What we collect, and why
HighKing is a scheduling tool for Kingshot KvK prep. It collects as little as it can get away with, because players use it without an account.
This page describes what the software actually does. It is written to be accurate rather than to be legal boilerplate, and it has not been reviewed by a lawyer.
Players register without an account
There is no signup, no password, and no email required to submit availability. You pick your governor name from your kingdom’s roster, give your in-game player ID, and choose the half-hour slots you can be online.
What identifies you afterwards is a single private link. We store only a SHA-256 hash of its token — we cannot reconstruct the link, so if you lose it we cannot recover it, only issue a new one.
What we store about a submission
Your governor name and alliance, your Kingshot player ID, the slots you offered, the resources you listed in your week’s bag and how you split them across the prep days, any points total you committed to on a day, whether you declared you will lead your duel group, and anything you typed into the note or Discord handle fields. Submissions made before the bag existed also hold the speedup days and premium amounts entered at the time.
Your kingdom’s leadership can see all of it. That is the point of the tool — they use it to decide who gets a contested slot. The bag, the per-day split and the commitment are read by your Kingdom Manager, King and Ministers of Justice; the rest of your submission is visible to R4 and R5 officers too.
Screenshots you attach
Optional. They live in a private bucket with no public access; every byte is served through our own origin behind your status-link token, never a public URL.
They are compressed in your browser before upload, which re-encodes the image and drops camera metadata such as location. They are deleted 14 days after upload, or when the cycle is archived, whichever comes first.
Email addresses
Collected in exactly two places: when leadership asks us to set up a kingdom, and when a kingdom invites someone to its console. We use them to reply and to sign people in. We do not send marketing.
Abuse prevention
To stop automated submissions we use Cloudflare Turnstile, and we rate-limit by network address. We never store your raw IP address — only a salted SHA-256 hash of it, which we cannot reverse into an address.
Who processes the data
Supabase hosts the database and file storage; Vercel serves the application; Cloudflare provides the bot check. Nobody else receives your data, and we do not sell it or use it for advertising.
Visitor analytics
We use Vercel Web Analytics to count page views and see which screens get used. It sets no cookies and does not follow you to other sites.
It records the address of each page visited, and we strip the secret out of that address before it is sent: a status link is reported as “/s/[token]”, never the token itself, so nobody reading our analytics can open your page. Nothing you typed into a form is ever sent.
How long things are kept
Submissions and assignments stay for the cycle’s history, so leadership can weigh who has had a slot before. Screenshots go after 14 days. Administrative action logs are pruned after 65 days.
Asking us to delete something
You can withdraw a submission yourself from your status link while registration is open. For anything else, ask your kingdom’s leadership or contact us and we will remove it.