Privacy Policy / 隐私政策

Effective Date / 生效日期: 2026-06-01 Last Updated / 最后更新: 2026-11-03 Version / 版本: 1.4

This document is a template based on Crownscribe's planned data practices. Before launch, have a lawyer review for your specific jurisdiction.

本文档基于 Crownscribe 计划的数据实践模板。上线前请律师按你的司法管辖区审核。

---

ENGLISH VERSION

1. Introduction

Welcome to Crownscribe ("we", "us", "our"). Crownscribe is an unofficial companion app for Clash Royale, a game developed by Supercell. This Privacy Policy explains how we collect, use, and protect your personal information.

By using Crownscribe, you agree to the practices described in this policy. If you don't agree, please don't use Crownscribe.

Crownscribe is not affiliated with Supercell. This is critical to understand. We use Supercell's public Royale API but operate independently.

2. Information We Collect

2.1 Information You Provide

• Clash Royale player tag (e.g., #L8Q2YR): You provide this to view your game stats.
• Email address: Required if you sign in with Apple, Google, or email magic link.
• Account name / display name: Optional; defaults to your CR in-game name.
• Notification preferences: Your choices about which push notifications to receive.

2.2 Information We Collect Automatically

• Device identifiers: Anonymous device ID for crash reporting (no IDFA on iOS unless you opt in)
• App usage data: Which screens you visit, how long you use the app (aggregated, no individual tracking)
• Crash reports: Stack traces and device state when the app crashes (via Sentry)
• Push notification tokens: To send you notifications (you control this)

2.3 Information from Third Parties

• Clash Royale data: We fetch public game data (battles, decks, clan info) from Supercell's Royale API using your provided player tag. This data is already public within the game.
• Sign-in providers: If you sign in with Apple/Google, we receive your name and email (you control what's shared at sign-in).

2.4 What We DON'T Collect

• ❌ Your Supercell account credentials (we never see your password)
• ❌ Your real name or address (unless voluntarily shared in support)
• ❌ Your contact list, photos, or files
• ❌ Your location (unless explicitly required for a feature, none in MVP)
• ❌ Biometric data
• ❌ Browsing history outside Crownscribe

2.5 Discord Bot (Optional)

If you use the Crownscribe Discord bot, we store only what its features need:

• Account link (/verify): your Discord user ID and the Clash Royale player tag you proved is yours, plus the time you verified. To prove ownership you give the bot the short-lived API token shown in the game (Settings → More settings → API token). We send it to Supercell's API once to check it and never store it.
• Server settings (/setup, server admins only): the server's ID, the clan tag it follows, the IDs of the channels for war reminders and the clan join / leave log, and which Discord roles match clan roles.

We do not store Discord usernames, avatars, messages or member lists. The bot uses only slash commands and cannot read messages. We use this data only to set roles and post the messages the server asked for, never for analytics or ads.

2.6 Viewer Deck Queues (Optional)

If you send a deck to a streamer's deck queue (on the web or with /submit in Discord), we store the deck and the name you type, and show both to the streamer and the other viewers of that queue. Pick any name you like; it doesn't have to be your real name. We don't store your IP address or Discord username with it. A queue and everything sent to it is deleted 48 hours after its last activity, or at once when the streamer ends it.

3. How We Use Your Information

We use collected information to:

1. Provide the service: Display your CR stats, decks, battles
2. Send notifications: Personal best alerts, weekly recaps, clan war reminders (you choose which)
3. Improve the app: Fix bugs, optimize performance, plan features
4. Communicate with you: Service updates, support responses
5. Comply with law: Respond to legal requests when legally required

4. How We Share Your Information

4.1 Service Providers

We share minimal data with third parties to operate Crownscribe:

Provider	Purpose	Data Shared
Supabase	Authentication	Email, OAuth tokens
Sentry	Crash reporting	Device info, stack traces (no personal data)
Cloudflare	Content delivery, DDoS, Web Analytics	IP address (anonymized)
Umami	Anonymous page-view analytics on the web mirror (no cookies)	Page address, referrer, browser, operating system, device type, country derived from the IP address (the IP address itself is not stored)
Vultr	VPS hosting	Encrypted data at rest
Google AdMob	Display ads in the app	Anonymous device ID (you can opt out)
Google AdSense	Display ads on the web mirror (non-personalized only)	Cookies or similar identifiers, IP address, browser and page information
Firebase Cloud Messaging	Push notifications (Android)	Push token
Apple Push Notification Service	Push notifications (iOS)	Push token

These providers have their own privacy policies and process data only as needed.

