Privacy Policy
Last updated: October 7, 2026
TheoryChamp collects as little as it can get away with. There is no advertising, no analytics, no tracking pixels and no third-party scripts following you around. This page explains exactly what we do hold, why we hold it, who else sees it, and how to make us delete it.
1. The short version
- You can use the free calculators and the team builder without signing in and without giving us anything.
- If you sign in, we get your account ID, email and display name from Google or Discord. That is it. We never see your password.
- We never see your card details. Payments happen on Stripe's own page.
- There is no analytics, no advertising and no behavioral tracking anywhere on this site. We do not know which pages you visited or how long you stayed.
- We use two cookies, both strictly necessary: one keeps you signed in, one protects the sign-in process.
- Your build requests and the teams produced are sent to a third-party artificial intelligence provider, because that is what generates them. (How this works.)
- Share a team to the Build Library and that team is public: the team, its name and the handle you choose. Who favorites a team is never shown, only the count.
- Ask us to delete your account and we delete it, for real, within 30 days.
2. Who is responsible
TheoryChamp is operated as a sole proprietorship based in New York, United States. We are the data controller for the personal data described here.
For anything to do with privacy, including access and deletion requests, contact contact [at] theorychamp [dot] com. The feedback form on the Team Lab page reaches us too.
3. What we collect and why
| What | Why | Where it comes from |
|---|---|---|
| Account ID, email address, display name, and which provider you used | To sign you in, to keep your credits attached to the right account, and to contact you about a purchase or a problem | Google or Discord, when you choose to sign in |
| Your credit history: free grants, purchases, and what you spent | To know how many builds you have left, and to handle refunds and disputes | Created as you use the Service |
| Your build requests, any names you give your builds, and the teams and reports produced from them | To generate your team, and to let you reopen and rename a report later from any device | What you type in Team Lab |
| If you use the Build Library: the handle you choose, the teams you share (the team, the name you give it, and your build request if you choose to show it), a preview image of each shared team, the teams you favorite, and any report you send about a shared team | To show the teams you share under your handle, to keep your favorites, and to look into a report | What you choose in Team Lab and the Build Library. The preview image is drawn in your browser from the team itself |
| Team sheets you paste into the analysis page or the chat, and your chat messages | To answer your questions about that team | What you paste or type. Chat conversations are held in memory only and are gone when the session ends or the server restarts. We do not save them. |
| Feedback you send: your message, the optional email address you leave for a reply, and the team sheet or build request attached to it | To understand and fix the problem you reported, to reply to you, and to give you a free credit if your report leads to a fix | The feedback form. The form tells you before you send it when a team sheet is attached. Leaving an email address is optional. |
| A scrambled, one-way code derived from your IP address | Only to stop one person creating many accounts to farm free credits. It cannot be turned back into your IP address, and we do not store your raw IP address in your account | Your connection, at sign-up |
| Your IP address, used and then discarded | To apply rate limits, to run the bot check on the feedback form, and to record security events such as a failed attempt to reach an admin endpoint. Rate-limit counters live in memory and are lost on restart | Your connection, on each request |
We do not collect payment card details, dates of birth, addresses, phone numbers, location data, contacts, or anything about you from other sites. We do not build a profile of you and we do not make automated decisions that have a legal or similarly significant effect on you.
4. Our legal basis
If you are in the European Union or the United Kingdom, the law asks us to say why we are allowed to process your data. Our reasons are:
- To perform our contract with you: your account, your credits, generating your teams, saving your reports, and answering you in chat. Without this data the Service cannot work.
- Our legitimate interests: preventing abuse and fraud, keeping the Service secure and available, and acting on feedback to improve it. We have weighed these against your interests and kept the data involved to a minimum.
- Legal obligations: keeping records of payments for tax and accounting.
We do not rely on consent for any of the above, so there is no consent for you to withdraw. Where we ever do ask for consent, we will say so at the time and you will be able to withdraw it just as easily as you gave it.
5. Cookies and local storage
We use two cookies. Both are strictly necessary to run the Service, neither is used for tracking or advertising, and neither is shared with anyone. Because they are essential, no consent banner is required, and you will not see one.
| Cookie | What it does | How long it lasts |
|---|---|---|
sid |
Keeps you signed in. Contains only your account number and a signature that proves it has not been tampered with | 30 days |
oauth_state |
A one-time security check during sign-in, to make sure the sign-in that comes back is the one you started | 10 minutes |
Both are marked HttpOnly and SameSite=Lax, and are sent only over
HTTPS on the live site, so they cannot be read by scripts or sent to other sites. Signing out
clears the sid cookie immediately.
Things stored in your browser
The site also remembers a few things locally, in your own browser. These never leave your device, are never sent to us, and are not personal data we hold. You can clear them at any time through your browser's settings.
| Name | What it remembers |
|---|---|
theorizer.paste | The team you are working on, so it carries between the builder, the analysis page and the Lab |
theorizer.activeBuild | A build that is still running, so you can close the tab and come back to it |
theorychamp.showcase.open.v1 | Whether you left the example gallery open or closed |
theorychamp.welcome.dismissed.v2, theorychamp.welcome.lastShown.v1, theorychamp.welcome.shownSession.v1 | Whether you have already seen or dismissed the welcome message |
The bot check
The feedback form is protected by Cloudflare Turnstile, which tells us a submission came from a person rather than a script. When it runs it may store data in your browser and it receives your IP address in order to work. It does not track you across sites and it does not build an advertising profile. It appears only on the feedback form.
6. Who else processes it
We share the minimum necessary with the services that make TheoryChamp work. Each one is a processor acting on our instructions, not a party we sell data to.
