Privacy policy

Last updated October 26, 2026

Clan War Stats ("we", "us") is an independent, unofficial fan site for Clash of Clans, available at clanwarstats.com. This page explains what we collect, why, how cookies and advertising work here, and the choices you have. Questions: matthewzimmers@gmail.com.

What we store

• Your account: your email address and a salted, one-way hash of your password (we never store the password itself). If you change your email or password we update these. If you sign up with Google you may have no password at all until you set one.
• Sign in with Google (optional): if you choose it, Google tells us a unique, stable ID for your Google account, your email address, whether Google has verified that email, and your name. We store the ID, email and name with your account so you can sign in again, and when you linked it. We ask Google only for basic sign-in information (the openid, email and profile scopes): we never see your Google password and get no access to your Gmail, contacts, Drive or anything else in your Google account. You can unlink Google on your account page at any time (once you have another way to sign in), and you can also remove Clan War Stats's access at myaccount.google.com/connections. If your Google email matches an existing Clan War Stats account, we only link the two after you enter that account's password.
• Linked game accounts: the Clash of Clans player tags you verify, with the player's name, clan, in-game role and Town Hall level at the time of linking.
• Sign-in sessions: for each signed-in device, a random session identifier (stored only as a hash), when it was created and last used, its IP address and browser user-agent. You can see and end these on your account page. Sessions expire after 30 days.
• Security log: a record of security-relevant actions (sign-ins, failed sign-ins, linking accounts, creating invites, admin actions) with time, account and IP address, used to protect accounts and investigate abuse.
• Invite links: leaders' invite links (stored as hashes) with their expiry, use count and which accounts used them.
• Public game data: for clans that are tracked, data published by Supercell's official Clash of Clans API: clan details, member names, tags, roles, Town Hall, hero and troop levels, trophies, donations, war and Clan War League attacks, and Clan Capital raid results. This data is public in the game; we store it to build each clan's history and show it to that clan's signed-in members.

When you link a game account, the one-time API token you paste is sent to Supercell's API to confirm ownership and is not stored. We don't ask for your Supercell ID, game password, real name, address or payment details.

How we use it

To run the site: sign you in, show your clan's stats to you and your clanmates according to your in-game role, keep accounts secure, prevent abuse (for example rate-limiting sign-in attempts), and, if ads are enabled, show ads that pay for hosting. We don't sell your personal information and we don't share your email with advertisers.

Cookies

Essential cookies (always on, because the site can't work without them):

• __Host-cws_session keeps you signed in (up to 30 days, or until you sign out).
• __Host-cws_csrf protects forms against cross-site request forgery.
• cws_consent remembers whether you accepted or declined non-essential cookies (6 months).
• Two short-lived cookies (2 minutes) show a newly created invite or password-reset link once to the leader or admin who created it.
• __Host-cws_oauth and __Host-cws_sso_pending (10 minutes, only while you sign in with Google) hold a signed, random one-time value that ties Google's reply to your browser and protects the sign-in against forgery.

Advertising cookies (only with your consent): if ads are shown on this site, they are served by Google AdSense. Google and its partners use cookies and similar identifiers to serve ads, to personalise them based on your visits to this and other websites, to limit how often you see an ad, and to measure ad performance and prevent fraud. In the European Economic Area, the UK and Switzerland, ad scripts and advertising cookies are not loaded until you agree; on this site we wait for your consent everywhere. You can change your choice at any time with Cookie settings (also in the footer of every page).

Google AdSense and third-party ads

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet. You can learn more and control this here:

• Opt out of personalised advertising, or change how Google personalises ads: Google Ads Settings (My Ad Center).
• How Google uses information from sites that use its services.
• How Google uses cookies in advertising and Google's Privacy Policy.
• Opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info or, in Europe, youronlinechoices.eu.

If you decline advertising cookies, the site works exactly the same; we just don't load ads for you.

Who else handles data

• Supercell provides the Clash of Clans API we read game data from and verify account ownership with.
• Hostinger hosts the server the site and its database run on.
• Google, only if ads are enabled and you consent, as described above, and, separately, when you choose to sign in with Google (see "Sign in with Google" above; Google's handling is covered by Google's Privacy Policy).

We may disclose information if required by law or to protect the site and its users from abuse.

How long we keep it

Account data is kept while your account exists. Sessions stop working after 30 days or when you sign out, and password-reset links stop working after first use or when they expire. Clan history is kept while a clan is tracked so leaders can see long-term records. When an account is deleted we remove its email, password hash, sessions and linked player tags; the security log keeps a record that the deletion happened, and public game data about a clan may remain in that clan's history.

Your choices and rights

You can update your email and password, unlink game accounts and Google sign-in, and sign out other devices from your account page. You can ask us for a copy of your personal data, to correct it, or to delete your account by emailing matthewzimmers@gmail.com from the address on your account. Depending on where you live (for example under the GDPR, UK GDPR or California law) you may have further rights, including objecting to processing or complaining to your local data protection authority.

Children

Clan War Stats is not directed at children under 13 (or the minimum age in your country) and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will delete it.

Security

The site is served only over HTTPS. Passwords are hashed with scrypt, session cookies are secure and HTTP-only, and sign-in attempts are rate-limited. No system is perfectly secure, so please use a password you don't use elsewhere.

Changes

If we change this policy we will update the date at the top of this page. Significant changes will be noted on the site.

Contact

matthewzimmers@gmail.com