4.2 What We DON'T Share

• ❌ We never sell your data
• ❌ We never share for non-Crownscribe marketing
• ❌ We never share with data brokers
• ❌ We never share your data with Supercell

4.3 Public Profile Information

Some of your Crownscribe data may be publicly viewable by other Crownscribe users:

• Your player tag (already public in CR)
• Your CR stats (already public via Royale API)
• Your active clan membership (already public)

This is the same data anyone can see in-game or via Supercell's official API. We just present it nicely.

5. Your Rights

You have the following rights regarding your data:

5.1 Access

You can view all data we have about you in the app's Settings → Privacy.

5.2 Export

You can request a JSON export of all your Crownscribe data: Settings → Privacy → Export My Data.

5.3 Delete

You can delete your account: Settings → Privacy → Delete My Account. This permanently removes:

• Your account from Crownscribe
• All your custom settings
• Your stored tracked players list
• Your push tokens

Note: Public game data (battles, decks) may persist in aggregated form for meta calculations (anonymized).

Discord bot: run /unlink to delete your account link at once. A server's settings are deleted when the bot is removed from the server or an admin runs /setup reset.

5.4 Correct

If any data is inaccurate, contact us at privacy@analogkit.app.

5.5 Opt-Out

• Ads: Settings → Privacy → Non-personalized ads
• Web ads: Block or delete cookies in your browser; in the EEA, UK and Switzerland, also through the privacy settings link on the web mirror (see Section 8)
• Push notifications: System settings or Settings → Notifications
• Analytics: Settings → Privacy → Disable analytics

5.6 Regional Rights

• EU (GDPR): You can request access, rectification, erasure, restriction, portability, and object to processing
• California (CCPA): You can request what we collect, deletion, and opt-out of sale (we don't sell, ever)
• Brazil (LGPD): Similar rights to GDPR
• China: We comply with applicable PIPL rules; data is processed outside China

6. Data Security

We take reasonable measures to protect your data:

• Encryption in transit: All data transferred via HTTPS/TLS
• Encryption at rest: Sensitive data encrypted in our database
• Limited access: Only the developer (solo) has database access
• Regular backups: Daily encrypted backups
• Authentication: We use Supabase Auth (industry-standard)
• Monitoring: Sentry alerts us to security issues

However, no system is 100% secure. If a breach occurs that affects you, we'll notify you within 72 hours.

7. Children's Privacy

Crownscribe is not intended for children under 13 (or 16 in EU). We don't knowingly collect data from children. If we discover a user is under the age limit, we delete their account.

If you're a parent and believe your child has provided us data, contact privacy@analogkit.app.

The web mirror has no sign-in and no age check, so it shows every visitor non-personalized ads only (Section 8). Ads are never chosen from a profile of the visitor.

8. Cookies & Tracking (Web)

The Crownscribe mobile app doesn't use cookies. Our web mirror (crownscribe.com) uses minimal cookies:

• Essential: For session management (cannot be disabled)
• Analytics: Cloudflare Web Analytics and Umami. Neither sets cookies, stores your IP address or builds a profile of you. They count page views, where visitors come from, and their country and device type; Umami also counts a few button clicks (looking up a player tag, copying a deck, changing the language). Content blockers stop both, and you can block static.cloudflareinsights.com and cloud.umami.is in your browser.
• Advertising: Player profile and leaderboard pages show ads served by Google AdSense.
  • We request non-personalized ads only, for every visitor. Google does not use your browsing history or an advertising profile to choose them. They are chosen from context, such as the page's content and your approximate location (city level, from your IP address).
  • Google may still use cookies or similar technologies for frequency capping, aggregated ad reporting, and preventing fraud and abuse.
  • Visitors in the EEA, the UK and Switzerland are asked for consent through Google's consent message before advertising cookies are used. You can change that choice at any time through the privacy settings link on the page.
  • How Google uses information from sites that show its ads: https://policies.google.com/technologies/partner-sites
  • Ads appear after the stats on a page, are labelled "Advertisement", and never hide or gate any stats. Our legal pages carry no ads.