- Google and Discord (sign-in). They confirm who you are and give us your account ID, email and display name. We only ever receive these when you choose to sign in with them. Their own privacy policies cover what they do on their side.
- Anthropic (the artificial intelligence provider whose models generate your teams and chat answers). Your build instructions, team sheets and chat messages are sent to Anthropic so a report can be produced. We do not send them your name, email or account details. Anthropic processes this data on our behalf under their commercial terms and does not use it to train their models. (How this works.)
- Stripe (payments). When you buy credits you enter your card details on Stripe's own hosted page. We never see or store them. Stripe tells us only that a payment succeeded, and for which pack, so we can add your credits. Stripe holds the payment record as its own controller under its own privacy policy.
- Render (hosting). The Service runs on Render's infrastructure, and its database sits on a disk they provide. Standard web-server logs there may include IP addresses for a short period under the host's normal settings.
- Cloudflare (network, security and the bot check). All traffic to the site passes through Cloudflare, which sees the IP address and request details of every visit in order to route it, cache static files and block attacks. Cloudflare also provides the Turnstile bot check described above, and forwards email sent to our contact address.
- Google Workspace (email). Our contact mailbox is a Gmail account, so any email you send us, and a copy of any feedback you submit, is stored there.
We may also disclose data if the law genuinely requires it, or to establish or defend a legal claim. We have never received such a request.
7. Where your data goes
We are based in the United States and so is every provider listed above, so if you are in the European Union, the United Kingdom or elsewhere outside the US, your data is processed in the United States.
For those transfers we rely on the safeguards our providers offer, which include certification under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses, depending on the provider. You can ask us for details of the safeguards that apply to a specific provider.
8. How long we keep it
| What | How long |
|---|---|
| Your account, credit history and build history | While your account exists. Deleted when you ask us to delete the account |
| Saved build reports | While your account exists, so you can reopen them. Deleted with the account |
| Teams you share to the Build Library, their preview images, your handle and your favorites | Until you take a shared team down, or until your account is deleted. Reports about a shared team are kept like feedback notes |
| Chat conversations | Not stored. They live in memory during your session and are discarded when it ends or the server restarts |
| Feedback notes | Up to 12 months, then deleted automatically. Deleted sooner if you ask, or when the account that sent them is deleted |
| The email copy of your feedback in our mailbox | Deleted when you ask us to delete your data, and otherwise cleared periodically |
| Payment records | Held by Stripe, and kept by us for as long as tax and accounting law requires, normally 7 years. These survive account deletion because we are required to keep them |
| Database backups | We keep the 10 most recent backups of the accounts database. A deletion works its way out of these as they rotate. Backups are only ever used to recover from a failure |
| Server and security logs | Kept briefly by our hosting and network providers under their standard settings, and not linked to your account |
9. Your rights
Wherever you live, you can ask us to:
- See what we hold about you and get a copy of it;
- Correct anything that is wrong;
- Delete your account and the personal data attached to it;
- Receive your data in a portable form, so you can take it elsewhere;
- Restrict or object to processing we base on our legitimate interests;
- Sign out at any time, which ends your session immediately.
Email us and we will act within 30 days, and usually much sooner. We will not charge you, and we will not treat you differently for asking. We may need to confirm you control the account email before we delete anything, which protects you from someone else deleting your account.
What deletion actually does. It is a real deletion, not a hidden flag: your account record, your entire credit history, your build history, your saved reports and any feedback notes tied to you are removed from the database and the disk, and your session stops working at once. It cannot be undone, and any unused credits go with it, so tell us first if you want them refunded. Two things survive, and we would rather say so than pretend otherwise: payment records we are legally required to keep, and existing database backups until they rotate out.
If you are in the European Union or the United Kingdom and you think we have handled your data badly, you have the right to complain to your national data protection authority. We would genuinely prefer you told us first so we can fix it.
10. We do not sell your data
We do not sell your personal data, we do not share it for cross-context behavioral advertising, and we do not rent, trade or otherwise hand it to anyone for their own purposes. There is no advertising on this site and no advertising network has any presence on it. We have never done any of these things and have no plans to.
11. Security
The whole site is served over HTTPS and sits behind a network provider that filters malicious
traffic. Session cookies are signed, marked HttpOnly and cannot be read by page
scripts. The site loads no third-party scripts other than the bot check on the feedback form,
enforced by a strict content security policy. Administrative endpoints require a separate
secret token and log failed attempts. Card details never reach our servers at all.
No system is perfectly secure, and we are a small operation rather than a large company with a security team. If a breach affects your personal data and is likely to put you at risk, we will tell you and the relevant authority without undue delay, and within 72 hours of becoming aware of it where the law requires that.
If you find a security problem, please email us rather than posting it publicly. We will respond quickly and we will not pursue anyone who reports a genuine issue in good faith.
12. Children
The Service is not directed to children under 13, and you must be at least 13 to use it. Where local law sets a higher minimum age for consenting to online services, that age applies instead. In parts of the European Union and the United Kingdom that minimum is 16.
We do not knowingly collect personal data from anyone below the applicable age. If you are a parent or guardian and believe your child has given us personal data, contact us and we will delete the account and the data promptly.
We follow the U.S. Children's Online Privacy Protection Act (COPPA): the Service is not directed to children under 13, and we delete any personal data we learn came from a child under 13.
13. Changes
We may update this policy. When we do we change the "last updated" date at the top and post the new version here. If a change materially affects how we use data you have already given us, we will tell you by email or by a notice in the app before it takes effect.
14. Contact
Questions, access requests, deletion requests, or anything else about your data: contact [at] theorychamp [dot] com. If email does not work for you, the feedback form on the Team Lab page reaches us too. See also the Terms of Service.