Privacy Policy

UmaTracker (https://umatracker.com) is an unofficial, non-commercial fan project for Uma Musume Pretty Derby. It is operated by an individual developer ("we", "us", the "Operator") who is the data controller for the personal data described in this policy under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

You can reach us about anything in this policy at sandwave+umatracker@gmail.com.

UmaTracker is not affiliated with, endorsed by, or associated with Cygames, Inc., CyDesign, Inc., or Google.

We collect as little as we can. Below is everything the service stores, grouped by where it comes from.

2.1 Account data (Google sign-in)

Signing in uses Google OAuth through Firebase Authentication. We request only the basic profile scope. When you sign in we receive and store:

We do not receive your Google password, contacts, calendar, Drive files or any other Google data. UmaTracker's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.2 Anonymous accounts

You can use the Pulls Planner and CM Team Planner without signing in. To save your work across page loads, the app may create an anonymous Firebase account for you in the background. This consists only of a random user ID; it contains no name, email or other identifying information. If you later sign in with Google, the anonymous account's data is merged into your Google-linked account and the anonymous account is deleted.

2.3 Data you enter into the app

Everything you add while using UmaTracker is stored against your account so it syncs between devices:

• Inventory: which characters and support cards you own, with star, potential, limit break and level values
• Wishlist items
• Pull plans and pull history you record
• Champions Meeting team plans, deck templates and pinned cards
• Carat and crystal balances, club rank, Team Trials class, CM performance settings and the daily pack toggle
• Preferences such as your selected game server and theme

This is in-game information about a video game account, not information about your real-world identity. We treat it as personal data anyway because it is linked to your account.

2.4 Shared plans

When you use the "Share" feature, a snapshot of that plan (the characters, cards, targets and dates it contains) together with your display name is stored as a public document reachable by anyone who has the link. Links use random, unguessable IDs and are not listed anywhere, but they are not private: treat a shared link like a public post. Each account may hold up to 20 shared plans; re-sharing the same plan updates the existing link instead of creating a new one. Shared plans are deleted together with your account.

2.5 Server logs and aggregate page statistics

Every page request passes through our server, which does two things:

• Rate limiting. Your IP address is held briefly in server memory to cap the number of requests per minute and protect the site from abuse. It is not written to any database or log by us.
• Aggregate page counts. We increment daily counters for the page path visited, whether the visitor looked like a human or a bot (based on the browser's user-agent string), and the domain of the referring site. These counters are totals per day and cannot be traced back to any individual.

Our hosting provider (Google Cloud / Firebase App Hosting) additionally keeps standard infrastructure request logs, which may include IP addresses and user-agent strings, for its own security and operational purposes and for a limited period under Google's policies.

2.6 Analytics (optional)

With your consent we use Google Analytics 4 (via Firebase Analytics) to understand which features are used. It sets cookies and collects approximate location, device and browser information, pages viewed and session data. Google Analytics 4 does not log or store IP addresses for EU traffic. Analytics is off by default and only starts if you click "Accept" on the cookie banner. See section 4.

2.7 What we do not collect

• No payment or billing information (the service is free)
• No precise location
• No data from your Uma Musume game account itself: nothing is linked to Cygames' servers; everything is what you type in
• No advertising identifiers and no third-party ad networks

We do not use your data for automated decision-making or profiling, and we do not sell it.

UmaTracker stores a small amount of information in your browser. Items marked "essential" are needed for the site to function and do not require consent. Analytics cookies are only set after you accept them.

You can change your mind at any time using the "Cookie preferences" link in the site footer. Declining or withdrawing consent disables Google Analytics for this browser; it does not affect any feature of the site. You can also block or delete cookies in your browser settings.

We do not sell, rent or trade personal data. We share it only with the service providers ("processors") that run the infrastructure, and only as needed:

Game data shown on the site (characters, support cards, banners, schedules) is sourced from the community resources GameTora and uma.moe. That data is fetched by our server, never by your browser, so those sites receive no information about you from UmaTracker.

Plans you deliberately share are visible to anyone with the link, including services that generate link previews (for example Discord or Twitter/X).

We may disclose data if required by law or to protect the rights, safety or property of users or the Operator. We have never received such a request.

Our Firebase project is hosted on Google Cloud. Google may process data in the United States and other countries outside the European Economic Area. Google LLC is certified under the EU-US Data Privacy Framework, and transfers are additionally covered by the European Commission's Standard Contractual Clauses incorporated into Google's data processing terms. Details are in Google's Firebase privacy documentation.

When you delete your account we immediately and permanently remove:

• Your profile (user ID, email, display name, photo URL)
• Your entire inventory, wishlist, pull plans, pull history, CM plans, deck templates, pinned cards, currency and settings
• Every plan you have shared; the links stop working
• Your Firebase Authentication record, which severs the link to your Google account

Deletion cannot be undone. If you want to keep a copy, use Download my data on the Account page first; it gives you a JSON file of everything listed above.

Deleting your UmaTracker account does not touch your Google account. You may also want to revoke UmaTracker's access at myaccount.google.com/connections, although this is not necessary after deletion.

Data that was never personal, such as the daily page counters, is unaffected. Google Analytics data already collected under your earlier consent remains subject to Google's retention settings described above; you can clear the analytics cookies in your browser to break the link to future visits.

If you cannot sign in and therefore cannot use the Account page, email sandwave+umatracker@gmail.com from the Google address linked to the account and we will delete it for you within 30 days.

If you are in the EEA, the UK or Switzerland you have the following rights, and we extend them to everyone regardless of location:

• Access — get a copy of your data. Use "Download my data" on the Account page for an instant export.
• Rectification — everything we store is editable in the app. Your name and photo come from Google; change them there and sign in again.
• Erasure — delete your account from the Account page (section 8).
• Portability — the export is machine-readable JSON.
• Restriction and objection — you can object to processing based on legitimate interests by emailing us. Because the only such processing is minimal security and aggregate counting, the practical remedy is usually to stop using the site.
• Withdraw consent — for analytics, use "Cookie preferences" in the footer at any time. Withdrawal does not affect processing that already took place.
• Complain — you can lodge a complaint with your local data protection authority. A list of EU authorities is available from the European Data Protection Board.

For anything not covered by the self-service tools, email sandwave+umatracker@gmail.com. We respond within one month. We may ask you to confirm the request from the Google email address linked to your account so that we do not hand data to the wrong person.

All traffic is encrypted with HTTPS. Data is stored in Google Firebase, which encrypts it at rest and in transit. Access to your data from the browser requires a valid, short-lived Firebase ID token for your own account; server-side API routes verify that token before reading or writing anything. Administrative access is restricted to the Operator. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authority as the GDPR requires.

UmaTracker is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, email us and we will delete it.

We will update this page when our practices change and revise the "Last updated" date above. For significant changes, such as adding a new category of data or a new processor, we will show a notice in the app. Continued use after the effective date means you have read the updated policy.

Data controller: the Operator of UmaTracker.
Email: sandwave+umatracker@gmail.com