Privacy Policy

This policy explains what happens to data when you use clashofclanslayouts.com. It is written to be read, not to be skipped. The short version: we have no accounts, we ask for nothing, and almost everything described below comes from advertising and from the ordinary mechanics of serving a web page.

This policy was last updated on the date shown above. When it changes materially we update that date and, where the change affects consent, we ask again through the consent banner.

1. Who is responsible for your data

clashofclanslayouts.com is an independent fan site run by a small group of private individuals. There is no company behind it. We are the controller of the limited personal data described here.

Contact for any privacy matter: [email protected]. Put “Privacy request” in the subject line and we will treat it as one.

We do not publish a postal address, because there is no business premises to publish. If you need one for a formal legal process, write to the address above and we will provide what is required.

The site is not affiliated with, endorsed by or sponsored by Supercell. Supercell has no role in this policy and no access to anything described in it.

2. What we collect

Directly from you: only what you email us. There is no sign-up, no login, no account, no newsletter and no comment system on this site. The only way you can give us personal data is by sending an email or a layout submission. In that case we hold your email address, your name if you sign the message, whatever you chose to write, and, for layout submissions, the display name and optional link you asked us to credit. See the submit page for what we deliberately do not ask for.

Automatically, when your browser loads a page. Our host and the third parties named below process:

• your IP address, which also indicates your approximate location, usually at country or city level;
• your user agent string, meaning browser, operating system and device type;
• the page you requested, the page that referred you, and the date and time;
• technical signals used to distinguish humans from bots and to defend against attacks;
• cookies and similar identifiers, but only as described in section 4.

Stored in your browser, never sent to us. Some features remember things locally on your device using localStorage: your saved favourite layouts, your consent choices, and small interface preferences. This data stays on your device. We cannot read it, it is not transmitted anywhere, and clearing your browser data deletes it.

What we do not collect at all: payment details, government identifiers, precise GPS location, biometric data, contacts, and any information about your Clash of Clans account. We never ask for your Supercell ID or any game credentials, and any message that does is not from us.

3. Third parties involved

We keep this list short on purpose. Each entry says who they are and why they are here.

Cloudflare. The site is hosted and served through Cloudflare’s network. Cloudflare processes your IP address, request headers and connection metadata to deliver pages, cache them near you, and block attacks and abusive traffic. This is technically necessary to serve the site and cannot be switched off while still loading the page. Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/.

Google AdSense (Google LLC and, for users in Europe, Google Ireland Limited). Advertising on this site is served by Google. Google and its advertising partners use cookies, device identifiers and IP addresses to serve, measure and, where you have consented, personalise ads. Google’s description of how it uses data from sites that use its services is here: https://policies.google.com/technologies/partner-sites. Google’s privacy policy: https://policies.google.com/privacy.

Google Analytics 4 (Google LLC and, for users in Europe, Google Ireland Limited). We use Google Analytics 4 (measurement ID G-DWHP1LBJDS, G-8SSK7WXNJF) to understand which pages are useful and where the site is failing people. It sets first-party analytics cookies, named _ga and _ga_<ID>, to count visits and sessions, and it processes your IP address, device and browser details and the pages you view according to Google’s own settings for the product. We do not send your name, email address or any other directly identifying information to Google Analytics. Google’s privacy policy: https://policies.google.com/privacy. You can block Google Analytics in any browser with Google’s opt-out add-on: https://tools.google.com/dlpage/gaoptout.

Our consent management platform (CMP). Once advertising is switched on, for visitors in the European Economic Area, the United Kingdom and Switzerland, a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework presents the consent banner, records your choices, and passes them to Google through Consent Mode. The CMP stores your choices in your browser so it does not have to ask again on every page.

That is the complete list. There are no social widgets, no embedded videos, no comment platform, no chat widget, no heatmap tool, no A/B testing service and no advertising network other than Google’s.

4. Cookies and similar technologies

Cookies fall into three groups here.

Strictly necessary. Set by Cloudflare for security and load balancing, and by the CMP to remember your consent choices. These are required for the site to work and are used on the basis of our legitimate interest in serving a secure, functioning site. They are not used to profile you.

Advertising. Set by Google and its partners when ads are served, to deliver ads, limit how often you see the same ad, measure performance, and personalise ads where you have allowed it. In the EEA, the UK and Switzerland these are set only after you consent.

Analytics. Set by Google Analytics 4 (_ga and _ga_<ID>, kept for up to two years) to count visits and see which pages are read. They do not identify you by name. Once the consent banner is live, visitors in the EEA, the UK and Switzerland will be asked before these are set.

As Google requires us to state plainly:

Third party vendors, including Google, may be placing and reading cookies on your browser, or using web beacons or IP addresses, to collect information as a result of ad serving on this site.

Changing your mind. Once the consent banner is live, use the Cookie settings link it adds to the footer of every page to reopen the consent banner and change or withdraw your choices at any time. Withdrawal is as easy as consent and takes effect immediately for future ad requests. You can also block or delete cookies in your browser settings; the site will still work, though ads may become less relevant or, in some browsers, less reliable.

