Privacy Policy

Last updated November 14, 2026

MetaRoK (meta-rok.com) is a fan-made Rise of Kingdoms companion site run by Cortex. It is not affiliated with or endorsed by Lilith Games. This page explains, in plain language, what the site stores about you, why, who can see it, and how to get it removed. It describes what the site's code actually does today.

Browsing without an account

The tier lists, commander pages, marches and makers work without signing in, and MetaRoK ties nothing you do there to you. Visits are counted with Cloudflare Web Analytics, which sets no cookies and does not identify you (see Analytics). Some pages show ads from Google once Google approves the site for them (none run yet), which brings Google's own cookies and consent message to those pages; see Advertising. The tier list maker and talent tree maker keep their state in the page URL, in the part after #, which your browser never sends to the server or to the analytics on its own, and the tier list maker keeps the height of its unranked pool and how the pool is sorted and shown, and the talent tree maker which background its images carry (the game's talent screen, a plain dark colour or none) and whether they carry the name and points line, in your browser's local storage; that data never leaves your browser unless you share the link, sign in while a board or build is on screen, or save the board or build to your account (see "Saved tier lists and talent builds" under Signing in). A board's title and author name, and a talent build's name, travel in that link too. Anyone can see a saved board you make a short link to, for as long as the link lasts (same section). Signing in brings you back to the page you were on: when that page's address after meta-rok.com, the part after # included, is 200 characters or fewer (a small board or build, with its title and author name), the login request carries it to the server, so it is in the request records described below for at most seven days, and in a cookie for the ten minutes a login can take; a longer address goes without the part after #. The graphic maker keeps your designs and pictures in your browser too, unless you save them to your account (see Graphic maker).

Like any website, requests pass through the hosting provider's infrastructure (see third parties). The site's API uses your IP address to rate limit requests. Those counters expire on their own, most within a minute and none later than an hour.

Requests that reach the site's server code (the API, login, connecting Patreon, the membership updates Patreon sends the site, uploaded images, the share links (/u/..., /k/..., /t/...), the links on the pricing and Patreon guide pages that send you on to Patreon's checkout or to your memberships there and any address that does not exist on the site, which gets the not-found page, but not the tier lists and other static pages) are recorded in Cloudflare's Workers Logs: the time, the method and full URL, the response status and request details such as your IP address, your browser's user agent and Cloudflare's estimate of your location, together with any error or audit line the server wrote while handling the request. When you connect Patreon, the address Patreon sends you back to carries a one-time code that the site spends at once and that is useless afterwards. A membership update from Patreon is recorded like any other request, with Patreon's servers as the sender; its content is not recorded. Only the site owner can read these records, and Cloudflare deletes them after at most seven days.

Analytics

MetaRoK counts visits with Cloudflare Web Analytics, to see which pages are used and how fast they load. On every page except the graphic maker, your browser loads a small script from Cloudflare (static.cloudflareinsights.com) that sends Cloudflare a short report about the page:

the address of the page you are on and of the page you came from, each without the part after a ? or a #, which is where a profile or kingdom page's address names the profile or kingdom and where a tier list maker board or a talent build is kept (a profile's share link, /u/..., names the profile before that part, a kingdom's, /k/..., the kingdom, and a saved board's, /t/..., that board, so a visit that came through one can report it as the page you came from);
how the page loaded: how long it took, how long its largest picture or block of text took to appear (and, when that is a picture, its address), how much the layout shifted and how quickly the page answered a tap or a click, with which element on the page each figure is about;
the versions of your browser, its engine and your operating system, and a random number for that page view.

The script sets no cookies and stores nothing in your browser, and it does not identify you or follow you across websites. Like any request, the report reaches Cloudflare with your IP address and your browser's user agent: Cloudflare works out from them the country, browser, operating system and kind of device it counts, and discards the IP address rather than storing it. The site owner sees only totals in Cloudflare's dashboard (for example visits by page, country, browser or the site you came from), for up to six months. If your browser or an extension blocks the script, nothing is sent and the site works the same.

