s name appears as a heading on the page. Nothing else about a list is ever published, and the teams under a heading are exactly the ones you had already shared. Turning it off takes the page down straight away, and so does clearing your display name, because the address is made from that name.

What stays private is the rest: your ally code, your email address, your Discord name, and every team you did not share. A list name is private too, and stays private unless you switch that particular list on as a heading — so a list called something you would rather nobody read stays yours even when a team inside it is public, which is exactly why that switch is per list rather than one for all of them.

One technical detail, stated rather than buried. A shared team carries the random identifier your account is keyed by, because grouping an author's teams under one byline is the point of having a byline — and, if you have opened a page, that grouping is literally a page, which is the whole of what the identifier does here. It is an opaque string that unlocks nothing on its own and reveals nothing about you; every row it touches is guarded by the database, not by the identifier being secret. Nothing published anywhere shows it.

Turning the switch off withdraws the team immediately, as does deleting it or deleting your account. What someone has already read or copied is outside the reach of any switch, here or anywhere.

These services, and no advertisers, analytics vendors, or data brokers of any kind:

• Vercel hosts the site. Like every web host, its servers log requests — including IP addresses — under its own policy and retention, which this site does not control.
• Supabase provides the database holding everything described above.
• swgoh.gg is where roster data comes from. Entering an ally code sends that code to them.
• Resend delivers email: the notification for a contact-form message, and the sign-in code, if you sign in that way. Delivering a message means handling the address it is going to.
• Discord handles signing in, and only if you choose to make an account. It tells this site an account id and an email address; this site tells it nothing about you. Signing in with an emailed code involves neither: the address is yours to give, the code goes to it, and no other account anywhere is touched.

Not on that list: any AI service. This site was built with the help of an AI assistant, which the terms say plainly — but that help was in writing the code, before any of it was deployed. Nothing you type, look up, or publish is sent to an AI service, none is involved in serving a page, and none has access to anything described on this page.

Data is stored and processed in the United States — the database is in Oregon. If you are in the EEA or the UK, that means what this site holds about you is transferred to the United States, which is worth knowing even though the retention is short and the content is already public on swgoh.gg.

Where the GDPR or UK GDPR applies, the lawful basis for caching rosters and for the rate-limit records is legitimate interests (Article 6(1)(f)): running a working, publicly useful tool without hammering someone else's API. The data cached is already public on swgoh.gg, the retention is short, and no profiling or automated decision-making is done with it. For a contact-form message, the basis is your own request to be answered.

For an account, the teams in it, and anything you choose to publish, the basis is the performance of what you asked for (Article 6(1)(b)): none of it exists unless you make an account, and nothing is published unless you turn a switch on. The rate-limit records that bound sign-in emails are legitimate interests again — an address that can be flooded with codes by anyone who types it is a problem for whoever owns that address.

Anyone can enter any ally code — this site has no way to tell whose it is. What comes back is the same public profile anyone can see on swgoh.gg. If a cached roster is yours and you would rather it were not here, say so through the contact form and it will be deleted; include the ally code so the right one is found.

Wherever you live, you can ask for a copy of what is held about you, ask for it corrected, or ask for it deleted — and, in the EEA and UK, restrict or object to processing, receive your data in a portable form, and complain to your national data-protection authority. California residents have equivalent rights to know, delete, and correct.

Personal information is never sold or shared — including for cross-context behavioural advertising, which this site does not do in any form.

If you have an account, deletion is self-service: the button on your profile page removes the account, the ally code saved to it, your display name, your author page with its description and links, every list and team in it — shared ones included — and your likes, immediately, with nothing to wait for. To withdraw a published team without losing the account, turn its Share switch off.

For anything else, use the contact form. Without an account the ally code is usually the only way to find your data, so please include it. Most requests are answered well inside 30 days.

This site is not directed at children under 13 and asks for nothing about anyone's age or identity. If a child has made an account or sent something through the contact form, use the contact form and it will be deleted.

Everything is served over HTTPS. The database tables holding personal data — cached rosters, rate-limit records, contact messages, accounts, teams, and likes — are unreadable by the public key that this site's pages use. No account can read another account's row, and that is enforced by the database rather than by the application remembering to ask correctly.

Shared teams are the one deliberate exception, and it is a narrow one: the database allows the public to read a team only while its Share switch is on, and the units under it only through that team. Your lists, your unshared teams, and your profile stay closed by the same rules that were already refusing everyone else.

The operator can see a message you send through the contact form, which is the point of sending one, and can see anything you have published — the team, its notes, and the display name on it — because a complaint about something public cannot be acted on without reading it. That page can withdraw a team, clear a display name, or take down an author page and the description and links on it, and nothing else; it shows no ally code, no email address, and nothing about a team you did not share. Taking a page down leaves the teams that were on it shared, since those are a separate decision. Each such action is written to an audit log, so a moderation decision has a record and a date.

Beyond those two things the operator sees only counts — how many accounts exist, how many have saved an ally code — on an internal page that names no individual account.

If this policy changes, the date at the top changes with it. Anything that materially affects what is collected will be called out on the site rather than slipped in quietly.