Privacy Policy
Last updated: 17 July 2026Uma Tools is a free, unofficial fan tool for Umamusume: Pretty Derby, operated by a private individual. This policy explains what data the site handles and why. It collects as little as possible.
1. What we collect
• Account: your username and password. The password is stored only as a salted hash, so it cannot be read back.
• Discord sign-in (optional): only your Discord user ID. We request the minimum "identify" scope. We do not receive or store your email, avatar, real name, or Discord password. Your Discord username is read once to suggest an account name and is not kept afterward; the ID is all that links your Uma Tools account to Discord.
• Content you create: decks, support and character rosters, and race plans you choose to save, so they follow your account across devices.
• On your device: preferences (theme, toggles) and unsaved working state, kept in your browser's local storage. This stays on your device unless you sign in and save.
• Technical: standard server logs (IP address, browser user-agent, request time) for operating and securing the service, and one encrypted sign-in cookie (about 30 days).
2. How we use it
We use this data only to run the service: to sign you in, save your builds, and protect against abuse. We do not show ads, build advertising profiles, or sell your data.
3. Who else processes it
• Neon hosts the database (EU region) that stores your account and saved content.
• Discord is involved only if you use Discord sign-in; that exchange is governed by Discord's privacy policy.
• Our hosting provider runs the server the site is served from.
We do not sell or share your data for marketing.
4. Cookies
The only cookie is an essential, encrypted sign-in cookie that keeps you logged in. There are no analytics or advertising cookies.
5. Where data is stored
Account and saved data are stored in a database hosted in the European Union.
6. Retention
Account and saved content are kept while your account exists. Server logs are kept only briefly and then rotated. If your account is deleted, its data is removed.
7. Your rights
Under the GDPR you can request access to, correction of, export of, or deletion of your data, and object to certain processing. Account deletion is currently handled on request; contact us using the details below and we will action it.
8. Security
Passwords are stored hashed, traffic is served over HTTPS, and the sign-in cookie is encrypted. No method of storage or transmission is ever completely secure.
9. Children
The service is not intended for anyone under 13 (or the higher minimum age required in your country or by any sign-in provider you use).
10. Changes to this policy
We may update this policy from time to time. The "last updated" date above will change when we do.
11. Contact
Privacy questions or data requests (including account deletion): luca@trenz.de.