Advertising

Not running yet. Until Google approves the site for ads, no page loads Google's ad script or its consent message, so Google sets no ad cookies here: the places kept for ads show only MetaRoK's own "Go ad-free" card. The rest of this section describes what happens once ads run.

MetaRoK shows ads through Google AdSense (publisher ID ca-pub-8923692775775400). Ads appear only on the tier lists, the pairing pages, the commander pages, the march compositions (/marches) and RoKdle (one ad, after a finished game), plus an anchor ad at the edge of the screen on phones on those pages except RoKdle. When you are signed in with a paid tier (see Paid tiers), no page shows you ads or the consent message.

Every other page loads no ad script and shows no consent message, including the commander databank (/commanders), the about page, profiles, kingdom pages, the tier list, talent tree and graphic makers, the admin pages, the not-found page, these legal pages, the pricing page and the contact page. The first page you open from a link on another website also loads no ad script and shows no consent message, as long as your browser tells the site which website you came from (most browsers do for a search result). A page opened with no such information (from an app such as Discord or YouTube, a bookmark, a typed address or the installed app) also loads no ad script and shows no consent message when it is the first page of the site you open in that browser tab.

Consent. Visitors in the European Economic Area (including Norway), the United Kingdom and Switzerland see Google's certified consent message (the IAB Transparency and Consent Framework) before any personalised ads. Visitors in US states with privacy laws of their own get a "Do not sell or share my personal information" choice, and Google applies restricted data processing for them.
What Google does. On the ad pages, Google and its partners may set and read cookies and similar identifiers for ads and ad measurement, and process data such as your IP address and information about your device and browser. That happens under Google's own policies; see how Google uses information from sites that use its services.
Ads based on your visits. Third-party vendors, including Google, use cookies to show you ads based on your earlier visits to this site and to other websites. Google's advertising cookies let Google and its partners choose ads for you based on those visits. You can turn off personalised advertising from Google in Google's Ads Settings, and opt out of other vendors' cookies for personalised advertising at aboutads.info (in the EEA, the UK and Switzerland, also at youronlinechoices.eu).
Changing your choice. Google's consent message stores your choices in its own cookies. You can change them at any time with the "Privacy and cookie settings" link in the footer, which appears on the pages that load ads (as does the "Do not sell or share" link, where it applies).

MetaRoK does not sell your data. Under some US state privacy laws, Google's personalised advertising on the ad pages counts as "sharing" personal information; the "Do not sell or share my personal information" link is how you opt out of it.

You can sign in with Discord or with Google. There are no passwords on MetaRoK; the site never sees your Discord or Google password.

Discord. The site asks Discord for the identify scope only. It stores your Discord user ID, your username, your display name and the URL of your Discord avatar. It does not ask for or receive your Discord email address, your servers or your friends. The username and avatar URL are refreshed each time you sign in. Separately, the site checks your roles in the Cortex Discord server to see whether you hold a paid tier (see Paid tiers).
Google. The site asks for openid and email only, so Google does not send it your name or picture. It stores your Google account ID (the sub claim) and your verified email address. The email is refreshed on each sign-in. It is shown only to you, in the Accounts section of your profile, so you can see which Google account is linked; the site does not send you email and does not show the address to anyone else. A new account made with Google gets a neutral display name, "Governor" and four digits, until you choose your own, and the site asks you to choose one. Before 29 October 2026 a new Google account took the Google name as its display name; that name stays until you change it on your profile.

The first sign-in with a Discord or Google account creates one profile record with a random ID. That ID, not your Discord or Google ID, is what everything else on the site is keyed to.