9. International Data Transfer

We're based in Singapore/Hong Kong, with primary infrastructure in the United States (Vultr Atlanta) and Cloudflare's global edge network. Your data may be processed in:

• USA (Vultr Atlanta — primary application database & crawler; plus Supabase Auth, Sentry, Firebase)
• Google's global infrastructure (AdMob in the app, AdSense on the web mirror), under Google's own transfer safeguards
• EU (Cloudflare edge cache for EU users; transient, not the system of record)

The United States does not benefit from an EU adequacy decision, and our self-hosted Vultr server is not certified under the EU–US Data Privacy Framework. For users in the EU, UK, and other regions with transfer restrictions, we rely on Standard Contractual Clauses together with a transfer impact assessment as the safeguard for transferring your data to the United States. You may contact our DPO (dpo@analogkit.app) for a summary of these safeguards.

10. Changes to This Policy

We may update this policy. When we do:

• We'll update "Last Updated" at the top
• For material changes, we'll notify you via app push and email
• Continued use after changes constitutes acceptance

11. Disclaimer About Supercell

Crownscribe is unofficial fan-made content.

"This content is not affiliated with, endorsed, sponsored, or specifically approved by Supercell and Supercell is not responsible for it. For more information see Supercell's Fan Content Policy: www.supercell.com/fan-content-policy"

We use Supercell's public Royale API under their terms. Your Clash Royale account and game data are governed by Supercell's own Privacy Policy, which we have no control over.

12. Contact Us

Email: privacy@analogkit.app Support: support@analogkit.app

For GDPR-specific inquiries, contact our Data Protection Officer at dpo@analogkit.app.

---

中文版

1. 引言

欢迎使用 Crownscribe ("我们")。Crownscribe 是为 Supercell 开发的游戏《Clash Royale》(部落冲突: 皇室战争) 提供的非官方助手 App。本隐私政策说明我们如何收集、使用和保护你的个人信息。

使用 Crownscribe 即表示你同意本政策描述的实践。如不同意,请勿使用 Crownscribe。

Crownscribe 与 Supercell 无任何关联。这一点至关重要。我们使用 Supercell 的公开 Royale API,但独立运营。

2. 我们收集的信息

2.1 你提供的信息

• Clash Royale 玩家 tag (如 #L8Q2YR): 你提供以查看游戏数据
• 邮箱地址: 通过 Apple、Google 或邮箱魔法链接登录时需要
• 账号名/显示名: 可选;默认使用你的 CR 游戏内名字
• 通知偏好: 你选择接收哪些推送通知

2.2 自动收集的信息

• 设备标识: 用于崩溃报告的匿名设备 ID (iOS 上无 IDFA 除非你选择加入)
• App 使用数据: 你访问哪些屏幕、使用 App 时长 (汇总,无个人追踪)
• 崩溃报告: App 崩溃时的堆栈和设备状态 (通过 Sentry)
• 推送通知 token: 用于向你发送通知 (你控制)

2.3 来自第三方的信息

• Clash Royale 数据: 我们通过你提供的玩家 tag 从 Supercell Royale API 获取公开游戏数据 (对战、卡组、部落信息)。这些数据在游戏内已公开
• 登录提供商: 如使用 Apple/Google 登录, 我们收到你的名字和邮箱 (登录时你控制分享内容)

2.4 我们不收集的信息

• ❌ 你的 Supercell 账号凭证 (我们从不接触密码)
• ❌ 你的真名或住址 (除非你在客服中自愿分享)
• ❌ 你的联系人、照片或文件
• ❌ 你的位置 (除非某功能明确需要, MVP 中无)
• ❌ 生物识别数据
• ❌ Crownscribe 外的浏览历史

2.5 Discord 机器人 (可选)

如果你使用 Crownscribe Discord 机器人, 我们只存它的功能需要的数据:

• 账号关联 (/verify): 你的 Discord 用户 ID、你证明属于你的 Clash Royale 玩家 tag, 以及验证时间。为证明所有权, 你需要把游戏里显示的短时 API token (设置 → 更多设置 → API token) 交给机器人。我们只把它发给 Supercell 的 API 校验一次, 从不保存
• 服务器设置 (/setup, 仅服务器管理员): 服务器 ID、它关注的部落 tag、部落战提醒和成员进出记录所用频道的 ID, 以及哪些 Discord 身份组对应部落职位

