Sahul

Privacy policy

Last updated 13 September 2026

Sahul is a free, non-commercial community project run by John Cook in Australia. It is not a company, it does not sell anything, and it has no advertising. This page describes exactly what it stores about you, where, and for how long — written from the database schema rather than from a template, so it should match the software rather than describe a generic website.

The short version

  • • You can browse the game library, its catalogues and knowledge bases, and every club and event page without an account, and we store nothing about you if you do.
  • • If you make an account, we store your email address and which sign-in methods you use, and then what you choose to do here: the clubs you join, the events you go to, the games you log and the photos you upload. Each is described below.
  • • Your collection and army lists are stored in your browser. Once your account has two sign-in methods, your collection is also kept on our server, so it follows you between devices. Army lists never leave your browser.
  • • A logged game is the exception, because it is shared with the people you played: it lives on our server, private to them, and to nobody else unless a player shares it.
  • • Photos you upload live on our server too, as web-sized copies. A photo still carrying location or camera details is refused at the door; the date it was taken is kept when the file offers one, and nothing else from its metadata.
  • • Profile and cover photos are public. A player's show on their public profile once it is published; a club's show on its page and in the club directory, to everyone.
  • • We never store your IP address. It is hashed with a secret salt and truncated before it touches the database.
  • • There are no passwords to leak, because there is no password field anywhere in the app.
  • • Nothing is sold, rented, or shared with advertisers. There are no third-party cookies and no advertising.
  • • We do count page views, with a cookieless tool that cannot identify you or follow you to other sites. What it collects, and why, is spelled out below.

What we store if you create an account

All of this lives in a single Cloudflare D1 database, apart from the image files of photos you upload, which are on Cloudflare R2. None of it is shared with anyone outside Sahul; who inside Sahul can see each part is said beside it.

