Elixir Drop Privacy

Your email address is used for one-time magic-link sign-in and occasional player updates. It is never shown on your public profile. Drop stores your chosen player name, favorite-card avatar, game results, total games, per-card practice statistics derived from recorded games—including first-response time and whether choices or a requested hint were used. Those statistics are used only to deal you better practice rounds and are never shown to other players. Drop also stores an optional Clash Royale player tag. All of it is removed when you delete your account.

Magic-link messages come from elixir@poapkings.com.

Drop never sells or rents your email address and never uses it for third-party marketing or advertising. Player update emails include an unsubscribe link.

Leaderboards can show your generated Drop name, favorite card, scores, total games, and attached player tag. When you attach a tag, Drop also shows public Clash Royale clan, card collection, and account-age data. Card levels, trophies, arenas, and experience level are not shown.

• AWS runs the API and stores profiles and scores.
• Fastmail sends sign-in emails.
• Buttondown sends occasional player updates and manages unsubscribes and delivery suppression.
• Tinylytics receives cookie-free aggregate site visits and named product events with broad game-mode or platform labels. For events confirmed by the API, Drop forwards your connection IP address and browser user-agent so Tinylytics can associate the outcome with the same anonymous visit and derive country and browser context. Drop does not store or log those raw values for analytics. Tinylytics says it discards raw IPs after country lookup, may use IPinfo when its local lookup cannot resolve a country, and removes user-agent strings after seven days. Drop never sends Tinylytics your email, public player name, player tag, score, run ID, or session token.
• A private Discord operator log receives compact login and completed-game events using your public Drop identity, never your full email address.
• Supercell’s Clash Royale API supplies public data for an optional player tag.

To keep leaderboards honest, Drop derives non-reversible fraud-prevention signals from connection metadata on a recorded game. It does not store the raw IP address or full browser user-agent for Fair Play; they become one-way, salted fingerprints and coarse browser and operating-system families.

Ranked games also record coarse input evidence: when each answer became available, when it was submitted, whether it came from a pointer or keyboard-like action, and whether the browser marked the event as trusted. Drop does not record pointer coordinates, pressure, pointer identity, or the key pressed.

Automatic checks may start review of a leading or technically unusual result. They never make the final decision. Review evidence and private reasons are not published.

Each recorded run can publish one permanent link with a server-rendered score image and a small public result snapshot. The same link is returned every time and can be created from the finish screen or later from your run Log. The snapshot and image remain until you delete your account; a Fair Play exclusion makes them unavailable.

A shared run shows your public Drop name, favorite card, arena, mode, score, completion date, and a bounded chart derived from the validated game record. Drop counts only the landing page’s browser callback toward Herald—not link-preview HTML or image requests. The callback is deduplicated through a one-way, salted request fingerprint; Drop does not store the raw IP address or full browser user-agent, your own device is not counted, and credit per run stops at a fixed cap. Home and badge invitations do not count toward Herald.

Opening a valid shared run or invitation stores either its public player-and-run IDs or its six-character invitation token in that browser for up to 30 days. If that attribution leads to a genuinely new account, Drop credits one Recruiter milestone to the sharer when the new player completes sign-in and creates the account. The relationship is private, and the attribution is consumed when the login email is requested.

Magic links and signed run challenges expire quickly. Application logs are retained for 30 days. Your active profile and scores remain until you delete the account from your player profile.

Account deletion removes your email, Drop identity, saved tag association, game history, leaderboard entries, published share snapshots and images, and any links you shared from the active database, and removes the matching Buttondown player-update subscription. Anonymous aggregate Trophy Road totals remain. Encrypted recovery backups and private operator event history may take longer to age out.

Email drop@poapkings.com.