Privacy policy

You can use this site without giving anything. You only hand over anything when you choose to — by creating an account. Nothing here is sold. Some pages carry things that can follow you off this site, and they are named below.

The pages that exist to do something rather than to tell you something carry no advertising: posting a loadout, signing in, your account, this page, the Terms, and any page that does not exist.

If you are reading from the UK, the EEA or Switzerland you are asked before anything non-essential is stored, and you can change that answer at any time from Cookie settings at the foot of every page.

Crimson Moon Forge is run by TSMW DEVELOPMENT LTD, A UK software development studio building websites, apps and bespoke software., registered in England and Wales under company number 17204316. That company is the data controller for everything described here.

Write to contact@tsmwdevelopment.com about anything on this page, including a request to see or delete what is held about you.

Nothing is collected merely because you read a page, beyond what is named under Who else processes it below.

If you create an account:

• Your email address — so you can sign in, reset a password, and be told about anything that affects your account. It is not used for marketing unless you separately ask for that.
• A password hash — Argon2id, one-way. The password itself is never stored and cannot be recovered from what is, which is why a reset issues a new one rather than telling you the old one.
• A display name, if you set one.
• Timestamps — when the account was created and last updated.

Signing in sets one cookie: a signed session token, HTTP-only, readable only by this site's own server. It is strictly necessary — without it, signing in does not work — so it is not part of anything you are asked to consent to, and switching it off is not offered because the site would simply stop functioning.

The hosting platform keeps ordinary server logs — the request, the response code, a timestamp, an IP address — for a short period. That is a security and operations record rather than analytics, and it is not linked to an account.

Every one of these is a real dependency of this site rather than a category. If one is removed, it is removed from this list in the same change.

• DigitalOcean — hosting. Serves every page, and keeps the short-lived request logs described above. The servers are in London, United Kingdom.
• Google Analytics — counts page views and tells one reader who opened four pages from four readers who opened one each. It stores an identifier in a cookie on this domain. In the UK, the EEA and Switzerland it starts denied and does nothing until you agree; elsewhere it starts on and the footer control switches it off.
• Google AdSense — the advertising on the content pages. Google may store an identifier to choose which advert to show and to count whether it was seen. Google shows its own consent prompt in the UK and the EEA, separately from this site's, because its certification requires it.
• Awin — the affiliate network behind the shop adverts. Its creative sets a cookie on its own domain when the picture loads, which is how an advertiser knows the advert ran. Where consent is required, that request is not made at all until you agree — a copy of the same picture is served from this site instead, and the advert still works.
• DigitalOcean — the database, where account records are stored.

Under PECR in the UK and the ePrivacy rules across the EEA, storing or reading anything on your device needs your consent first, unless it is strictly necessary for something you asked for. Switzerland reaches a similar answer through its own law. This site treats an unknown location as though it were on that list, so if it cannot tell where you are, you are asked.

There are three categories, and only two of them are a question:

• Strictly necessary — signing in, and the short-lived tokens that make signing in safe. Not offered as a choice, because without them the site cannot do what you asked it to.
• Measurement — Google Analytics, above. A real choice: say no and it runs without storing anything, or not at all.
• Advertising — the networks named above. Say no and the adverts still appear, served from here, and nothing is stored.

Your answer is kept in this browser's own storage rather than in a cookie, and it is the only thing stored before you have answered anything. Storing a record of a consent decision is itself strictly necessary, which is the one exemption this site relies on.

Change your mind at any time from Cookie settings at the foot of every page. It clears the answer and asks again rather than silently switching everything off — being asked and being switched off are different things.

Advertising runs on the content pages. It does not run on the pages whose purpose is an action rather than a subject: search, posting a loadout, signing in, creating an account, managing an account, resetting a password, confirming an email address, the admin pages, this page, the Terms, the Disclaimer, and any page that does not exist.

That list is not editorial policy written after the fact — it is the same list the code reads to decide whether to load the tag at all. If the two ever disagree, this paragraph is the bug.

Affiliate adverts are also limited by country, because a campaign is sold in specific ones: there are none running at present.

Where this site earns a commission if you buy something, the advert says so on its face. Advertisement describes the placement; the line beneath it describes the incentive. Both are shown, always.

Account records are kept until the account is deleted. Deleting an account removes the record; it is not a flag that hides it.

Password reset and email confirmation tokens are stored hashed, expire within hours, and are deleted once used.

Server logs are kept for a short operational period by the host and then rotated away.

Google Analytics keeps the detailed event data behind this site's reports for 14 months from a visit, after which the detail is discarded and only aggregate counts remain. That period is a setting on the analytics property, so if it is changed there, this sentence changes with it.

Anything a third party stores on your device is governed by that party's own retention, not by this site's. The links in their names go to their policies.

Under the UK GDPR and the EU GDPR you can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, object to processing, and withdraw a consent you gave.

Ask at contact@tsmwdevelopment.com. There is no form and no account requirement; an email is enough. You will get an answer within a month.

If you are not satisfied with the answer, you can complain to the Information Commissioner's Office in the UK, or to your own supervisory authority in the EEA.

This site is not directed at children, and nothing here is designed to appeal to them specifically. Accounts are not knowingly created for anyone under 13. If you believe one has been, write to the address above and it will be removed.

This page changes when the site does, and the date at the top says when it last did. A change that affects what you were asked to consent to resets the question rather than reinterpreting an old answer — a yes given when one thing was running is not a yes to something else.