Privacy Policy

Last updated: October 14, 2026

This policy explains what the Uma Musume Carat Calculator ("the Site") collects, why, how long it is kept, and what you can do about it. It is written to meet the EU and UK General Data Protection Regulation (GDPR), and it applies to everyone who uses the Site, wherever they are.

The Short Version

The Site holds as little about you as it can. We do not collect or store:

  • your email address
  • your real name, or the name on your Google, Discord or Patreon account
  • your profile picture
  • any password
  • your IP address

What we do hold is described below: an anonymous account reference if you sign in, the plan you build, anything you choose to post in the PvP gallery, an anonymous visitor count, and the data that Google Analytics and (if ads run) our advertising partner collect with your consent.

Who Is Responsible

The Site is run by Henry (Henry Handsome Derby), who is the data controller for everything described in this policy. There is no company behind it. For any question or request about your data, email [email protected].

Information We Collect

You can use the calculator without an account at all. If you choose to create one, you sign in through Google, Discord, or Patreon, and we collect as little as possible:

  • An anonymous account reference supplied by Google, Discord, or Patreon. This is an opaque identifier that lets us recognize you when you return. It is specific to this Site and cannot be used to identify you elsewhere. You may link more than one of these to the same account.
  • A randomly generated username, such as user_a3f9c1, created by us. You are not asked to choose one.
  • A display name, if you choose one on your account page. It is shown to you, and to everyone else only next to a team or comment you post in the PvP gallery (see below). You can change it whenever you like, and clear it once you have no team posted.
  • The favourite characters you pick on your account page. These are picks from the Site's own catalogue, not anything about you, and the first one is used as your picture, including next to anything you post in the gallery.

We never see your Google, Discord, or Patreon password. Those services verify it and only confirm to us that the sign-in succeeded. We request the narrowest permission each provider offers, so your email address and profile details are never sent to us in the first place; where a provider includes something about you anyway, such as a username, we discard it without storing it. In Patreon's case that means we can see that an account exists and, if you link it, whether it currently supports us. We never see your email address, your pledge amount, or your billing details.

When you use the calculator, we store the planning data you enter, including your current in-game resources (such as carats and tickets), your selected income ranks, the banners you plan to pull on, and any notes you write on them. Notes are shown only to you. This data is tied to your anonymous account so your plan is available the next time you sign in. If you use the Site as a guest, the same planning data is kept in your browser on your own device and is never sent to us. It stays there until you clear it, your browser removes it, or you sign in, at which point it is added to your account.

The PvP Gallery

Posting a team to the gallery is your choice, and the post dialog asks you to agree first. Once you post, everyone can see the team, your caption and strategy, your display name, your favourite character picture and, if you support us on Patreon and leave it switched on, your tier. The same shows next to any comment you write.

  • Upvotes: we store which posts you upvoted, so each person counts once. Nobody else can see who upvoted what.
  • Views: we count how often each post is opened. To count each person once a day, the server keeps a scrambled value in its memory for a day. It is never written to our database.
  • Reports: if you report a post or comment, we keep the report and your account reference for our moderators. The person you reported is never told who you are.
  • Link previews: when a post's link is shared on Discord, X or a similar service, that service fetches a picture of the team's three characters with their running styles, plus the event name and the characters' names. Nothing about you is in it. Those services keep their own copy under their own policies, even after a post is taken down.

Taking a post down deletes it with its upvotes and comments. Deleting your account deletes your posts, your upvotes and your comments, except that a comment someone has replied to stays in its thread as "[deleted]", with no text and no name.

