Privacy Policy

Introduction

Sleepy Clash ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, and access our API. Please read this policy carefully. If you do not agree with our policies and practices, please do not use our services.

Information We Collect

Account Information

When you register for a Sleepy Clash account, we collect your username, email address, and password (encrypted). You may optionally provide a profile picture, bio, and link your Clash Royale tag for profile features.

API Keys & Usage Data

When you generate API keys in your settings, we store the key hash (not the plain key). We log API requests associated with your key for security and abuse detection purposes, including timestamps, endpoints accessed, and request frequency. This data is retained for 90 days for troubleshooting and analytics.

Player & Clan Lookups

When you search for player tags or clan tags, we temporarily cache results from the official Supercell API. This data is not permanently stored on our servers beyond the current session unless you save it to your profile. We do not create profiles for players without their consent.

Deck Data

Decks you build, rate, or save are stored in your account. Public decks may be indexed and included in our Deck Library. Your saved decks remain private unless you explicitly share them.

Automatic Information

We automatically collect IP address and general location (city/country level), browser type, operating system, device information, pages visited, time spent on site, clickstream data, referral source, and search terms used. This information is collected via server logs and may include analytics from third-party services like Google Analytics.

How We Use Your Information

We use collected information for the following purposes:

• Service Delivery: Create and maintain your account, provide deck analysis, API access, and player lookups.
• Security & Fraud Prevention: Detect abuse, enforce API rate limits, and protect against unauthorized access.
• Improvement: Analyze usage patterns to improve features, fix bugs, and optimize performance.
• Communication: Send account notifications, service updates, and respond to support requests. We do not send marketing emails without consent.
• Legal Compliance: Comply with legal requests, enforce terms, and protect our rights.

Third-Party Data Sharing

We do not sell your data. However, we may share information with trusted partners:

• Supercell API: To fetch player and clan data, we send player tags to Supercell's official API. This is governed by Supercell's privacy policy.
• Analytics Providers: We may use third-party analytics (e.g., Google Analytics) which collects anonymized usage data. Consult their privacy policies.
• Hosting Providers: Our servers are hosted on secure cloud infrastructure. Your data is encrypted in transit and at rest.
• Legal Requirements: We may disclose information if required by law, court order, or government request.

Data Retention

• Account Data: Retained while your account is active. Deleted within 30 days of account deletion.
• API Logs: Retained for 90 days for security purposes, then anonymized or deleted.
• Server Logs: Retained for 14 days.
• Session Data: Cookies expire after 30 days of inactivity.
• Player Searches: Not permanently stored unless saved to your profile.

Your Rights & Choices

You have the right to:

• Access: Download a copy of your data anytime from Settings > Data Export.
• Correction: Update your account information in Settings.
• Deletion: Delete your account and all associated data. This is irreversible.
• Opt-Out: Disable cookies in your browser. Unsubscribe from emails in Settings.
• Portability: Export your decks and profile data in standard formats.

For GDPR or CCPA requests, contact us at privacy@sleepyclash.com with your user ID.

Security Measures

We implement industry-standard security practices:

• HTTPS encryption for all data in transit
• Passwords hashed with bcrypt (salted)
• API keys stored as secure hashes
• Regular security audits and vulnerability testing
• Limited employee access to sensitive data (need-to-know basis)
• Automated backups with encryption

While we strive to protect your information, no method is 100% secure. You are responsible for keeping your password confidential.

International Data Transfers

Our servers are located in the United States. If you access Sleepy Clash from outside the US, your data will be transferred to and stored in the US, which may have different privacy protections. By using our service, you consent to this transfer. For EU/EEA residents, we comply with GDPR standards for data transfers.

Third-Party Links & Services

Sleepy Clash may link to external websites (e.g., Supercell, StatsRoyale). We are not responsible for their privacy practices. Please review their policies before providing information. We also integrate with the official Clash Royale API, which is governed by Supercell's terms.

Changes to This Privacy Policy

We may update this policy to reflect changes in law, technology, or our practices. Updates will be posted on this page with a "Last Updated" date. Material changes will trigger an email notification or prominent notice on the site. Your continued use of Sleepy Clash after changes constitutes acceptance of the updated policy.

Last Updated: October 2025

Contact

If you have questions about this Privacy Policy or our data practices:

• In-App: /support

We will respond to privacy inquiries within 7 business days.