  • • Your email address, lowercased, and whether it has been verified. This is the account's identity and how you recover it. We also keep when the account was made and when you last signed in.
  • • Your real name and an avatar, if Discord or Google supplied them when you signed in, or the real name you type in Settings. Your real name is shown only to the organisers of events you join — on their roster, at their check-in desk and in the results they download — and to the site's operators. It is never on a public page and never shown to other players.
  • • The name you are known by, if you give one: up to 40 characters, such as a gamer tag, and not unique. It is what other players and everyone else see: on event pages, round lists, the board, standings, game records, clubs and their notices, event updates, galleries and your public profile. Leave it blank and your handle shows there instead. Shared records — a game's seats, an event's roster, a disputed table — name your account from the account itself each time they are shown, so they follow your names as they are now and never show your real name to other players.
  • • Which sign-in methods you have linked — for each one, the provider's own account id and a label such as your Discord handle. We never receive or store your password for those services.
  • • Your sessions: a one-way hash of each session token, a shortened browser/OS string, a hashed IP, and when the session was created and last used. The hash means a copy of our database is a record of sessions that existed, not a set of working keys.
  • • Recovery codes, if you generate them — stored only as one-way hashes, which is why we cannot show them to you again. We also keep when each set was made and when a code was used, so you can see it in your inbox.
  • • Pending sign-in links: your address, a hash of the link's token, and — if you were sent to sign in from a particular page — the path of that page, so the link can bring you back to it. Deleted or expired within 15 minutes; the path is only ever a page on this site.
  • • API tokens you create: the name you give each one, what it may do, a one-way hash of the token (the token itself is shown to you once and never stored), when it was made, when it was last used and when it was revoked. A revoked token stays on your list as a record of what once had access, and everything a token does is recorded as done by that token.
  • • Your inbox. Each notification we file for you: what it is about, its words, the page it links to, when it arrived, and whether you have read or archived it. Only you see your inbox. Read notifications are archived after 90 days, apart from security ones, and a notification about something happening now is archived once it is over. Archiving hides a notification; nothing in the inbox is deleted.
  • • Game systems you add to the library: the name, kind and publisher you give it, that your account added it, and whether you did it yourself or with a token. A system is public in the library for everyone, with no name on it, and it is never deleted: it can be retired, or taken down by the site's operators, because games played under it have to keep making sense.
  • • Which game systems you mark as played or followed. Those two flags are stored against your account and shown on your profile, and either can be cleared at any time.
  • • A player ID for a game system, if you save one — for Infinity, your ITS PIN — on that system's page in your collection. We keep the ID, which game system it is for, and when you last changed it. Only you see it there, and it is in your data download; no page shows it to anyone else — not an event's organisers, not other players, and not the site's operators' tools. When you register for an event whose format asks for it, the form starts with it filled in, and what you submit is copied onto your roster row for that event (below): that copy is the one the organisers see. Change or clear the saved ID at any time; that does not change a copy already on a roster. If you stop being able to see the game system, its page stops showing the ID, but it stays in your data download until you ask us to remove it or delete your account.
  • • If you maintain a game system and cut a version of it, we record which version, who cut it and when — the same way a published edition names its date.
  • • If a game system is offered to you, by the site's operators or in answer to a claim you raised, we record who it was offered to, who made the offer, when, and whether it was accepted, withdrawn or ran out. It stays open for 14 days, only you can accept it, and nothing changes until you do. We keep the offer and how it ended permanently, with the change of hands it made.
  • • Your public profile page — your handle, the name you are known by, your bio and any part of it you switch on — is public by your choice, and only then, and it never shows your real name. Everything on a public profile is off until you turn it on; until you publish it, there is no public page at all — and a handle nobody has published looks exactly like a handle nobody holds, so the address cannot be used to find out whether an account exists. We do not count visits to your profile. There is no number, because we do not collect one.
  • • Handles you have given up. A handle can change once every 30 days. When you change yours we keep the old one, on its own and attached to nothing, for 90 days — so nobody else can pick it up and inherit whatever still links to it. It does not redirect: from the moment you change it, the old address is a page that does not exist. After 90 days it is simply free again.
  • • Other people, where your profile names them. If you publish your games, an opponent is named by handle only when they have published a profile of their own; everyone else reads as “an opponent”. If you publish your clubs, each listed club is named and linked; an unlisted or private club is left off, because your profile is the same page for everyone who opens it. Your choice publishes your side of a shared thing, never somebody else’s.
  • • The clubs you belong to, and — if you own one — your name on its page. A club's page names the person who runs it by the name they are known by, or by handle if they have not given one, and never by their real name, because a club has to have a reachable human. The club's other members can see that you belong to it, when you joined and which of its groups you are in. Nobody outside the club sees your membership, unless the club shows a group you are in on its page (below). A private club shows none of this to anyone outside it — not who runs it, not how many members it has, not the groups it shows.
  • • Support notes. If you write in, whoever answers may add a note about the request to your account. The notes are ours, are visible only to the site's operators and support group, and are not part of your export.
  • • Your collection, if you turn on syncing. The quantities you record — which models, how many, how many built and painted — the catalogue version each system's entries were recorded against, and the name you give anything you add that a catalogue does not list. Only accounts with two sign-in routes can sync; with one route everything stays in your browser and we hold none of it. Photos you attach to a model in the Infinity view of your collection stay in your browser: they never sync, and they are separate from the photo library described next.
  • • Photos you upload. Three web-sized copies of each (400, 1600 and 2560 pixels on the longest side), as WebP, or as JPEG when your browser cannot write WebP, stored on Cloudflare R2 under a fingerprint of the image, with the original file name discarded. Your browser makes the copies before anything is sent, and we refuse any file that still carries location or camera metadata, so we never hold it. The same image uploaded twice is stored once, and nobody is told that it matched. Only accounts with two sign-in routes can upload.
  • • The date a photo was taken, and nothing else from its metadata. Your browser reads that one field from the original file before making the copies — never the location, the camera or its serial number. We keep it when it falls between 1990 and today, and nothing when it does not. If you give a date yourself, for a batch of old scans say, we keep yours instead, to the day, month or year you gave, and note that you entered it. We also keep when you uploaded the photo.
  • • What happens to a photo afterwards. Whether you have hidden it from your own pages; whether it has been hidden after a report, and why; and — once you delete it — a 30-day bin, which counts toward your 1,000 photos; after 30 days it is gone, and the stored copies go as soon as no photo uses them. A photo you upload is visible to you and to nobody else until you post it into a club's or an event's gallery or add it to a note on a game (below), and a deleted photo stops being served to you the moment you delete it.
  • • Photos you give to a club or an event. Posting a photo into a club's or an event's gallery gives it to them: it stays with that club or event even if you later delete it from your library or delete your account, and when you go, it stays with no name on it. It remains yours to use anywhere else while you are here.
  • • Who sees a photo you post, and what we record. Until upload scanning is switched on, a club's gallery is shown only to its members, and an event's only to the people going and its organisers. While a photo you post waits for approval, the people who approve photos there can see it; once approved, so can the gallery's viewers. Both see the name you are known by, or your handle if you have not given one, and never your real name. We keep when you posted it, who approved it or took it out and when, and any note they left, which is also sent to your inbox.
  • • Profile and cover photos. A profile photo and a cover photo are public. Yours show on your public profile to anyone who opens it once you publish it, and to you alone until then; your profile photo also shows in your own account menu. A club's show on the club's page, and its profile photo beside its name in the club directory, to everyone, signed in or not, until the club closes. Your browser cuts the square or the banner and removes location and camera details before anything is sent, so only what is inside the frame reaches us, stored as three web-sized copies like any other photo. We keep which page each belongs to, when it was set, and, for a club, which member set it. Choosing one from your photo library makes a separate copy: the library photo stays as private as it was, and nothing else in your library becomes visible. Profile and cover photos are not part of your library and do not count toward its 1,000. Replacing or removing one deletes it at once, and its stored copies go as soon as no photo uses them; a browser that has already shown it may keep its own copy for up to five minutes. Anyone who can see one can report it, and one reported as harmful is hidden at once and the page shows no photo there until an operator decides; you, or the club's owner, are told, and never who reported it.
  • • The change record. When something is changed — a sign-in method removed, a token created or revoked, a club's details or groups edited, a notice or an event update posted, an event's settings changed, a result entered by an organiser, an account locked — we keep what changed, before and after, when, and who did it, including whether it was a person acting in the app or software acting with their token. That distinction is recorded on purpose: if you ever ask "did I do this, or did something do it for me?", this is the record that answers. Ordinary changes, such as a club editing what it says about itself or a notice being posted, are deleted after 90 days. Changes to who can do what or who owns what — sign-in methods, tokens, recovery codes, groups and their permissions, handovers and folds, event and round decisions, adjudicated results, locks, hidden photos, and game systems retired, taken down or offered to a new owner — are kept. There is no page that shows the record: the site's operators can read it, and you can ask for yours.