Linking logins. One profile can be opened by both a Discord login and a Google login. From the Accounts section of your profile you can link the other kind of login: the site sends you through that provider's normal sign-in and, once it completes, records that identity on the profile you were signed in to. Nothing is linked on the strength of a matching email address or name; only a completed sign-in with the other account links it. You can unlink either login again as long as one remains. Unlinking Discord also ends Discord-verified kingdom leadership on that profile until it is linked again, removes any manual king or officer promotion the profile held, ends any paid tier that came from your Discord role (a tier through Connect Patreon is not affected), and stops the speedup tracker for your profiles (see Kingdoms and leadership) until Discord is linked again. Unlinking does not cancel a Patreon membership; that keeps billing until you cancel it on Patreon. Linking or unlinking a login, confirming a merge, changing your main profile and deleting your account first ask you to sign in again when your last sign-in is more than ten minutes old, so a copy of your session cookie taken more than ten minutes after you signed in cannot change who owns the account. Unlinking a login also signs out every other browser that signed in to your account before you signed in to unlink it; the one you unlink from stays signed in.

Merging two profiles. If the login you are linking already has its own profile on MetaRoK (you signed in with Discord once and with Google another time), the site does not merge them on its own. It shows you both profiles and asks which one stays your main profile; that offer expires after ten minutes if you do nothing. While it waits, the site keeps a record of the offer in its database with the two profiles' IDs, the kind of login being linked and the Discord and Google account IDs each profile carried, nothing else; it is deleted when you confirm or cancel, and one that expired is deleted the next time any merge is offered. When you confirm, both logins are placed on the profile you kept and the other profile becomes a secondary profile under it, exactly like a farm account: nothing on it is deleted, and its Governor ID, sets, pairings and likes stay where they are. Its own secondary profiles, saved tier lists and talent builds, and saved graphic designs and brand kits with their images move under the kept profile, and any kingdom leadership tied to the Discord account follows the Discord account. A Patreon connection (see Paid tiers) moves to the kept profile's login too; when both logins have one, the one that gives the higher tier stays (the kept profile's when both give the same tier or neither gives one) and the other is removed. Records that name the Discord account behind an older note keep the name they were written with. Link, merge and unlink actions, changes of the main profile, connecting (with whether Patreon reported a membership and a Discord account), moving and disconnecting Patreon, and account deletions, are logged on the server with the profile IDs involved (for a deletion, the deleted account's profile ID and how many profiles it held); those log lines are part of the request records described under Browsing without an account.

Changing your main profile. On the Account tab of your main profile you can make one of your secondary profiles the main one. Your Discord and Google logins then open that profile, and what belongs to your whole login moves to it: your paid-tier records and Patreon connection, a Founder record, saved tier lists and talent builds, saved graphic designs and brand kits with their images, your RoKdle history (the leaderboards then show that profile's name, or your Discord name when it has none), your account notices and any kingdom leadership tied to your Discord account. With Discord linked, that profile then carries your Discord name, picture and ID, as a main profile always does, so others can tell it is yours: anyone who can open it gets them, and a link with your Discord ID opens it. If the leadership roster lists you as a leader of a kingdom, that profile becomes an approved member of it when it has no kingdom yet or is in that kingdom but not yet approved. Whatever its visibility, the members and leaders of the kingdom it belongs to see your Discord name, picture and ID beside it on the kingdom's member lists, and while that kingdom's page is public anyone sees your Discord name beside it there; if you use the Codex Helper bot, your main bot profile's speedups and action points show on whichever of your profiles holds the Governor ID that bot profile claims, and that kingdom's leaders see them as that profile's on their speedup tracker (see Kingdoms and leadership) when the bot does not say which ID that is and no other profile of yours in that kingdom already shows them there, or when that profile has no Governor ID and none of your profiles holds that one, unless a bot profile of yours that claims that profile's Governor ID has speedups or action points scanned; the leaders of a kingdom it has applied to see your Discord name, picture and ID with its application; and a kingdom leader who invites you by your Discord name or ID is shown that profile's name on the invite, as are the other leaders of their kingdom, or, when it is a member of a kingdom, is told which one. If you lead a kingdom, its other leaders see that profile's name beside your Discord name in the leader log and, when the leadership roster does not list you, on the invites you send, which also show it to the players you invite; and the members you leave a note for or suggest pairings to see that profile's name as the sender, with your Discord ID, as do the leaders who read those notes. If you lead or have led a kingdom, its leaders see that profile's name beside your Discord name on the members you approved there and on those who joined it through your invite. Setting it to Private keeps its own page apart from your Discord account, but not any of these. The old main profile becomes a secondary profile with everything on it, and each profile keeps its own kingdom, Governor ID, commanders, sets and marches. Every other browser signed in to your account is signed out the next time it talks to the site. It asks for a sign-in from the last ten minutes, as the other changes to your logins do, and can be done three times a day.

