Privacy

The short version

Undercut stores what it needs to run your account and nothing else. There are no analytics scripts, no ad trackers, and no third-party cookies on this site. The two cookies it sets are the ones that make it work. You can export everything I hold about you as JSON, or delete the account and all of it, from your account page.

What gets stored

Account. An email address and a password hash (argon2id; I could not read your password if I wanted to), or your Discord user id and display name if you sign in through Discord. Discord sign-in uses the "identify" scope only: no email, no guilds, no friends.

Things you create. Watchlist items, saved presets, price alerts, and hand-logged portfolio trades. They exist so the site can show them back to you.

Billing. When paid subscriptions go live they run on Stripe. Undercut stores the Stripe customer reference, never card numbers. During the beta nothing is charged and no billing data exists.

Server logs. The web server keeps short-lived request logs (path, timestamp, status) for debugging and abuse handling. They are not fed into any analytics product.

Cookies

Two, both strictly necessary, which is why there is no cookie banner:

session — a signed cookie that keeps you logged in. Set on login, cleared on logout.
region — remembers which game server you were looking at.

What leaves the site

Item images load from Albion Online's official render service, so your browser sends that server the same basic request data it sends any image host. Market data flows the other way: the site reads public data from the Albion Online Data Project; nothing about you is sent there.

Your data is not sold, shared, or handed to advertisers. It sits in a PostgreSQL database I run, with nightly backups on the same retention.

Your rights

GDPR gives you access, correction, portability, and erasure — and on this site they are buttons, not a support ticket. Export your data as JSON any time; delete your account and every row that belongs to it goes with it, immediately and permanently (backups age out on the nightly cycle). If you think I am mishandling your data you can complain to the Dutch DPA, the Autoriteit Persoonsgegevens. But write me first, I fix things faster than they do.