What stays in your browser and never reaches us

The parts of Sahul most people use most are stored entirely on your own device, in your browser's local storage. They are not uploaded, not backed up by us, and not visible to us:

  • • Your collection — what you own, what is built, what is painted — unless your account syncs it (above)
  • • Your army lists and force-builder work
  • • Photos you attach to a model in the Infinity view of your collection, held as small downscaled copies (separate from photos you upload, above)
  • • Bookmarks, view preferences and your light/dark choice

The consequence is worth stating plainly, because it cuts both ways: clearing your browser data deletes all of it, and we cannot get it back for you. Nor does it follow you to another device, except your collection once your account syncs it.

Who can see a game record

A logged game is a shared record: it belongs to everyone sitting at that table, not to whoever typed it in. That is why it is stored on our server rather than in your browser, and why one player cannot quietly rewrite it. Each record holds the game system's name and version as of the day you played, the format and mission if whoever started it chose them, who was in it, the result, any notes anyone added and the photos on them (below), and the times of those writes. It also keeps who entered the result and which other players have confirmed it looks right; when an organiser entered it, who they were, when, and the reason they gave; and, for each player who set the record back to private, that they did and when. When a player at an event rejects another player's proposed change to a result, the table is marked disputed and we keep both claims (who proposed what, and who rejected it) until an organiser enters the result or the players agree.

