Privacy Policy

Last updated: 14 October 2026

This Privacy Policy explains how Warhammer Game Finder (“the Site”, “we”, “us”) collects, uses, and shares personal data when you visit warhammergamefinder.com or create an account. It describes the Site as it works today.

The Site is a free, unofficial fan-made matchmaking service for tabletop Warhammer players. It is operated as a fan project by Chaos Theory Studios. It is not affiliated with Games Workshop.

If you do not agree with this policy, please do not use the Site. Related rules are in our Terms and Conditions and cookie notice.

1. Who is responsible

For UK data protection law, Chaos Theory Studios is the controller of personal data processed through the Site.

Contact: admin@chaostheorystudios.co

2. Who this Site is for

You must be 18 or over to register. We do not knowingly collect personal data from children. If we learn that an account belongs to someone under 18, we will close it.

3. What we collect

We collect the information below because the Site needs it to run, or because you choose to provide it.

Account

When you register we store your email address, username, a hashed password (we do not keep your password in plain text), when you registered, and that you confirmed you are 18 or over and accepted the terms. We also store an email-confirmation code and whether your email is confirmed. If you registered through another member’s invite link, we record which member invited you.

If you ask to reset your password, we store a one-time reset code, which expires after an hour, and email you a link containing it.

On a successful login we record the time you last logged in, and while you use the Site we record when you were last active (updated at most every 15 minutes). We issue a signed session token so the Site knows who you are. That token is kept in your browser’s local storage (not as a cookie). It lasts seven days and is renewed automatically while you keep using the Site.

Profile and location

You can save a postcode, country, the game systems you play, a short bio, your experience level, the armies you play, when you are usually free to play, and a profile photo. The Site does not use your phone or browser GPS. When you save a postcode and country, our server sends them to Google’s geocoding service so we can store a map point (latitude and longitude). We use that point only to measure distance: for player search, open games and clubs near you, the nearby numbers on your dashboard, and the nearby emails described below.

Profile photos must be PNG or JPG. We resize them and store them in Microsoft Azure. Your email preferences (see section 5) and a private unsubscribe code are stored with your account.

Searching for clubs without an account

Anyone can search for clubs near a postcode on the Clubs page. We send the postcode and country to Google’s geocoding service and keep the resulting map point with that postcode and country for 30 days, so the next search for the same postcode does not need Google. This is not linked to you or to any account. To stop the search being misused we allow 20 searches an hour from one internet address: we store a one-way scrambled (hashed) form of the address with the time of the search, never the address itself, and delete it after a day.

Games you arrange

When you invite someone to play we store who invited whom, the date and time, the game system, the points value, any note you add, whether the other player accepted or declined, whether either of you cancelled, and when we sent the reminder email.

When you post an open game we store the game system, date and time, points value, your description, a copy of your map point at the time you posted (so the game can be found by distance), and who joined it. Joining an open game creates an arranged game between you and the poster.

If you choose one of your clubs as the place to play an open game or arranged game, we store which club. An open game at a club uses a copy of the club’s map point instead of yours. The other player sees the club’s name and town, and its street address only if the club shows it publicly or they are a member.

Private messages

One-to-one messages you send or receive are stored, including who sent them, when, and whether the recipient has opened the thread.

Forum

Forum posts and replies include a title, body, author, and time. You may attach a PNG or JPG. Images are resized and stored so other signed-in members can see them with the post. We also store who liked a post.

Clubs

If you list a club, we store what you enter about it: its name, descriptions, venue type and name, address, town, postcode, country, meeting times, dates the club is closed, game systems, fees, facilities, website and social links, how people join, and any logo or cover photo you upload. We send the postcode (or town) and country to Google’s geocoding service to get a map point for the club, which we use to measure distance in club search. We record who created the club and when it was created, changed and published.

For each club member we store their role (owner, manager or member), whether they are a member, have asked to join, have been invited or are banned, when they asked and joined, who approved or banned them, and whether they chose to appear on the club’s public page. If you report a club, we store your reason, who you are and when you reported it.

Site administrators may list a club nobody has claimed yet. If you claim one, we store who you are, what you wrote about how you are connected to the club, and when you claimed it, then which administrator decided, when, and any note they added. We keep the claim after it is decided.

Club owners and managers can add events (for example a tournament or painting day). We store what they enter (title, type, date and time, game systems, number of spaces, cost, details, whether it is for members only), who created it, and whether it was cancelled. When you say you are going to an event, or join its waitlist, we store that and when you did it, which decides your place on the waitlist. We also record when we sent the reminder email.

Technical and usage data

The Site is a web app that can be installed on a phone or computer. Your browser may keep copies of the Site’s files for offline use. We also store a simple “cookie notice accepted” flag in local storage after you tap Got it on the analytics notice, your light or dark mode choice, and (if you arrived through an invite link) the inviting member’s username until you register.

