Privacy Policy

Last updated: October 21, 2026

Collector Coach is a fan-made tool that reads the public roster of a game account from its ally code and turns it into a report. You do not need an account and we never ask for your game login. This policy explains what we handle when you use this website.

1. Who is responsible

The data controller is Ives Laurent, based in Mexico City, Mexico. For anything related to your data write to [email protected].

2. What we handle and why

The ally code you type
What for:
Look up the public roster and build your report. The report address includes it (/r/…), so anyone you share the link with can open it.
Legal basis:
Providing the service you ask for; legitimate interest
Public roster data: player name, guild name, characters, ships, stars, gear and relic levels
What for:
Build the report. This is public game data: anyone who knows an ally code can see it in the game and in community tools.
Legal basis:
Providing the service; legitimate interest
Guild tab: the public rosters of the members of the guild of the ally code you type (name, galactic power, legendaries unlocked and close)
What for:
Show who can help with your goals, how ready the guild is for Territory Battle special missions, and which legendaries the guild has. Other members’ ally codes are never shown.
Legal basis:
Providing the service; legitimate interest
Waitlist: email, ally code (optional), language, the page where you signed up, the date, and whether you confirmed or left the list
What for:
Write to you once, when early access to the coach opens. First we send one email asking you to confirm the address.
Legal basis:
Your consent (the checkbox, confirmed by the email)
Anonymous visit measurement (section 3)
What for:
Count visits, see which parts of the report help and fix what fails.
Legal basis:
Legitimate interest
Google Analytics cookies, only if you accept them
What for:
Aggregate site statistics.
Legal basis:
Your consent (the cookie banner)
Emails you send us
What for:
Answer you and handle your request.
Legal basis:
Legitimate interest; legal obligation for rights requests

Data we handle
Data	What for	Legal basis
The ally code you type	Look up the public roster and build your report. The report address includes it (/r/…), so anyone you share the link with can open it.	Providing the service you ask for; legitimate interest
Public roster data: player name, guild name, characters, ships, stars, gear and relic levels	Build the report. This is public game data: anyone who knows an ally code can see it in the game and in community tools.	Providing the service; legitimate interest
Guild tab: the public rosters of the members of the guild of the ally code you type (name, galactic power, legendaries unlocked and close)	Show who can help with your goals, how ready the guild is for Territory Battle special missions, and which legendaries the guild has. Other members’ ally codes are never shown.	Providing the service; legitimate interest
Waitlist: email, ally code (optional), language, the page where you signed up, the date, and whether you confirmed or left the list	Write to you once, when early access to the coach opens. First we send one email asking you to confirm the address.	Your consent (the checkbox, confirmed by the email)
Anonymous visit measurement (section 3)	Count visits, see which parts of the report help and fix what fails.	Legitimate interest
Google Analytics cookies, only if you accept them	Aggregate site statistics.	Your consent (the cookie banner)
Emails you send us	Answer you and handle your request.	Legitimate interest; legal obligation for rights requests

To read a roster, our server asks the game's servers for the public profile of that ally code through Comlink, a community tool we run on our own server. We do not ask for, receive or store game passwords, and we never act on any game account.

2b. The waitlist, step by step

You type your email and tick the box. That saves a pending signup and sends you one email asking you to confirm the address.
You are only on the list once you open the link in that email. The link works for 7 days, and you can ask for a new one by signing up again.
If you never confirm, the address is deleted within 30 days and we never write to it. Nothing else is done with it in the meantime.
Every email we send carries a link to leave the list. One click is enough: no login, no reply, no form. You can also write to [email protected].
The link carries a random code, and only a one-way version of that code is stored, so nobody who reads our database can rebuild the link. The code is replaced each time we send a new email.

3. Visit measurement that does not identify you

We count visits ourselves, without cookies. For each event (for example, a page view, a report viewed or a waitlist signup) we keep: the event name, the page path, the domain you came from (never the full address), the campaign tags of the link you used, the test variant if one is running, the country reported by Cloudflare, the device type (mobile, tablet or desktop) and a few small details such as how many legendaries are pending.

We do not store your IP address, your full browser string, your name or your email.
To count distinct visitors within one day, your IP and browser string are turned into a one-way code with a secret key that changes every day (UTC). The key is deleted after one day, so a visit today cannot be linked to you or to your visits on other days.
Report pages are recorded as /r/:code, without the ally code. If an event carries an ally code, it is kept only as a code made with that same daily key.
Visits from known bots are not recorded by this counter.