Every game is private when it is created, and stays that way on its own.A record is visible to the people seated in it who have accounts, and — when the game was played at an event — to that event's organisers, who need to be able to see the games at their own tournament. A player without an account is a name on the record and can see nothing until they take their seat, which they do through a claim link one of the players gives them. We never email an invitation to somebody who has no account.

Any player in a game may raise it to anyone with the link, and any player may lower it again; if you disagree, the more private setting wins, and your objection stays with the record until you lift it yourself. There is no way for one player to publish a shared record to the world: games appear on a public profile only through your own profile page, showing your games, switched on by you.

Two details of how that works. A record set to anyone with the link can be read by somebody who is not signed in at all — that is what the setting means, and pretending otherwise would make it a promise we do not keep. Reading is all they can do. And a claim link can bereplaced by any player in the game: the old one stops working immediately, so a link that went to the wrong person is one tap from being useless.

You can also put a real account into a seat by typing that person'shandle, exactly. We match handles only — no name search, no email search, no browsing of who has an account — and only for people who have published a profile; an unknown handle and an unpublished one give the same answer, so this cannot be used to find out who is here. The person is told they were added and can say Not me, which empties the seat again.

A photo added to a game note is shown to whoever can see that game: its players with accounts, the organisers of its event, and — while the record is set to anyone with the link — anyone holding the address, signed in or not. Nobody else, and nothing else in your photo library becomes visible because of it. A player can add photos only to a note they write on a game they are seated in, uploaded there or chosen from their own library. We keep which note each photo is on, the order, and when it was added, and the photo carries a tag for the game in your library. It is not given to anyone: it stays yours. Taking it off the note, removing the game's tag in your library, hiding it or moving it to the bin takes it off the game for everyone, and it stays in your library; if the site hides it after a report, it is hidden on the game too.

If you belong to a club, or run one

A club's page describes the club, not its members. What it can say about itself — its name, a line about it, the suburb, region and country, the venue, when it meets, a contact link and up to five other links, and the games it plays — is club data, entered by whoever runs it and public to anyone with the link, unless the club is private (below). If you type a home address into the venue field it becomes public, because that field is printed on the page; there is no map, no radius search and no geocoding, and we never work out where a club is from anything but the words it typed.

A club can be open or by invitation. An invitation link carries a join key — a short random string stored on the club's row, not on you. It is a doorbell, not a password: anyone holding the link can join, the people running the club can replace it at any time, and replacing it stops every copy of the old link immediately. Nothing about who used it is recorded beyond your membership itself.

A club is listed, unlisted orprivate, a setting stored on the club's row and changed by whoever can edit the club. A listed club is in the directory and its search. An unlisted club is not, but its page shows to anyone with the link. A private club is not in the directory either, and to anyone who is not a member its address shows only its name and that it is private: its description, where it meets, who runs it, how many members it has, the groups it shows, its notices, events, photos and game systems are sent to its members and nobody else. A private club is always by invitation. An event a private club hosts stays public, and to anyone outside the club it names the club only as “a private club”, with no link. A private club's name is never copied onto your registration as your club banner. The site's operators can still look up and open any club, whatever it is set to.

Your membership of a club is visible to the club's other members: the name you are known by and your handle, never your real name, the day you joined and which of the club's groups you are in. Nobody outside the club sees that list; they see how many members it has, and nothing else — and outside a private club, not even that. The one exception is the site's operators: looking a club up, they see who owns it and who can change its groups, and on its hand-over page they see its members' handles and the names they are known by, so that a club whose owner cannot hand it over can still be offered to one of them. Never your email address, to anyone.

A club can choose to show a group on its page. If it does, the names the people in that group are known by (or their handles) are public on the club's page for as long as the setting stays on — or, in a private club, shown to its members only. It is off for every group until somebody who runs the club turns it on, and turning it off takes the names down at once.

Changing what a club says about itself is kept in the change record, with who changed it and when. Changing who is in a group, what a group may do, which group new members land in, or removing somebody from the club is kept permanently, with who did it and whether it was them in the app or software acting with their token: "who gave this person that power" is the question that gets asked late.

