Privacy Policy

About PandaZones

PandaZones is a Kingshot companion platform with public game information, lookup tools, calculators, planners, gift-code features, and account tools. PandaZones also has a separate public music area. This policy applies when you visit PandaZones or use a PandaZones account.

Information PandaZones processes

• Account and sign-in information. PandaZones supports email/password and Google sign-in through Supabase Auth. Supabase Auth processes the credentials or provider identity needed for authentication and provides PandaZones with authenticated identity and session information. PandaZones may also display account information made available to the application, such as an internal user ID, email address, display name, nickname, or account tier.
• Kingshot account information. When you add or use a Kingshot account, PandaZones processes information such as the Kingshot ID, Kingdom, registration or verification state, and related account status. Gift-code use also involves the selected Kingshot ID, the code, and redemption status or history.
• Governor Profile screenshots and OCR. If you choose screenshot-assisted account verification, the image is sent to PandaZones for optical character recognition. Extracted identifiers and verification evidence are recorded so the verified account can be enrolled. You should upload only the Governor Profile image needed for this purpose.
• Public feature submissions. If you submit KvK or alliance information, PandaZones processes the fields you provide, which may include Kingdoms, season and result details, notes, Kingshot ID, player name, power, statistics, or hero information, depending on the feature.
• Public lookup information. Player, alliance, Kingdom, KvK, and transfer tools process the identifiers you search for and may display public game data received from external Kingshot data sources.
• Technical information. Requests naturally include technical details such as an IP address and browser request data. PandaZones uses request identity for rate limiting. A public KvK matchup submission stores a shortened cryptographic hash derived from the request IP. Limited operational logs may include requested game identifiers, timing, cache or upstream outcome, and error status; they are designed not to log full player profiles or free text from those lookup responses.

How information is used

• Provide authentication, account pages, Kingshot account management, and gift-code features.
• Verify screenshot-assisted Kingshot account enrollment and show the result for confirmation.
• Return public game lookups, operate calculators and planners, and accept feature submissions.
• Protect the service through session checks, CSRF protection, validation, rate limiting, and troubleshooting.
• Maintain the accuracy, availability, and security of PandaZones.

Cookies and browser storage

PandaZones uses application session cookies to keep signed-in areas available and CSRF cookies to protect account actions. An additional session cookie is used only for an authorized admin step-up. These cookies are checked by PandaZones servers; cookie presence alone does not grant access.

Some public tools save preferences or working data in your browser's local storage so it is available on a later visit. This includes certain calculator inputs, planner data, message-template favorites, and a KvK invite-submission receipt. That receipt can include the submitted Kingshot ID, player name, power, statistics, and hero selections. This browser data stays on the device unless you clear it or the feature replaces it.

Service providers and external services

• Supabase provides email/password and Google authentication through Supabase Auth, as well as database services used by PandaZones. The browser authentication client is not used to upload files to Supabase Storage.
• Kingshot services and data sources are used to perform requested gift-code operations and retrieve public game data. The application mediates these requests through PandaZones servers where implemented.
• Spotify and YouTube are supported by the music page, but no Spotify or YouTube player is configured in the current published catalog. If a player is added, loading it may send technical request data to that provider under its own privacy terms.

PandaZones does not currently configure a separate product-analytics or advertising platform in the application. When Google sign-in is used, Google provides the basic account identity and email information needed for authentication under the sign-in scopes requested. PandaZones does not request sensitive or restricted Google scopes, and Google sign-in does not determine PandaZones admin rights. Discord sign-in is not active.

Retention

PandaZones keeps account and service records for as long as they are needed to provide the relevant feature, preserve account and redemption integrity, protect the service, or resolve a support issue. Some historical Kingshot records are intentionally preserved as archive or recovery evidence and are not automatically treated as active accounts. The current application does not publish fixed deletion periods for account records, OCR verification evidence, submissions, or operational logs.

Your choices and requests

You can sign out to clear PandaZones application session cookies, and you can clear your browser's site data to remove locally stored tool preferences and receipts. Signed-in account pages let you review current PandaZones and Kingshot account information, although not every field can currently be edited there.

You may ask PandaZones to review, correct, or delete personal information associated with you, subject to records that must be preserved to keep account ownership and redemption history accurate. Use the PandaZones support channel through which you normally contact the service. A dedicated public privacy email is not currently published, so do not post passwords, session tokens, screenshots, or other sensitive account information in a public message.

Security

PandaZones uses measures such as server-verified sessions, protected cookies, CSRF checks, request validation, rate limits, and server-side mediation for sensitive operations. No internet service can guarantee absolute security, so please protect your credentials and report suspected account misuse through the available PandaZones support channel.

Changes to this policy

PandaZones may update this policy when the service or its verified data practices change. The date at the top of this page shows the latest update.