Why We Use It, and the Legal Basis

GDPR requires a legal basis for each thing we do with your data. These are ours:

  • Running your account and saving your plan (your account reference, username, display name, favourite characters and planning data). Basis: performance of a contract, Article 6(1)(b). This is the service you asked for when you signed in.
  • Showing what you post in the gallery (your team, caption, strategy, comments, display name, picture and tier). Basis: your consent, Article 6(1)(a), given when you post. You withdraw it by taking the post down or deleting the comment.
  • Moderating the gallery (reports, and limits on how often you can post or comment). Basis: legitimate interest, Article 6(1)(f), in keeping the gallery free of spam and abuse.
  • Counting visitors with the anonymous counter described below, and rate-limiting requests to keep the Site up. Basis: legitimate interest, Article 6(1)(f), in knowing whether the Site is used and in protecting it from abuse. The counter is designed so that this interest costs you nothing: no IP address and no identifier on your device.
  • Aggregate statistics about how the calculator is used (for example, the share of accounts that enable a given income option, or which banners are popular). Basis: legitimate interest, Article 6(1)(f), in improving the Site. These figures are totals and never identify anyone.
  • Google Analytics and advertising cookies. Basis: your consent, Article 6(1)(a), if you are in the EU, the EEA, the UK or Switzerland. Neither sets a cookie there until you agree (see "Cookies" below).

We do not sell your personal information, and because we hold no contact details, we cannot send you marketing of any kind.

Traffic Measurement

Our own counter

To understand how many people use the Site, we count page loads ourselves. When you load the Site, your browser sends a single request that increments a daily counter. That request also says which page you opened first and the name of the site that linked you here, if any, such as google.com, so we can see which pages and communities bring people in. We keep only the page and the site's name, never the rest of the link. The request sets no cookie, and it happens whether or not you have an account.

So that we can tell how many separate people visit, not just how many times the Site is opened, we combine your IP address and browser user agent into a scrambled value that cannot be turned back into either. Your IP address is never stored. We keep only that scrambled value, and we use it purely to avoid counting the same visitor twice.

The scrambling changes at the start of every calendar month, so the value representing you in one month bears no relation to the next. In practice this means we can recognize a repeat visit within a single month, which is what lets us report how many people used the Site that month. We cannot follow anyone from one month into the next, or build a long-term picture of any individual's activity. The scrambled values are deleted after 90 days; only anonymous totals are kept.

This counting uses no cookie and no identifier stored on your device, so it cannot be linked to you on any other website, or to anything else we hold. We never see who you are, only that some visitor, distinguishable from other visitors for the rest of the month, was here.

Google Analytics

We also use Google Analytics, a service run by Google, to see which pages are visited and roughly where visitors come from. With your consent, Google Analytics sets cookies and collects information such as the pages you view, your device and browser type, and your approximate location. Google processes this under its own privacy policy, keeps it for at most 14 months, and does not receive your account details or anything you save in the calculator.

If you are in the EU, the EEA, the UK or Switzerland, Google Analytics starts in a no-cookie mode: nothing is stored on your device and nothing that identifies you is sent until you accept the cookie prompt. Anywhere else it starts on, and Reject on the same prompt turns it off. You can also block it everywhere by installing the Google Analytics opt-out browser add-on.

Advertising

The Site may show ads from a third-party advertising partner, which may include Google, to help pay for hosting. An advertising partner uses cookies to serve ads, and with your consent may use them to show ads based on your visits to this and other websites. Without that consent, in the regions listed above, any ads shown are not personalized. We will name the partner here when ads start.

You can opt out of personalized advertising from Google at Google Ads Settings, and from other partners at www.aboutads.info. Residents of US states with privacy laws can treat the consent controls described below as their "do not sell or share" choice.

Cookies and Local Storage

The Site's own code sets no cookies. It uses your browser's local storage for three things: a sign-in token, so you stay signed in, your display preferences, such as the theme you picked, and your plan while you use the Site as a guest. All three are needed to run the Site as you asked for it, and none is sent anywhere else. You can remove a guest plan with "Clear plan and start over" in the calculator's settings, or by clearing the Site's data in your browser.