A club can be handed over. Its owner offers it to one of its members, and that member accepts it or not. The offer names both people and when it was made; it stays open for 14 days and ends when it is accepted, declined, withdrawn or runs out. We keep every offer and how it endedpermanently, with the ownership change it made. While an offer is open, the owner can see whether the member they chose could accept today, but not which step they are missing; the member is told exactly what to add. Nobody else sees the offer except the site's operators. When a club's owner cannot hand it over, an operator can make or withdraw the offer in their place: the member still accepts it or not themselves, the owner is told, and the record names the operator who did it.

A club's owner can fold it, and so can the site's operators. Its page stays up as a record marked closed and every other member gets a note in their inbox; when the operators fold it, the note says so, and the owner gets one of their own. A club can be reopened for 30 days: by its owner, if they folded it, or by the operators. If the club looked after a game system, the site's operators get a ticket naming the club and the system, and the ticket records whoever folded it as the person who raised it. The operators may offer that person the system, which they accept or not themselves, or turn the claim down with a reason that person is sent. A fold and a reopen are kept permanently with who did them.

A club can post notices on its page. A notice stores its title and text, who can see it, whether it is pinned, the day it comes down if one was set, the account that posted it, and when it was posted, last changed, edited and removed. A notice for anyone is public to anyone with the link, signed in or not (in a private club, to its members only); a members-only notice is shown to the club's members and nobody else. Each notice shows the name the person who posted it is known by, or their handle, and never their real name or email address. When a notice is posted, every other member of the club gets one note in their inbox; editing, pinning or removing it sends nothing. Nobody can answer a notice on Sahul, and nobody is told who has read one, because we do not record it.

A notice past its day stops being shown to anyone but is kept, and the people who run the club can still see it, change it or remove it. A removed notice waits in the club's bin for 30 days, where they can restore it, and is then deleted. A notice belongs to the club's board, not to whoever posted it: it stays if they leave the club. Posting, changing, removing and restoring a notice is kept in the change record, with who did it and when.

If you register for an event

An event page is public. Anyone with the link — signed in or not — can see what it is, when and where it happens, who is hosting it, and how many people are coming. Saying you are watching, interested or going records one row: the event, you, which of those you picked, and when you last changed it. You can move up and down that list freely, and there is deliberately no "not going" to record.

Creating an event records it against your account. What you enter for it — its name, a line about it, the venue, time zone and dates, its registration settings and player pack, and each tournament's system and format — is public on the event page, and your account is not named there as its creator. Naming a club as host, co-host, participating or listed records that, and when the club accepted or declined it. Cancelling records when, and the reason you give, which the event page shows.

Registering records the same row plus three things: the club banner you were in at that moment (never a private club's), copied as text so a later rename or a club you leave never rewrites who you played for; which tournament you registered for, when the event holds more than one; and your place in the queue if every place was taken. If somebody withdraws and you are first in that queue, you get an inbox item saying so. Withdrawing drops you back to watching — it does not delete the row, because the event's organisers need an honest count.

When a tournament's format asks for player details, such as an ITS PIN and a faction or sectorial army, registering for it asks for them and stores your answers on your roster row for that tournament, the same place the desk keeps a walk-in's answers. You can change them until round 1 is published. The event's organisers can see them, correct them at any time, and include them in the results they download; a correction is recorded with which organiser made it, when, and which details changed, but not your answers. Withdrawing before you have played in the tournament deletes that roster row, and your answers with it.

If the game system has a player ID you saved, such as your ITS PIN, that question starts with it filled in. The answer on your roster row is a copy: changing your saved ID later does not change it, and changing the answer on the form saves it back as your ID only if you tickAlso save as my ITS PIN.

Whether your name appears on the page is your choice, asked when you register and changeable at any time. With it on, the page shows the name you are known by, or your handle, and never your real name. With it off you are still counted — the page says "and 6 others" — and your name is not sent to the browser of anyone reading the page at all, rather than being sent and hidden. It stays visible to the event's organisers, who cannot run an event against a list of anonymous people and who see your real name with the name you are known by beside it, and to whoever you are drawn against, who is about to meet you anyway and sees the name you are known by.