我们不保存 Discord 用户名、头像、消息或成员列表。机器人只用斜杠命令, 读不到消息。这些数据只用于设置身份组和发送服务器要求的消息, 从不用于分析或广告。

2.6 观众卡组队列 (可选)

如果你把卡组投进主播的卡组队列 (网页上或 Discord 的 /submit), 我们保存这副卡组和你填的名字, 并展示给主播和这个队列的其他观众。名字随你填, 不必是真名。我们不随之保存你的 IP 地址或 Discord 用户名。队列和投进去的所有内容在最后一次活动 48 小时后删除, 主播结束队列时立即删除。

3. 我们如何使用你的信息

收集的信息用于:

1. 提供服务: 展示你的 CR 数据、卡组、对战
2. 发送通知: 个人最高警报、周报、部落 War 提醒 (你选择哪些)
3. 改进 App: 修复 bug、优化性能、规划功能
4. 与你沟通: 服务更新、客服回复
5. 遵守法律: 法律要求时回应法律请求

4. 我们如何分享你的信息

4.1 服务提供商

我们与第三方分享最少数据以运营 Crownscribe:

提供商	用途	分享数据
Supabase	身份验证	邮箱、OAuth token
Sentry	崩溃报告	设备信息、堆栈 (无个人数据)
Cloudflare	内容分发、DDoS、Web Analytics	IP 地址 (匿名化)
Umami	Web 镜像的匿名浏览统计 (不使用 cookies)	页面地址、来源页面、浏览器、操作系统、设备类型、由 IP 推断的国家 (不保存 IP 地址本身)
Vultr	VPS 托管	静态加密数据
Google AdMob	App 内展示广告	匿名设备 ID (你可拒绝)
Google AdSense	Web 镜像展示广告 (仅非个性化)	Cookies 或类似标识、IP 地址、浏览器与页面信息
Firebase Cloud Messaging	推送通知 (Android)	推送 token
Apple Push Notification Service	推送通知 (iOS)	推送 token

这些提供商有自己的隐私政策,按需处理数据。

4.2 我们不分享的

• ❌ 我们从不出售你的数据
• ❌ 我们从不分享用于非 Crownscribe 营销
• ❌ 我们从不分享给数据中介
• ❌ 我们从不与 Supercell 分享你的数据

4.3 公开档案信息

你的部分 Crownscribe 数据可能被其他 Crownscribe 用户公开查看:

• 你的玩家 tag (在 CR 中已公开)
• 你的 CR 数据 (通过 Royale API 已公开)
• 你的活跃部落成员身份 (已公开)

这些是相同数据,任何人都能在游戏内或通过 Supercell 官方 API 看到。我们只是更优雅地呈现。

5. 你的权利

你对自己的数据享有以下权利:

5.1 访问

你可以在 App 的 设置 → 隐私 中查看我们持有的所有你的数据。

5.2 导出

你可以请求 JSON 格式的所有 Crownscribe 数据导出: 设置 → 隐私 → 导出我的数据。

5.3 删除

你可以删除账号: 设置 → 隐私 → 删除我的账号。这将永久移除:

• 你的 Crownscribe 账号
• 所有自定义设置
• 存储的追踪玩家列表
• 你的推送 token

注意: 公开游戏数据 (对战、卡组) 可能以聚合形式保留用于 meta 计算 (匿名化)。

Discord 机器人: 运行 /unlink 立即删除你的账号关联。机器人被移出服务器、或管理员运行 /setup reset 时, 该服务器的设置随之删除。

5.4 更正

如有任何数据不准确, 请联系 privacy@analogkit.app。

5.5 拒绝

• 广告: 设置 → 隐私 → 非个性化广告
• Web 广告: 在浏览器中屏蔽或删除 cookies; 欧洲经济区、英国和瑞士的访客还可通过 Web 镜像上的隐私设置链接更改 (见第 8 节)
• 推送通知: 系统设置或 设置 → 通知
• 分析: 设置 → 隐私 → 禁用分析

5.6 区域权利

• 欧盟 (GDPR): 你可请求访问、更正、删除、限制、可携性,并反对处理
• 加州 (CCPA): 你可请求我们收集了什么、删除、拒绝出售 (我们永不出售)
• 巴西 (LGPD): 类似 GDPR 的权利
• 中国: 我们遵守适用的 PIPL 规则;数据在中国境外处理

6. 数据安全

我们采取合理措施保护你的数据:

• 传输加密: 所有数据通过 HTTPS/TLS 传输
• 静态加密: 敏感数据在数据库中加密
• 访问受限: 仅开发者 (单人) 有数据库访问
• 定期备份: 每日加密备份
• 身份验证: 我们使用 Supabase Auth (行业标准)
• 监控: Sentry 提醒我们安全问题

但无系统 100% 安全。如发生影响你的泄露, 我们将在 72 小时内通知你。

7. 儿童隐私

Crownscribe 不面向 13 岁以下儿童 (欧盟为 16 岁)。我们不有意收集儿童数据。如发现用户在年龄限制以下, 我们将删除其账号。

如你是父母且认为孩子向我们提供了数据, 请联系 privacy@analogkit.app。

Web 镜像没有登录, 也不做年龄确认, 因此对所有访客只展示非个性化广告 (见第 8 节), 广告从不依据访客画像投放。

8. Cookies & 追踪 (Web)

Crownscribe 移动 App 不使用 cookies。我们的 Web 镜像 (crownscribe.com) 使用最少 cookies:

• 必要: 用于会话管理 (不可禁用)
• 分析: Cloudflare Web Analytics 和 Umami。两者都不设置 cookies、不保存你的 IP 地址、不建立个人画像。它们统计页面浏览量、访客从哪里来、所在国家和设备类型; Umami 还统计少数按钮点击 (查询玩家 tag、复制卡组、切换语言)。内容拦截插件会屏蔽两者, 你也可以在浏览器中屏蔽 static.cloudflareinsights.com 和 cloud.umami.is。
• 广告: 玩家资料页和排行榜页展示由 Google AdSense 投放的广告。
  • 我们对所有访客只请求非个性化广告。Google 不会用你的浏览记录或广告画像来挑选广告, 而是依据上下文, 例如页面内容和你的大致位置 (根据 IP 地址, 精确到城市)。
  • Google 仍可能使用 cookies 或类似技术, 用于控制展示频次、汇总广告报表, 以及防范欺诈和滥用。
  • 欧洲经济区、英国和瑞士的访客, 会在使用广告 cookies 之前通过 Google 的同意弹窗征求同意。你可以随时通过页面上的隐私设置链接更改选择。
  • Google 如何使用展示其广告的网站上的信息: https://policies.google.com/technologies/partner-sites
  • 广告位于页面数据之后, 标有 "Advertisement", 不会遮挡任何数据, 也不会以看广告作为查看数据的条件。法律页面不展示广告。

9. 国际数据传输

我们位于新加坡/香港, 主要基础设施在美国 (Vultr Atlanta) 和 Cloudflare 全球边缘网络。你的数据可能在以下地区处理:

• 美国 (Vultr Atlanta —— 主应用数据库与爬虫; 另含 Supabase Auth、 Sentry、Firebase)
• Google 的全球基础设施 (App 内的 AdMob、Web 镜像上的 AdSense), 适用 Google 自己的数据传输保障措施
• 欧盟 (Cloudflare 为欧盟用户提供的边缘缓存; 临时性, 非数据存储系统)

美国不享有欧盟充分性认定, 且我们自建的 Vultr 服务器未通过 EU–US Data Privacy Framework 认证。对欧盟、英国及其他有传输限制地区的用户, 我们以 标准合同条款 (SCCs) 配合传输影响评估作为向美国传输你数据的保障措施。 你可联系数据保护官员 (dpo@analogkit.app) 获取这些保障措施的说明。

10. 本政策的变更

我们可能更新本政策。届时:

• 我们将更新顶部的"最后更新"
• 对重大变更, 我们将通过 App 推送和邮件通知你
• 变更后继续使用即表示接受

11. 关于 Supercell 的免责声明

Crownscribe 是非官方粉丝制作内容。

"本内容并非由 Supercell 关联、认可、赞助或特别批准, Supercell 对其不负责。详见 Supercell Fan Content Policy: www.supercell.com/fan-content-policy"

我们在 Supercell 条款下使用其公开 Royale API。你的《Clash Royale》账号和游戏数据受 Supercell 自己的隐私政策管辖, 我们无法控制。

12. 联系我们

邮箱: privacy@analogkit.app 客服: support@analogkit.app

GDPR 相关问询, 联系数据保护官员 dpo@analogkit.app。

---

Privacy Policy v1.4 / 隐私政策 v1.4