Account notices. Your notification bell tells you when a login is linked to or unlinked from your account, when two logins are merged into it, when your main profile changes, and how a Governor ID report ended: one you filed, or one that cost your profile its Governor ID (see Governor ID reports), and when an admin replies to your feedback (see Feedback). Each notice is stored for your whole login with what happened (the kind of login, the Governor ID and the outcome, or the reply with the first 80 characters of your message) and when; a login or report notice never names the other player or holds an email address. It stays until you dismiss it. The Account tab of your profile also lists the logins linked to, unlinked from or merged into your account, and the changes of your main profile, in the last 90 days, whether or not you dismissed their notices. A dismissed notice is deleted once it is more than 90 days old, the next time you dismiss one, and every notice is deleted with your account; a merge moves the other login's notices to the profile you kept, and a change of your main profile moves them to the new main profile.

Saved tier lists and talent builds. A tier list maker board or a talent tree maker build that you save to your account is stored on the server for your whole login: the name you give it, the board or build exactly as its link holds it (any title and author name you typed included), and when you first saved it and last updated it. Only you can open them, from any profile on your login, unless you make a short link to a board (next paragraph), and they are kept until you delete them or your account (see Retention and deletion).

Short links to saved boards. You can make a short link (/t/...) to a tier list maker board you saved; a talent build has none. Anyone with the link can then see that board, with any title and author name it holds, and the link's preview shows the name you saved it under when it has no title, and a new name once you rename it. Nothing there names your profile or your login. Your browser draws a 1200x630 picture of the board (its first tiers), which is stored with it and served at a public /img/ URL, and apps like Discord fetch it to show the preview. The link lasts until you choose Stop sharing or delete the board or your account. Updating the board with a change shows that change at once and deletes the old picture; your browser then draws a new one, and until it arrives the preview shows this site's own picture. Stopping deletes the picture at once; the link's page can still be answered from Cloudflare's edge cache for up to about a minute, and a copy kept by an app that showed the preview is under that app's rules.

Signing out everywhere. "Sign out everywhere" on the Account tab of your profile ends every session of your login, on every device and browser, this one included. It records the moment on your main profile, and a session that started before it stops working the next time that browser talks to the site.

Your profile

Everything on your profile is entered by you, and you can change or clear it at any time on the profile page. It can include: a display name, your in-game Governor ID, alliance name, kingdom number, civilization and the other civilization's buff you run beside it, VIP level, power, kill points, dead troops, highest acclaim, the commanders you own with their skill levels and sculptures, equipment and armament sets, march pairings, filter presets, and your activity times (see below).

Account age. Governor IDs are handed out in order, so from yours the site estimates roughly when your account was started, using a fixed list of dated IDs. The estimate is worked out in the browser from the Governor ID on your profile and is never stored. Anyone who can see your profile sees it beside your Governor ID, and so do the leaders of a kingdom you belong to or apply to, in their member list or with your application. Your march showcase, and the images saved from it, show your Governor ID and your account age as lines of their own only if you turn each on in your profile editor. While your profile is public, the showcase also prints your profile's share link beside the logo, and that link holds your Governor ID, or your Discord ID on a profile with no Governor ID; a profile that is not public, or has neither ID, prints only meta-rok.com. An image saved while your profile was public keeps that link.