Organisers can add a walk-in — somebody at the door with no account. That stores the name they gave and their answer to the same "show my name" question, and nothing else; we have no way to contact them and we never try. A walk-in slip carries a short claim code(six characters) which lets that person, later, sign in and attach their results to their own account. It is a one-time claim on one roster row at one event, not a password, and it stops working the moment it is used. Cancelling an event tells everyone with a row on it, whatever they have muted; walk-ins cannot be told, and the organiser is shown that number before they confirm.

At the event, the check-in desk records that you arrived, when, and which organiser checked you in; undoing a check-in is recorded the same way, and both records are kept. If you are playing in a tournament, the organisers keep a roster row for you: the club banner and the "show my name" answer copied from your registration, any player details the format asked for, and when you arrived. The names it shows are read from your account each time the roster is shown. An organiser can take you off that roster and put you back; that is recorded with who did it, and it does not change your own place on the list above. When a walk-in claims their place with a code, the roster row, every game recorded against it, and the answers they gave at the desk move onto their account.

When the organisers run rounds, each round records which table you were seated at and who with. Publishing a round makes a game record for your table with your roster row attached, and sends you an inbox item saying where you sit, which expires on its own once the round is over. The public round list and the board shown at the venue list every published table with your "show my name" answer applied: if you said no, you read there as "Anonymous player", with no club banner. They show whether a table's result is in, not the result, which stays on the game record. Being given a table does not mark you as arrived: the desk does that, and so does your own first note or result on your game.

Dropping out of a tournament, whether you do it or an organiser does, records when, and who did it. When the organisers publish the results, we keep the final standings as they stood: each player's place and figures, stored against their roster row rather than their name, with your "show my name" answer applied every time the table is shown, so changing it later still counts. The standings page shows who won each table and, where an organiser entered the result, who they were and when; it never shows the scores.

After the event, an organiser can write a report: text they write, kept on the event, which can be edited or cleared. Until the results are published only the event's organisers can see it; once they are published it is shown on the event page, under the results, to everyone who can see that page, and the event page is public. Each time the report is saved, edited or cleared we record who did it, when, and what it said before and after, and we keep that record. A report can link to other websites, but it never loads a picture or anything else from them into the page: a picture in it is shown as a link.

Every event has an Updates log on its page, public wherever the event page is. When an organiser changes the event's date, start or end time, time zone or venue, or cancels it, we write one entry saying what changed, from what to what, or the reason given for cancelling. Those entries name no account, and nobody can edit or remove them. An organiser can also post their own update: we store its text, the account that posted it, when, and when it was last edited, and the page shows the name that account is known by, or its handle, and never its real name or email address. Each change, cancellation and post sends one note to the inbox of everyone with a row on the event — watching, interested, going, registered, on the waitlist or checked in — except the person who made it; editing or removing a post sends nothing, and walk-ins cannot be told. Removing a post takes it off the page at once and deletes its words; we keep only the fact that a post was there. Posting, editing and removing an update is kept in the change record for 90 days, with who did it and when.

A game you log at an event outside its rounds is a side game. You can link one to an event while the event is running, if you are playing there or are one of its organisers. It is kept like any other game record, with the event attached, and it never counts towards the event's standings or results, and is never in the organisers' download. It does not mark you as arrived. The event page lists it only to the people seated in it and to the event's organisers, who can see every game at their event.

An event's organisers (its creator, and anyone holding event:manage in its host or a co-host club) candownload the results of each tournament, for one round or all of them, as a CSV or JSON file. The file holds every table of each published round: each player's real name (the one on your account, or the name given at the desk, whatever you answered to "show my name") with the name you are known by beside it, the player details the game's format asks for, such as an ITS PIN and faction, where they were recorded, and each table's result, scores, and who entered it. It is for the organisers' own reporting, for example into Corvus Belli's CorvuSphere. Sahul sends it nowhere, and a download is not recorded.

Each attempt to claim a walk-in place with a code records the event, your account and the time, so that attempts can be capped. Those records are deleted after a day.

Who can see it: the site's operators

Sahul has a small, named operators group. Today that is John. Anyone else is added only by an existing operator, deliberately, and every addition and removal is written to the change record described above and kept — so "who was an operator, and since when" always has an answer. A second group, support, exists for people who help with reports; it is empty.