Google Analytics runs when you load the Site and collects standard usage information (for example pages visited and approximate location derived by Google). Our API may also write technical logs through Microsoft Azure, which can include request details such as time, path, and error information.

We do not collect payment details. There is no in-app billing. We do not offer friend lists.

4. How we use your data

We use personal data to:

- create and secure your account, confirm your email, and keep you signed in;

- show you as a potential opponent to other members and let you search by username, game system, and distance;

- let you arrange games, post and join open games, send private messages, and use the forum;

- show badges on your profile that are earned from activity (for example games played, members you invited, a club you started, or club events you went to);

- suggest clubs near you, and let you narrow player search to members of the clubs you belong to;

- publish club listings, let members find and join clubs, and let club owners and managers run their club;

- email you about your account and activity on the Site;

- understand how the Site is used and to keep it running (analytics, hosting, and error logs);

- enforce the terms, including the 18+ rule, a check that usernames, messages, forum posts, and club listings do not contain prohibited language, and reviewing reported clubs.

5. Emails we send

Email is sent from noreply@warhammergamefinder.com through Mailgun (EU).

These emails are always sent, because the Site needs them to work:

- a welcome email when you register, and an email with a confirmation link (the link includes a one-time code);

- a password reset link, when you ask for one;

- game emails: when someone invites you to a game, and when the other player accepts, declines or cancels it, or joins your open game. These include the other player’s username, the game system, the date and time, and (for invites) the points value;

- club emails: when your request to join a club is approved or declined, when you are invited to join or help manage a club (with the inviter’s username), when a club is handed over to you (with the previous owner’s username), or when your claim to a club is approved or declined (with any note from the administrators);

- club event emails: when an event you are going to, or waiting for, is moved or cancelled, and when a space opens and you move off the waitlist. These include the club’s name and the event’s title, date and time.

These emails are optional. They are on when you join and you can turn each one off in the email settings on your profile, or turn them all off with the unsubscribe link at the bottom of each one:

- a notice when another member sends you a private message — the email does not include the message text;

- a notice when a confirmed member whose saved location is within about 75 miles of yours posts or replies on the forum. That email includes their username and the post title. You are not emailed about your own posts. Members without a saved location are skipped;

- a notice when a member within about 75 miles, or at a club you belong to, posts an open game in a system you play, with their username, the game system, date and time, points value, description and (for a game at a club) the club’s name and town;

- a reminder the day before an accepted game, with your opponent’s username, and the day before a club event you are going to;

- a notice when a club you belong to adds an event, with the event’s title, date, time and details;

- a weekly round-up of new players who share your game systems (with their usernames) and open games within about 50 miles, and events in the next two weeks at clubs you belong to, sent only when there is something new, and a one-off reminder to finish your profile if it has no location or game systems a couple of days after you register;

- for club owners and managers, a notice when someone asks to join their club, with that member’s username.

There is no separate marketing mailing list, and we do not send your email address to other members.

6. What other members can see

The Site is built so registered members can find each other. Logged-out visitors cannot browse member profiles, messages, bookings, or the forum. Published club listings are the exception: they are public (see below).

Other signed-in members can see:

- on your profile and in search results: your username, profile photo, country, game systems, bio, experience level, armies, when you are usually free, roughly how far away you are, when you were last active, when you joined, how many games you have played, and your badges;

- your username in game invites, the forum, and (if you share their systems and live nearby) weekly round-up emails;

- open games you post, with your username, the game system, date and time, points value, description, the club if you chose one, and roughly how far away you are (from the club, for a game at a club);

- forum posts, replies, likes, and any image you attach;

- private messages only if they are in that conversation;

- game invites that involve them.

We do not show your email address or postcode to other members. Distances are rounded and are worked out from your map point, which other members never see. There are no separate privacy switches on a profile: if you save a postcode and game systems, other members can use them to find you. Do not put information in a username, profile, message, or forum post that you do not want other members to see.

Profile photos and forum images are served from web addresses that are not listed anywhere public, but anyone who has such an address can open the image without signing in.

Clubs

A published club listing can be seen by anyone, including people who are not signed in, search engines, and services that show link previews. We also save a copy of each published club page, and of its cover photo or logo, into the public website so search engines and link previews can read it. That copy is refreshed once a day, so a change or removal can take up to a day to reach it.

The club’s owner chooses whether its street address and postcode are shown publicly. For a club that meets in a private home, only the town is shown publicly, and only the club’s members see the full address. Anyone can see how many members a club has. Members choose whether their username, profile photo and role appear on the club’s public page; this is off unless you turn it on. Signed-in members can see the club’s owner and its full member list. A club’s owner and managers also see who has asked to join, who has been invited, and who is banned. Nobody else in a club sees your email address or postcode.

Club events at a published club can be seen by anyone, with how many people are going. Only signed-in members see who is going (username and profile photo), and only the club’s owner and managers see who is on the waitlist.

