---
title: "Privacy Policy"
url: https://tacticsjournal.com/privacy/
---

# Privacy Policy

**Effective date:** October 15, 2026

Tactics Journal (“we”, “us”, “our”) operates tacticsjournal.com and the Tactics Journal iOS app. This policy explains what we collect about you, what we do with it, and how we protect it.

## Information we collect

### Email address

When you subscribe or create an account, we collect your email address. We use your email to:

* Send you newsletter posts when you subscribe
* Send sign-in links and one-time codes for account access
* Send account-related notifications

### Account data

If you create an account, we store:

* Your email address
* Session information for keeping you signed in

If you sign in with Google, Google sends us your email address and basic profile information (name, profile picture) through the OpenID Connect `email` and `profile` scopes. We keep only your email address.

### Community data

If you use Community features (Chat, Discussion, Feed, comments, profiles), we also collect and store:

* **Profile information** you provide: display name, title, bio, website URL, avatar image, and banner image
* **Content you post**: chat messages, discussion posts, replies, and article comments, including any attached images
* **Home sources** you configure: RSS/Atom/YouTube URLs you add to Community Home
* **Community application answers**: your full name, username, country, whether you work in football, why you want to join, and your confirmation that you are 18 or older. If you work in football, we also ask for your experience, the types of roles you’ve had, your current role, your company or team, and your LinkedIn. A photo, bio, website, and email are optional. Your company or team appears on your profile; your country, LinkedIn, experience, and email are not shown to other members
* **Reports** you file against content or members, and the members you **block**
* **Moderation records**: if we act on your content or account, we log what we did and why

Anyone can see your posts, and your profile if you set it to public. Direct messages are visible only to the people in the conversation, and to moderators when a message is reported. We store uploaded images (avatars, banners, message attachments) in Cloudflare R2 and serve them from public URLs. When you delete a message or post, we take it out of public view, though we may keep the underlying record in our moderation logs. When you upload a new avatar or banner, we delete the old image from storage.

### AMAs

If you take part in an AMA (Ask Me Anything), we store:

* **Questions and upvotes** you submit. If you ask anonymously, other members don’t see your name, but the question is still linked to your account so we can moderate it.
* **Guest recommendations**: the guest’s name, a link, and your reason.
* **Guest applications**, if you apply to host one: your topic and focus, the dates you offer, your time zone, any link or video you want to promote, and any private note to us. If we book you, your name, bio, photo, and answers are published on the AMA page.
* **Sponsor inquiries and bookings**: the contact name and email, sponsor name, website, message, and the logo and copy you submit. Polar handles the payment.

### IP addresses

We use your IP address for a short time to limit abuse, such as too many sign-in attempts or uploads. We don’t store it with your account, your email preferences, or your poll votes, and we don’t send it to our newsletter provider.

### Automated moderation

To keep Community safe, the text of new posts, replies, chat messages, and Boards shared to Community is checked by OpenAI’s moderation service, which flags harmful content such as harassment, hate, and sexual or violent material. When someone reports content, the reported text and the reporters’ reasons are sent to TypeSafe, which suggests a category for our review queue. Both are automated suggestions; a person makes every moderation decision. We send only the content being checked, not your email address.

### iOS app

If you use the iOS app, we also store:

* **Sign-in sessions** for the app. The app keeps its session keys in your device’s Keychain. When you sign in with an email code, the app creates a device key that signs the sign-in request; we keep its public half only until shortly after that sign-in request expires.
* **Push notification tokens**, if you turn notifications on. Apple’s push service delivers the notifications. By default a notification says only that there is new activity, not what someone wrote. We stop sending to it when you turn notifications off, and delete it when you sign out or delete your account.
* **Passkeys**, for accounts that use one. The passkey stays on your device or in your password manager; we store only its public key.

The app does not use advertising identifiers, and we do not track you across other companies’ apps or websites.

### Board account data

If you use Board cloud backup or Pro, we store the project documents you sync to your account. Pro also keeps up to 30 periodic earlier versions of each synced project so you can restore one. When an agent link proposes a version instead of editing your project, we store that proposed document until you accept or reject it; a decided proposal keeps only its outcome. We store synced custom assets and library items, sharing and invitation records, and revocable agent-access grants when you use those features. Browser-local projects that you do not back up or sync stay on your device.

### Paid product billing

Tactics Journal Pro is sold through Polar, our payment processor and merchant of record. Polar handles payment details, so we do not store your full card number. We receive the account and subscription details needed to match a purchase to your account, grant or remove paid access, handle renewals, cancellations, refunds, chargebacks, and failed payments, and send billing and service notices.

### Board product counters

The Board sends a small set of first-party product counters so we can understand editor use, exports, pricing views, checkout starts, and free-backup use. We store only an aggregate count for the UTC day, event type, approved detail, and plan category (Free, Pro, or self-hosted). Older aggregate records may include plan categories we no longer offer.