What an operator can see is the account data listed on this page: your email address, your real name and the name you are known by, which sign-in methods you have linked, when you last signed in, a summary of your sessions, how many API tokens you hold, your synced collection if you have one, the clubs and groups you belong to, reports you have filed, and the change record. They see it to run the site and to answer you when you write in — not to browse. They cannot see anything that stays in your browser, and nothing here is shared outside the project.

An operator can lock an account, and only with a reason. We keep the reason and who locked it with the account, and both are written to the change record. Locking signs out every device, stops the account's API tokens working until it is unlocked, and takes a published profile down; nobody else is told. If you try to sign in to a locked account you are told it is locked, and the reason is put in its inbox. To contest a lock, use Report an issue. Unlocking needs a reason too, and is kept the same way.

Operators can act on a game system that is not theirs. They canretire it, which stops new adoption and keeps every game played under it working; take it down, with a reason, which hides it from the library and search for everyone but the people who look after it and the operators, andreverse a takedown, which puts it back and clears the reason from the system; offer it to anew owner, who accepts it or not themselves; and accept or turn down a claim on a system whose club folded. Everyone who plays or follows a system is told when it is retired, taken down or put back, with the operators' reason for a takedown, and its owner and the club that manages it are told when it is offered to somebody else. Games keep the name and version they were played with. Each of these acts is kept permanently in the change record with the operator who did it. The support group can look a system up but cannot do any of them.

If you report a bug

The report form stores what you wrote, the page you filed it from, the item it was about, your browser's user-agent string, and a hashed IP used only to rate-limit abuse. The contact field is optional and free text — whatever you choose to put there is stored as you typed it, so give an address only if you want a reply.

If you report something, or someone

Reporting a photo, a game system, an account or a club opens a ticket the site's operators work through. We keep who reported it — so the outcome can reach you, and so the people answering can see when the same person reports many things. The person you reported is never told who reported them. Your name sits on the operators' side of the ticket and in nothing that is sent to anybody else. When the ticket is closed you are sent the operator's words unchanged, and nothing about anyone else. Operators may take a ticket on, draft the reply and add notes while they work it; the notes and drafts are ours, like support notes, and are not part of your export.

If someone reports a photo, we keep the report, the reporter's account or the email address they chose to give, and the outcome. The person whose photo it is never sees who reported it, or the words the report was sent with.

A request about a photo of yourself needs no account, only an email address. That address is used for that request alone: it is kept with it and shown only to the site's operators, so they have a way to reach you. Sahul sends no email about reports. A photo reported as harmful is hidden from everyone, its owner included, until an operator decides; a photo whose owner does not answer a request about it within 7 days is hidden the same way.

What we deliberately do not collect

  • • Your IP address. It is combined with a secret salt, hashed with SHA-256 and truncated before storage. It exists to count abuse and cannot be turned back into an address.
  • • Passwords. There is no password field in Sahul. Sign-in is by emailed link, Discord, Google, or a recovery code you generated yourself.
  • • Payment details. Nothing is for sale.
  • • Tracking pixels, advertising identifiers or third-party cookies. There are none. The only cookies Sahul sets are your session and a short-lived one during sign-in.
  • • Any analytics that can identify you. See the section below for exactly what the page counter does and does not see.
  • • Your location, contacts, or anything from your device beyond what a web page ordinarily receives. That includes the location a phone writes into a photo: a photo still carrying it is refused at upload.

Measurement — what we count, and what we deliberately do not

Sahul uses Cloudflare Web Analytics, which is a page counter rather than a tracker. It sets no cookies, builds no profile, does not fingerprint your browser, and cannot follow you to any other website. There is no way for us to look up what any individual did.

What it records, per page view:

  • • the page visited, and the site that linked you here
  • • your country, browser and operating system — no more precise than that
  • • how quickly the page loaded

Why: to know whether anything is broken, whether pages are slow, and whether anyone is actually using a thing before more time goes into it. That is the whole purpose. It is not used for advertising, it is not sold, and it is not shared.