5. Why we are allowed to process this data

Under the UK and EU GDPR our legal bases are:

• Consent (Article 6(1)(a)) for advertising cookies and identifiers, for personalised advertising, and for analytics, wherever consent is legally required. You can withdraw consent at any time through Cookie settings.
• Legitimate interests (Article 6(1)(f)) for security, abuse and bot prevention, basic server logging, and keeping the site available. Our interest is in running a site that stays online and is not attacked; the processing is minimal and does not profile you.
• Legitimate interests (Article 6(1)(f)) for handling correspondence and layout submissions you choose to send us, so that we can reply and publish what you asked us to publish.

Where you send us a layout for publication, the credit you ask for is published because you asked for it, and you can withdraw that at any time.

6. Personalised advertising and how to opt out

You can control advertising personalisation independently of this site:

• Google’s own ad settings: https://www.google.com/settings/ads
• Digital Advertising Alliance opt-out (United States): https://optout.aboutads.info/
• Your Online Choices (Europe): https://www.youronlinechoices.com/
• Network Advertising Initiative opt-out: https://optout.networkadvertising.org/

Opting out of personalisation does not remove ads. It makes them less relevant to you.

7. Your rights in the EEA and the UK

You have the right to:

• access the personal data we hold about you and receive a copy;
• rectify data that is inaccurate or incomplete;
• erase your data, sometimes called the right to be forgotten;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests, including profiling;
• portability, meaning to receive data you gave us in a machine-readable form;
• withdraw consent at any time, without affecting processing that already happened on the basis of that consent;
• complain to your local data protection supervisory authority. In the UK that is the Information Commissioner’s Office at https://ico.org.uk/. In the EEA, a list of authorities is at https://edpb.europa.eu/about-edpb/about-edpb/members_en. You are welcome to raise it with us first.

To exercise any of these, email [email protected]. We respond within one month and we do not charge. In practice, the only data we are likely to hold about you is an email exchange, because the site itself stores nothing about you on our side. If we cannot identify you from what you send us, we will say so rather than pretend to delete something we never had.

For data held by Google as a result of advertising, you can also exercise rights directly with Google using the links in section 3.

8. United States privacy rights

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas or another state with a comprehensive privacy law, you have the right to know what personal information is collected about you, to access and delete it, to correct it, to opt out of targeted advertising and of the sale or sharing of personal information, and not to be discriminated against for exercising those rights.

Do Not Sell or Share My Personal Information. We do not sell personal information for money. However, the use of advertising cookies to serve cross-context behavioural advertising is treated as a “sale” or “sharing” under California law and as “targeted advertising” under other state laws. To opt out:

• Use the Cookie settings link in the footer and turn off advertising and personalisation. This is our Do Not Sell or Share mechanism.
• Or enable Global Privacy Control in your browser or extension. We honour Global Privacy Control signals. When your browser sends one, we treat it as a valid opt-out of the sale and sharing of personal information and of targeted advertising, and we apply Google’s restricted data processing so that Google acts as a service provider rather than serving personalised ads to you. You do not need to do anything else, and you do not need to identify yourself.

We do not process sensitive personal information and we do not use personal information for profiling that produces legal or similarly significant effects. We do not knowingly sell or share the personal information of anyone under 16.

9. Children

This site is a strategy reference for a game with players of all ages. It is not directed to children, it has no child-targeted design, and it collects no personal data through any form or account.

You must be at least 13 years old to use this site, and at least 16 years old if you are in the European Economic Area or the United Kingdom, or the lower age set by your own country’s law where one applies. We do not knowingly collect personal information from children under 13, and we do not knowingly serve personalised advertising to anyone we know to be under the applicable age.

If you are a parent or guardian and you believe a child has sent us personal information, email [email protected] with enough detail to find the message. We will delete it and confirm that we have done so. We do not require you to prove anything beyond a plausible description; deleting the message is easier for everyone than arguing about it.

10. How long we keep things

• Email and layout submissions: kept while the correspondence is useful, and reviewed periodically. Rejected submissions are deleted once the exchange is over. Published layout credits stay while the layout is on the site.
• Server and security logs: short-lived, retained by our host for its own operational and security periods, typically days rather than months.
• Advertising and analytics data: retained by Google under its own retention rules, described in Google’s privacy policy.
• Data stored in your browser: stays until you clear it.

11. International transfers

The site is served from a global network, and our advertising and analytics providers are based in or transfer data to the United States. Where personal data of people in the EEA, the UK or Switzerland is transferred outside those areas, the recipients rely on the European Commission’s standard contractual clauses, the UK international data transfer addendum, and, where applicable, the EU-US Data Privacy Framework and its UK and Swiss extensions. Google’s transfer arrangements are described in its own privacy documentation.

12. Security

The site is served over HTTPS. It is a static site with no database of users, no login and no stored payment or account data, which removes most of the ways a site leaks personal information. Email we receive sits in an ordinary mailbox protected by strong authentication. No system is perfectly secure, and we will not pretend otherwise, but there is very little here to lose.

13. Changes to this policy

We update this page when what we do changes, for example when advertising is switched on. The date at the top always reflects the current version. Material changes affecting consent are reflected in the consent banner as well, so you get the chance to decide again rather than finding out by re-reading this page.

14. Contact

Questions, requests and complaints: [email protected]. See also the contact page, the terms and the disclaimer.