Site administrators can see every club, including drafts, and the reports made about it, with the reporting member’s username. Club owners and managers cannot see who reported their club. Only site administrators see claims to a club, with the claiming member’s username and message. While a club is unclaimed, site administrators look after its listing.

7. Who we share data with

We do not sell your personal data. We do not run advertising networks. We share data only as needed to run the Site, as required by law, or with your consent.

Processors and other services we use:

- Microsoft Azure — hosts the website, API, database, profile photos, forum and club images, the scheduled jobs that send reminders and round-ups, and application logs;

- Mailgun (EU) — sends the emails listed above. Mailgun receives the recipient’s address and username and the contents of each email described in section 5 (for example other members’ usernames, game details, forum post titles, club names, and confirmation, reset and unsubscribe links);

- Google Analytics — measures how people use the Site. See Google’s Privacy Policy;

- Google Geocoding — converts the postcode and country you enter into a map point when you save your profile, a club’s postcode (or town) and country into a map point when the club is saved, and a postcode searched on the Clubs page into a map point;

- PurgoMalum — checks usernames, profile bios and armies, private messages, forum titles and bodies, game invite notes, open game descriptions, and club listing and event text for prohibited language before we store them. The submitted text is sent to that service for the check.

Those organisations process data under their own terms. Some (in particular Google and PurgoMalum) may process data outside the UK. Where that happens, they typically rely on a lawful transfer tool such as the UK International Data Transfer Addendum or Standard Contractual Clauses.

8. Cookies and similar storage

We do not set our own tracking cookies. We do use:

- Google Analytics cookies — loaded with the Site so we can see aggregate usage. A snackbar on first visit explains this. Choosing Got it stores a cookie-notice flag in local storage; it does not currently block Analytics from loading;

- local storage — your session token while you are logged in, the cookie-notice flag, your light or dark mode choice, and an inviting member’s username if you arrived through an invite link;

- a service worker — caches Site files so the app can load faster and work as an installable web app. That cache is not used to identify you.

More detail is on our cookie notice. You can also use your browser settings to block cookies or clear local storage (clearing local storage will sign you out).

9. Lawful bases

Under UK GDPR we rely on:

- Contract — to create your account, confirm your email, reset your password, search for players, arrange and post games, send messages, run the forum, list and run clubs, and send the related emails;

- Legitimate interests — to keep the Site secure, understand usage, improve it, and send the optional emails in section 5 (which you can turn off at any time), in ways that we believe are reasonable for a small community matchmaking site;

- Consent — you confirm you are 18 or over and accept the terms when you register. Analytics is described in the cookie notice; continuing to use the Site is treated as acceptance of that tracking as the Site works today.

10. How long we keep data

We keep account, profile, message, booking, open game, forum, and club data while your account exists. There is no automatic deletion after inactivity. Session tokens expire after seven days unless renewed. Password reset codes expire after an hour. When you replace or remove your profile photo, we delete the old image.

When a club owner deletes a club, the listing disappears from the Site straight away, but we keep its details and membership records (and the copy in the public website until the next daily refresh). Leaving a club, or having a request to join declined, removes that membership record, but not your replies to club events; you can withdraw from an event with Can’t make it until it starts. Email admin@chaostheorystudios.co if you want a deleted club’s data removed.

There is no self-service delete-account button. Email admin@chaostheorystudios.co if you want your account removed. We will delete or anonymise personal data we no longer need. Forum posts, messages, or bookings that involve other members may need to be handled as part of that request so we do not break their records.

Backups, email logs at Mailgun, and Azure logs may retain copies for a limited time after deletion until those systems rotate.

11. Your rights

If UK data protection law applies to you, you can ask us to:

- access the personal data we hold about you;

- correct inaccurate data (you can already edit your username, postcode, country, game systems, bio, experience, armies, availability, photo, and email settings on your profile);

- erase your data, or restrict or object to certain processing;

- receive a copy of data you provided, where that right applies.

Email admin@chaostheorystudios.co and we will respond as required by law. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.

12. Security

The Site is served over HTTPS. Passwords are stored as salted hashes, not as the password you typed. Signed-in API calls require a valid session token. Profile photos, forum images, and club images are stored in Azure Blob Storage.

No internet service is completely secure. You are responsible for keeping your password private. Because the session token is stored in the browser, you should not use a shared device without signing out, and you should treat the Site like any other logged-in web app.

Meetings you arrange through the Site, and club meetings, happen in the real world. Other members will see the location details you choose to share. Take your own precautions when meeting people you first contacted online.

13. Changes

We may update this policy when the Site changes. The “Last updated” date at the top will change. Continued use of the Site after an update means you accept the revised policy. We may also mention significant changes by email or a notice on the Site.

14. Contact

Questions about this policy or your personal data: admin@chaostheorystudios.co