We would rather count less than more. If something here can be dropped without losing the ability to tell whether the site works, it should be — say so atprivacy@sahul.net and it will be.

Who else is involved

  • • Cloudflare hosts the site and the database, stores uploaded photos, provides the anti-spam check on the sign-in form, and counts page views as described above. Data is stored in their Oceania region. They process it on our behalf and do not use it for their own purposes.
  • • Discord and Google are involved only if you choose to sign in with them. We receive your account id, email address, display name and avatar; the display name becomes your real name here until you change it in Settings. We do not post anything, read your messages, or see your servers or contacts.
  • • Cloudflare Email delivers sign-in links.
  • • Corvus Belli is not involved. Sahul is an independent community project and shares nothing with them.

How long we keep things

  • • Sign-in links — 15 minutes, then unusable, and deleted a day after that. Deleted immediately if delivery fails.
  • • Sessions — up to 90 days from last use, and removed the moment you sign out. Expired ones are deleted within the hour.
  • • Your account — until you delete it.
  • • Your synced collection — until you delete your account, or stop syncing and ask us to remove the copy.
  • • Saved player IDs — until you clear them or delete your account.
  • • Photos — until you delete them, then 30 days in the bin, then gone; the stored copies are deleted once no photo uses them. A photo you posted into a club or event stays with it, with no name on it once you are gone.
  • • Profile and cover photos — until replaced or removed, then deleted at once. A player's go with their account. A closed club's are kept, and shown to nobody, while its record stays.
  • • Club notices — until the club removes them, then 30 days in the bin, then gone. A notice past its day is hidden, not deleted.
  • • Event updates — kept with the event. A removed update's words are deleted at once.
  • • The change record — ordinary changes for 90 days; changes to who can do what or who owns what, kept. Removing a way into an account is exactly the kind of change that gets asked about long afterwards, and a record with an expiry date is no protection in the case it exists for.
  • • Your inbox — until you delete your account. Archived is not deleted.
  • • API tokens — until you delete your account; a revoked token stays listed as revoked.
  • • A handle you gave up — 90 days, attached to nothing.
  • • Walk-in claim attempts — a day.
  • • Reports and tickets — kept, with their notes, as the record of what was decided and why.
  • • Bug reports — kept, because they are a record of what was wrong. Say so and we will remove yours.

Your rights

You can ask for a copy of everything held about you, ask for it to be corrected, or ask for it to be deleted, and you do not need a reason. Download my data, in Settings under Your data, hands you a file straight away with what this browser holds, your account's email address, real name, the name you are known by and handle, your game records, and the player IDs you have saved. For everything else, write to privacy@sahul.net and we will act within 30 days. There is no delete button yet: an account is deleted by hand, on request. That removes your user record, your linked sign-in methods, your recovery codes, your tokens, your profile and its profile and cover photos, your saved player IDs, your sessions and your photo library — except photos you posted into a club or event gallery, which stay there with no name on them. Records you share with other people — games, event rosters and results, notices you posted in a club, updates you posted on an event — stay for them, with your name taken off.

Sahul is run from Australia and follows the Australian Privacy Principles under the Privacy Act 1988(Cth). If you are in the UK or the European Economic Area, the UK GDPR and GDPR give you these same rights and a few more — the right to object, to restrict processing, and to complain to your local supervisory authority. We treat everyone as having them regardless of where they are, because maintaining two standards would mean getting one of them wrong.

Our lawful basis, where one is needed: we process your email address to perform the contract of giving you an account you asked for, and we process hashed IPs under legitimate interests — keeping a free sign-in form from being abused.

Children

Sahul is not aimed at children and accounts are not intended for under-16s. If you believe a child has created an account, tell us and we will delete it.

If something goes wrong

If a breach happens that could put you at risk, we will tell affected people directly and say what happened, what was involved, and what to do — within 72 hours of finding out. This is a small project run by one person; that is a reason to be more direct about failures, not less.

Changes

If this policy changes in a way that affects what we collect or who sees it, the change is made before the collection starts, not after, and the date at the top moves.

Questions: privacy@sahul.net. See also theterms of use.