Last updated: 9 September 2026

Privacy Policy

1. Who We Are

Cadre (“we”, “us”) operates the Service at cadre.gg. This policy explains what personal data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR).

For data protection enquiries: support@cadre.gg

In plain English: this explains what data we collect and why. Short version: as little as possible, only what's needed to run the app.

2. Data We Collect

2.1 Authentication data (via Discord OAuth)

When you sign in, we receive from Discord:

Discord user ID
Username and discriminator
Email address (if granted)
Guild (server) memberships relevant to your clan

We do not receive or store your Discord password.

2.2 Usage data

Clan roster entries (player names, roles, assignments)
Match records and briefing content you create
Map plans, drawings, and scenario data
Feature usage events for product improvement (collected via PostHog)
Session replays of the public /demo sandbox: a recording of the screen and the clicks made in it, so we can see where the sandbox confuses people. Recording starts only in the sandbox, text you type is masked, and replays are deleted after 30 days.

2.3 Billing data

Payment is handled by Lemon Squeezy. We receive confirmation of subscription status but do not store payment card details. Lemon Squeezy's privacy policy applies to payment processing.

2.4 Technical data

IP address and browser user agent (server logs, retained 30 days)
Session tokens (stored as secure cookies)

In plain English: we collect your Discord identity for login, the content you create (rosters, briefings, maps), and basic technical logs deleted after 30 days. We never see your credit card. That goes straight to Lemon Squeezy.

3. How We Use Your Data

Purpose	Legal basis
Operate and authenticate the Service	Contract (Art. 6(1)(b))
Store clan and match data you create	Contract (Art. 6(1)(b))
Process subscription billing	Contract (Art. 6(1)(b))
Improve the Service	Legitimate interest (Art. 6(1)(f))
Comply with legal obligations	Legal obligation (Art. 6(1)(c))

We do not sell your data to third parties. We do not use your data for advertising.

In plain English: your data is used to run and improve Cadre. No selling, no ads.

4. Data Sharing

We share data only as necessary to operate the Service:

Supabase: database and authentication infrastructure (EU region)
Lemon Squeezy: subscription billing
Vercel: hosting and edge delivery
Discord: OAuth authentication only
PostHog: product analytics and demo session replay, EU region (feature usage events tied to your account identifier and Discord display name, so we can recognise per-user activity; we do not send your email address or any content you create)

All processors are bound by data processing agreements.

In plain English: data only goes to the services that keep Cadre running. That means the database (EU), billing, hosting, Discord login, and PostHog for understanding how the app is used.

5. Data Retention

Account and clan data: retained while your account is active, deleted within 30 days of account deletion
Match and briefing data: retained while your clan subscription is active
Server logs: 30 days
Demo session replays: 30 days
Billing records: 7 years (Finnish accounting law requirement)

In plain English: your data lives as long as your account does. Delete your account and it's gone within 30 days, except billing records, which Finnish law requires us to keep for 7 years.

6. Your Rights (GDPR)

Under GDPR you have the right to access, rectify, erase, and port your personal data, as well as the right to object to or restrict certain processing.

To exercise any of these rights, email support@cadre.gg with the subject line “Data request” and describe what you need. We will respond within 30 days.

You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

In plain English: want to see, fix, export, or delete your data? Email support@cadre.gg and we'll handle it within 30 days.

7. Cookies

Cadre uses:

Session cookie: required to keep you logged in (essential, no consent needed)
No advertising or tracking cookies

In plain English: one cookie to keep you logged in. No tracking, no ad cookies.

8. Security

We use industry-standard measures including encrypted connections (HTTPS), row-level security in our database, and access controls. No system is perfectly secure; we will notify you of any breach as required by GDPR.

9. Children

Cadre is not directed at children under 16. If you believe a child has provided us data, contact us and we will delete it.

10. Changes

We will notify users of material changes via the in-app announcement system before changes take effect.