We do not store an IP address, user agent, cookies, email address, account ID, installation ID, raw URL, referrer, or arbitrary event text with these counters. We keep the aggregate rows for 14 months, then delete them.

Pro is $14.99 billed monthly or $12.99 a month billed yearly at $155.88 and renews automatically until canceled. The browser-local Board editor is free, including unlimited local projects and exports. Signed-in Free accounts may select one project for cloud backup. You do not need Pro to read Opinion posts or to use free Community features and public pages.

## Third-party services

We use the services below. Each link goes to that company’s own privacy policy.

* **Buttondown.** Newsletter delivery and subscriber management. [Buttondown’s privacy policy][1]
* **Resend.** Transactional email, meaning sign-in links, one-time codes, and account notifications. [Resend’s privacy policy][2]
* **Google.** Optional “Continue with Google” sign-in through Google Identity Services and OAuth 2.0. We ask for the `openid email profile` scopes and nothing else, and we reach no other data in your Google account. [Google’s privacy policy][3]
* **Cloudflare.** Site hosting, edge computing, and database services (D1). [Cloudflare’s privacy policy][4]
* **Apple.** App distribution through the App Store, and push notification delivery through the Apple Push Notification service. [Apple’s privacy policy][5]
* **OpenAI.** Automated moderation checks on Community posts, replies, and messages. [OpenAI’s privacy policy][6]
* **TypeSafe.** Suggested categories for reported Community content in our review queue. [TypeSafe][7]
* **Polar.** Payment processing and merchant-of-record services for Tactics Journal Pro. Polar’s privacy policy applies to billing information handled by Polar. [Polar’s privacy policy][8]

We do not use any third-party analytics or tracking services.

## Cookies

This site uses essential cookies only. We set no advertising, analytics, or third-party tracking cookies. Here is every cookie we do set:

| Cookie | Purpose | Duration |
|----------
| `tj_session` | Signs you in and keeps you signed in after you sign in via a sign-in link, one-time code, or Google. HttpOnly, Secure, SameSite=Lax. | Up to 30 days |
| `tj_google_oauth` | Guards the Google sign-in redirect against CSRF. HttpOnly, Secure, SameSite=Lax. | 10 minutes (cleared after sign-in completes) |
| `tj_poll_voter` | A random ID, set when you vote in a morning poll, so a second vote from the same browser replaces the first. It holds nothing about you, and we store only a coded version of it with your vote. HttpOnly, Secure, SameSite=Lax. | 1 year |
| `cookie-notice-dismissed` | Remembers that you have seen the cookie notice so we do not show it again. | 90 days |

For the full detail, see our [Cookie Policy](https://tacticsjournal.com/cookies.md).

## Data retention

* **Newsletter subscribers.** New subscriptions receive every new post by email. Existing preferences stay unchanged. We keep your email while you stay subscribed. Unsubscribe at any time using the link in any email.
* **Account data.** We keep it while your account is active. You can delete your account in the Tactics Journal iOS app (Settings → Account → Delete account), on [tacticsjournal.com/community](/community/), or by contacting us.
* **Community data.** We keep your posts, messages, and profile information while your account is active, or while the content stays publicly visible. We may keep deleted content in our moderation logs. Contact us to have your account, Community content, and uploaded images deleted in full.
* **When an account is deleted.** We sign you out everywhere and delete your profile, photos, email address, settings, follows, blocks, bookmarks, and notifications, and remove you from our newsletter list. Your posts, replies, and messages stay so conversations still make sense, but they are shown as “\[removed by user\]” with nothing that identifies you. If a moderator removes an account, its content is shown as “\[removed by moderator\]” instead, and we keep a record of the ban. We keep billing records for as long as the law requires, and anonymous vote counts.

## Your rights

You may at any time:

* **Unsubscribe** from newsletters using the link in any email
* **Sign out** of your account to clear your session
* **Request access, correction, or deletion** of your account and data by contacting us at our [contact page][9]

## Children’s privacy

The Service is not meant for children under 13, and we do not knowingly collect personal information from them. Only people who are 18 or older can post or take part in Community, including comments and the iOS app’s Community features. If you think a child has given us personal information, contact us and we will delete it.

## Changes to this policy

We may update this policy from time to time. We post any change on this page and update the effective date.

## Contact

If you have questions about this policy, reach us through our [contact page][9].

[1]: https://buttondown.com/legal/privacy
[2]: https://resend.com/legal/privacy-policy
[3]: https://policies.google.com/privacy
[4]: https://www.cloudflare.com/privacypolicy/
[5]: https://www.apple.com/legal/privacy/
[6]: https://openai.com/policies/privacy-policy/
[7]: https://typesafe.ai
[8]: https://polar.sh/legal/privacy
[9]: https://tacticsjournal.com/contact.md

---

Web page: https://tacticsjournal.com/privacy/
Every post and page as Markdown: https://tacticsjournal.com/llms.txt