Rally and garrison pairings. Beside your march pairings you can keep up to five rally and five garrison pairings. They show on your march showcase, and so to anyone who can see your profile, until you turn off "Show on my showcase" on your profile editor's Commanders tab. While it is off, your profile page, your showcase and any image saved from it leave them out. An image saved while they showed keeps them. So does a link preview made then, until you next save your showcase as an image in your profile editor, turn the preview off or make your profile anything but public (see "Sharing and link previews" below).

Visibility. New profiles are public by default. You can set your profile to one of four levels:

Public: anyone with the link can see it.
Kingdom: only approved members and leaders of your kingdom.
Leadership: only verified leaders of your kingdom.
Private: only you.

Being an approved member of a kingdom shares part of your profile with that kingdom whatever this setting says (see Kingdoms and leadership). Site admins can view every profile regardless of this setting. Profile pages ask search engines not to index them, but a public profile shared as a link is visible to anyone who has the link.

Sharing and link previews. The Share button, yours or a visitor's, hands out a link to your profile, and anyone who can see your showcase can save it as an image, which carries the meta-rok.com mark. A link preview is off until you turn it on in your profile editor, which you can do while your profile is public. Turning it on, and each showcase image you save from your profile editor while it is on, makes a 1200x630 picture of your showcase that is kept as your profile's link preview, at its own public address on this site. While your profile is public, a link from the Share button then shows that picture with your name, kingdom, alliance and power in Discord and other apps that preview links; otherwise it shows only the site's own card. Turning the preview off, making your profile anything but public, or a newer export, deletes the old picture from storage (an app that already showed it may keep its own copy).

Multiple profiles. One login can hold up to 20 profiles (for farm or alt accounts). Secondary profiles have no login of their own and are stored under your primary profile. The Governor ID on a secondary profile is required and must be unique across the site; the one exception is a profile that became secondary through a merge, which keeps whatever Governor ID it had, possibly none, until you set one.

Uploaded images

You can upload a profile avatar and a showcase background; kingdom leaders can upload a kingdom avatar and rally / garrison backgrounds; a Governor ID report requires a screenshot. Uploads are limited to raster images (PNG, JPEG, WebP, GIF). Your browser redraws each picture before it is uploaded, resized where needed, which leaves out the file's own details such as a photo's location, capture time and device; a small animation is uploaded as it is. Uploads are stored in Cloudflare R2 object storage. Replacing or removing a profile avatar, a showcase background, a link preview or a saved board's short link picture, or a kingdom's avatar or captain backgrounds, deletes the old picture from storage at once. These pictures are served from /img/ URLs on this site with a one-year cache lifetime, so a replaced or deleted one can remain in the caches of browsers that loaded it for some time after it is gone from storage. Anyone who can see the page a picture is on can see it. Two kinds of image are private: Governor ID report screenshots, which only site admins can open (see Governor ID reports), and the graphic maker's images (see Graphic maker).

Graphic maker

The graphic maker works without an account, and most of what it keeps stays in your browser. It saves the design you are working on as you go (and up to eight earlier ones that a link or a new design replaced, so you can go back to them), the pictures you add to it, the face cutouts you make, fonts you load from your own device and small pictures of the templates, all in your browser's IndexedDB storage. It keeps the layers you last copied (gm-clipboard, so they paste into another design), the last eight colours you used in its colour fields (gm-recent-colors), the last eight commanders and the last eight game backgrounds you added (gm-recent-commanders and gm-recent-backgrounds, so the library shows them first), your settings (spell check, language, export options, the video length zone, guides and snapping, the open tab, the brand kit in use, and whether the brand kit adds a sticker border to the pictures it places) and a note when a draft could not be saved in your browser's local storage. None of it is sent to the server unless you save to your account (below). It stays until you delete it in the editor or clear this site's data in your browser. Once it has kept a draft, the editor asks your browser once to keep this site's storage from being cleared on its own (when the disk runs low, or in Safari after a week without a visit); most browsers decide that themselves, and Firefox asks you.