One cookie is set on every visit without asking, because the Site cannot work without it: __cf_bm, from Cloudflare, the network that delivers the Site and protects it from automated abuse. It tells Cloudflare that requests from your browser belong to one person and not a bot. It holds no information about you, cannot be read by our code, and expires 30 minutes after your last request. Cloudflare describes it in its privacy policy. Site staff who sign in to the admin area also receive a session cookie for that area; it is never set for visitors.

Google Analytics and our advertising partner are the only other services that set cookies. On your first visit a prompt asks whether to allow them, with Accept and Reject side by side. In the EU, the EEA, the UK and Switzerland neither service sets a cookie until you accept; elsewhere Analytics starts on, and Reject turns it off. Your choice is saved on your device so you are not asked again, and "Cookie settings" in the footer reopens the prompt whenever you want to change it. You can also clear or block cookies in your browser settings; the calculator works without them.

The video on the home page is embedded in YouTube's privacy-enhanced mode, which does not set advertising cookies unless you play it. Anything the player stores from then on is governed by Google's privacy policy.

Feedback and Bug Reports

Bug reports, data corrections and feature ideas go through our Discord server. Discord is a separate service: anything you post there is held by Discord under its own privacy policy, and the Site never receives or stores it.

How Long We Keep It

  • Account data and your plan: until you delete your account. Deleting it removes everything at once.
  • Gallery posts and comments: until you take them down or delete your account. Reports are kept as a record of what our moderators decided, with your account reference removed if you delete your account.
  • Visitor scrambled values: 90 days. The daily and monthly totals they produce contain nothing about anyone and are kept.
  • Google Analytics data: at most 14 months, held by Google.
  • Cloudflare's __cf_bm cookie: 30 minutes.
  • Your cookie choice: on your device, until you change or clear it.

Where Your Data Is Stored

The Site's database is hosted by DigitalOcean in the United States (New York), and it is delivered through Cloudflare's network, which handles each request at the data centre nearest you. Google Analytics and Google's advertising services process data in the United States as well. For visitors in the EU, the EEA, the UK and Switzerland this is a transfer outside your region. Google is certified under the EU-US Data Privacy Framework, and its UK and Swiss extensions, which the European Commission recognizes as adequate protection. For the database, the only personal data transferred is the anonymous account data described above, and it is protected by Standard Contractual Clauses in DigitalOcean's data processing agreement.

Your Rights

If you are in the EU, the EEA, the UK or Switzerland, GDPR gives you the following rights over your data. We extend them to everyone.

  • Access: to know what we hold about you. Your Account page shows all of it: your username, your linked sign-in methods, your display name, your favourite characters, and the plans themselves are on the calculator.
  • Rectification: to correct it. Everything we hold is editable by you on the Account page or in the calculator.
  • Erasure: to have it deleted. The "Delete account" button on the Account page does this immediately and completely.
  • Portability: to receive a copy of your data in a usable form. Email us and we will send your plan data as a file.
  • Restriction and objection: to ask us to stop or limit processing, including on legitimate-interest grounds. Email us.
  • Withdraw consent: for Analytics and advertising cookies, at any time, through "Cookie settings" in the footer. Withdrawing does not undo processing that already happened.
  • Complain: to your national data protection authority if you think we have handled your data wrongly. We would rather hear from you first, but the choice is yours.

To make a request by email, include the username shown on your Account page. It is the only way we can tell which account is yours, because we hold no email address to match you against. We answer within one month.

Account Recovery

Because we store no email address, there is no password reset and no way for us to verify your identity if you lose access to every Google, Discord, or Patreon account you signed in with. If that happens, your saved plan cannot be recovered, and you would need to start a new plan. That is the trade-off for holding none of your personal data.

Children

The Site is not aimed at children under 16, and we do not knowingly hold any data about them. Since we hold no age or contact details, we cannot tell; if you believe a child has created an account, email us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date, and a change that affects what we collect will also appear on the Changelog.

Contact Us

For anything about this policy or your data, email [email protected].