Our server also keeps its own technical record of every free report it builds: the date, how it went (served, ally code not found, empty roster, error), whether the caller was a browser, a crawler or a script, how many units the roster had, the same daily visitor code described above and the ally code as a code made with that same daily key. This record exists because the counter above only sees visitors whose browser runs JavaScript, so without it a crawler pulling reports looks exactly like nothing at all. It holds no IP address and no browser string.

We also use Cloudflare Web Analytics, which counts page views without cookies and without storing anything on your device. Google Analytics is separate and loads only if you accept it. Details on the Cookie Policy.

4. Artificial intelligence

The free report does not use artificial intelligence. When the AI coach opens to the public (chat and plans), the roster of the ally code you use and the messages you write will be sent, as processors, to the AI providers that generate the answers: OpenAI, Google (Gemini) and Anthropic. We will update this policy, including how long conversations are kept, before that happens.

When a chat turn is blocked (limits, off-topic or unsafe content) we keep only the type of event, never the message, for 90 days.

5. Who else takes part

Cloudflare: content delivery, proxy and protection against attacks. It handles your IP to deliver the site, tells us your country and gives us cookieless page-view statistics (Cloudflare Web Analytics).
Hosting: a server operated by the owner in Mexico, where the app and its database run.
Resend: delivers the waitlist emails. It receives the address and the message so it can hand them to your mail provider, as our processor.
Google (Google Analytics 4): only if you accept analytics cookies.
The game's servers (Electronic Arts / Capital Games): receive the ally code when we read a public profile.
OpenAI, Google and Anthropic: only for the AI coach, once it opens (section 4).

There are no ads on this site today; if that changes we will update this policy and the cookie banner first. We do not sell your data or share it with data brokers.

6. International transfers

Some of these providers process data in the United States and other countries. We use them because the service needs them, and we choose providers that offer contractual safeguards for personal data (such as standard contractual clauses).

7. How long we keep it

Visit measurement events
Kept for:
13 months, then deleted automatically
Daily key used for visitor codes
Kept for:
1 day
Blocked chat events (type only)
Kept for:
90 days
Roster copy of an ally code
Kept for:
Refreshed when a report is requested; the last copy is kept to show the report when the game servers do not answer, and deleted after 30 days without use or on request. A guild summary is kept for one day.
Waitlist signup you never confirmed
Kept for:
30 days, then deleted automatically
Confirmed waitlist entry
Kept for:
Until early access opens and we write to you, or until you leave the list, whichever comes first
Waitlist entry you left
Kept for:
Kept marked as "do not write", so a later mailing cannot reach you by mistake, and deleted when early access opens
Google Analytics data
Kept for:
As set in our GA4 property: 14 months
Emails with requests
Kept for:
As long as needed to answer and to show we did

Retention
Data	Kept for
Visit measurement events	13 months, then deleted automatically
Daily key used for visitor codes	1 day
Blocked chat events (type only)	90 days
Roster copy of an ally code	Refreshed when a report is requested; the last copy is kept to show the report when the game servers do not answer, and deleted after 30 days without use or on request. A guild summary is kept for one day.
Waitlist signup you never confirmed	30 days, then deleted automatically
Confirmed waitlist entry	Until early access opens and we write to you, or until you leave the list, whichever comes first
Waitlist entry you left	Kept marked as "do not write", so a later mailing cannot reach you by mistake, and deleted when early access opens
Google Analytics data	As set in our GA4 property: 14 months
Emails with requests	As long as needed to answer and to show we did

8. Your rights

Wherever you live you can ask us to access, correct or delete your data, to stop using it, or to withdraw a consent you gave. Leaving the waitlist needs no request at all: the link at the bottom of every email we send does it in one click.

European Union and United Kingdom (GDPR): access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and the right to complain to your data protection authority.
Mexico (LFPDPPP): ARCO rights (access, rectification, cancellation and opposition), revocation of consent and limiting the use or disclosure of your data.

Write to [email protected] with the subject "Privacy request" (or "ARCO"), saying what you want and which email or ally code it is about. We may ask you to confirm that the email is yours. We answer within the legal deadline: 20 business days under Mexican law and one month under the GDPR.

9. Minimum age

This site is for people aged 13 or older. If you are under 16 in the European Union (or under the age your country sets), ask a parent or guardian before joining the waitlist. If we learn that a child under 13 gave us an email, we delete it.

10. Security

Encrypted connections (HTTPS) and security headers on every page.
Secrets live only in the server environment, never in the site code.
Request limits against abuse, and restricted access to the admin console.
No game credentials are ever requested or stored.

11. Changes

When this policy changes we update the date at the top. If a change affects how we use the waitlist emails, we will tell those people by email before it applies.

12. Contact

Privacy questions and requests: [email protected].