Effective 29 July 2026
Information processed
The service processes network and security information such as IP addresses, request times, browser or device signals and rate-limit counters to deliver the site and prevent abuse. If you choose to support the developer, APO also receives the Stripe payment status, amount, selected KVK and kingdom, and any optional display name or message you submit.
Public information
KVK request numbers and request counts are public. If you optionally provide an email and agree to a tracking update, we store the address privately to send one notification for that KVK when the administrator announces tracking. It is not displayed publicly or used for newsletters or marketing. Resend processes the recipient address and message to deliver that notification.
Your selected kingdom, contribution amount, optional display name and optional message may be displayed publicly. Do not submit personal or sensitive information in the public message field.
Audience measurement
We measure KVK page views and successful CSV responses to understand which battlefields are useful. Counts are private to the administrator. A daily, per-KVK estimate uses your IP address and browser user-agent transiently to calculate a keyed hash; the raw address and user-agent are not stored in the audience database. We do not connect these counts to governor names, emails, payments or browsing on other sites.
No visitor cookies or persistent browser identifiers are used for this measurement. We honor Do Not Track, Global Privacy Control and the opt-out below. The opt-out stores only your preference on this device. Known bots, scanner traffic and recognized owner-browser sessions are excluded; counts remain estimates.
Salts from days before yesterday are erased on the next tracking request, dashboard review or scanner heartbeat. Matching temporary hashes are then removed in bounded batches. During inactivity, cleanup resumes with the next activity. Daily aggregate counts are kept for up to 365 days on the same cleanup schedule. Temporary salts and hashes are excluded from our application database exports; infrastructure backups follow their separate retention schedule.
Payments
Stripe collects and processes card and billing information on its own checkout page. APO receives only the payment information required to verify and record the one-time support contribution. APO does not receive or store card numbers.
Service providers
Cloudflare provides network security and the Turnstile anti-bot check, Railway hosts the web application and database, and Stripe processes payments. These providers process limited information under their own terms and privacy commitments where needed to provide their services.
Security and retention
Security logs are retained only as needed to investigate abuse and operate the service. Temporary download limits expire automatically. Verified support records are retained for accounting, fraud and dispute handling and the public supporter history. Optional public fields may be removed on request unless retention is legally required.
Your choices
Requesting a KVK does not require an email. You can withdraw your notification request or correct its address by contacting [email protected] before it is sent. We clear the address from the active notification table after a successful send or when the admin deletes the request. Unsent signups expire after 180 days and are cleared on the next admin review or notification run. A hashed address and delivery status remain to prevent duplicate sends. Deleted addresses may remain in retained backups until those backups expire; delivery records also follow Resend's retention policy.
You can support anonymously by leaving the name and message fields blank. You may use the support contact in the footer to request access, correction or removal of optional public information, or to ask a privacy question, subject to identity verification and legal retention obligations.