Privacy Policy — Wolves Project

1. Identity of the Data Controller

The data controller for Wolves Project is Samuele Varalli, reachable at [email protected].

Wolves Project is a third-party fan-made dashboard for Clash of Clans clan management. It is not affiliated with, endorsed by, or sponsored by Supercell Oy.

2. Data We Collect

We collect only the minimum data required to provide the service:

Discord ID and username — obtained via Discord OAuth at login.
Clash of Clans player tag — provided voluntarily during onboarding (optional at signup).
Clash of Clans game statistics — war results, rankings, season data, and clan membership history retrieved via the official Clash of Clans API (api.clashofclans.com).
Session data — an opaque refresh token (stored server-side, hashed) and a short-lived JWT access token (15-minute lifetime), both delivered as HttpOnly cookies.
Audit log entries — timestamped records of security-relevant actions (logins, logouts, policy consent).

3. Purposes and Legal Basis

Purpose	Legal basis (GDPR Art. 6)
Authentication via Discord OAuth	Contract (Art. 6(1)(b))
Providing the clan dashboard service	Contract (Art. 6(1)(b))
Linking CoC player identity (optional)	Consent (Art. 6(1)(a))
Security logging and incident response	Legitimate interest (Art. 6(1)(f))
Italian fiscal record-keeping	Legal obligation (Art. 6(1)(c))

4. Data Retention

Session tokens: 30 days per active session; deleted immediately on logout.
Account data (Discord ID, username): retained until you request deletion + 30-day grace period, then anonymized.
Operational audit logs: 18 months.
Financial audit logs: 10 years (Italian fiscal law, D.P.R. 633/1972 art. 22).
Security audit logs: permanent (GDPR Art. 6(1)(f) legitimate interest for breach investigation continuity).

5. Third-Party Processors

Discord Inc. (USA)— OAuth identity provider. Transfer mechanism: Standard Contractual Clauses 2021 + Discord's DPA.
Cloudflare Inc. (USA) — CDN and DDoS proxy. All HTTP traffic transits Cloudflare infrastructure. Transfer mechanism: SCCs + Cloudflare DPA. Mitigation: no PII in cached URLs or headers.
Supercell Oy (Finland, EU) — Clash of Clans API. Player tags are sent; player profile data is received. EU-to-EU transfer; no SCC required.

6. Your Rights (GDPR)

Under the GDPR and Italian privacy law (D.Lgs. 196/2003), you have the following rights:

Access (Art. 15): Request a copy of all personal data we hold about you.
Rectification (Art. 16): Correct inaccurate data via your profile settings.
Erasure (Art. 17): Request deletion of your account. We anonymize PII while retaining the audit chronology (FK-preserving anonymization).
Restriction (Art. 18): Pause processing while contesting accuracy.
Portability (Art. 20): Receive your data in a machine-readable format (JSON/ZIP).
Object (Art. 21): We currently have no direct marketing or profiling — this right is satisfied by the absence of such processing.

To exercise any of these rights, contact [email protected].

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) at www.garanteprivacy.it.

7. Children

Wolves Project is not directed at children under 14 years of age (the minimum age for self-consent under Italian law, D.Lgs. 196/2003 art. 2-quinquies). If you are under 14, you must have your parent's or guardian's consent to use this service.

8. Cookies

We use only essential cookies required for authentication:

wolves_access — short-lived JWT (15 min), HttpOnly, SameSite=Lax.
wolves_refresh — refresh token (30 days), HttpOnly, SameSite=Lax.

We do not use advertising, analytics, or tracking cookies.

9. Supercell Fan Content

This material is unofficial and is not endorsed by Supercell. For more information see Supercell's Fan Content Policy: www.supercell.com/fan-content-policy.

10. Policy Changes

We version all policy changes. Material changes require re-consent at your next session. The current version is v1 — 2026-07-02.

Contact: [email protected]