The face cutout runs on your device: your browser downloads the background-removal model and the code that runs it from meta-rok.com and cuts the photo out there, so the photo itself is never uploaded. The same goes for the spell check, whose dictionaries are downloaded from meta-rok.com and check your text in the browser, and for exports: the image is drawn and saved in your browser, and carries no hidden marks or details about you or the site. The screen colour picker, in browsers that have one, reads only the colour you click, in your browser. Filling a design from your profile or your kingdom reads the same data those pages show you, in your browser; nothing about it is stored.

A share link carries the design itself in the part of the address after #, which browsers do not send to the server, so the server never sees it. Anyone with the link can see the design. Your own pictures never go into a link: they are left out and shown as empty placeholders.

Signed in, you can save graphic designs and brand kits to your account and upload images for them: logos, mascots, saved face cutouts and other pictures, plus a small thumbnail of each saved design. They are stored with your account and belong to your whole login rather than to one profile, so every profile on the login can use them. A saved design holds the design itself (its layers, text and settings) and its name, with each of your pictures whole, also where a blur, a pixelate or a bar covers part of it in the design; the images are PNG, JPEG or WebP files kept in Cloudflare R2 object storage. All of it is private: only your account can open your designs, brand kits and images. They are never served from the public /img/ URLs and are not shown to anyone else on the site. Each login has a storage limit (at most 500 designs, 10 brand kits and 150 MB of images). Each is deleted when you delete it (a design takes its thumbnail with it, and deleting a design or kit offers to delete the images only it uses), and all of them are deleted with your account. Your images, in the editor's More menu or under Manage images in the Designs dialog, lists every image saved to your account, with its size and whether anything uses it, and deletes the ones you choose from your account, the stored file included; a picture the design on screen uses stays in that design as a copy on your device. Deleting a secondary profile leaves them alone, and linking two logins moves them to the kept profile.

Activity times

You can optionally record the hours you are usually online and a preferred four-hour window for events, both in UTC. One setting controls who sees both:

Leadership only (the default): verified leaders of your kingdom, and you.
Public: anyone who can see your profile. A profile set to the former Public + Showcase level works the same way.

The showcase and its exported image do not show the times. The server removes these fields from the profile before sending it to anyone who is not allowed to see them. Kingdom pages can show an aggregate of members' activity (the most active window and peak hour across the kingdom, and how many members are active in each hour of the day). That aggregate is computed from members' windows without naming anyone, counts a player's several profiles once, and is shown only once at least three members have set their times, each hour's count only once at least three members share that hour (site admins see all of it sooner), and kingdom leaders choose whether it is visible to the public, to kingdom members, or to leadership only.

Kingdoms and leadership

Setting a kingdom number on your profile and applying to that kingdom records a membership status (pending or approved). While your application is pending, the kingdom's leaders see it on their kingdom page, with your display name, Discord username, avatar, Governor ID (and the account age estimated from it) and a link to your profile, and their notification bell counts it. Approved members appear on the kingdom's member list, can be assigned as rally or garrison captains, and can receive march pairing suggestions and notes from kingdom leaders; leaders can also invite a player who has not joined a kingdom. A note a leader leaves on your profile is visible to you and to the leaders of the kingdom it was written for, not to the leaders of a kingdom you join later. Pairing suggestions are deleted 90 days after they were sent, whether or not anyone answered them; invitations too if nobody answered them, and sooner, at the next daily clean-up, once they were accepted, declined or cancelled.

What membership shares, whatever your profile's visibility. As an approved member you are on the kingdom's member list with your display name, Discord username, avatar (your Discord picture only if your profile is public), Governor ID, power and roughly when your profile was last updated (in the last 7 days, the last 30 days, or longer ago). Everyone sees that list when the kingdom's page is public; the kingdom's members and leaders always see it, with your Discord picture, kill points, Discord user ID and the time of that update too. The kingdom's leaders also see your equipment and armament sets, the commanders you own with their skill levels and the account age estimated from your Governor ID, and can download the member list as their page shows it as a spreadsheet: names, Governor IDs, power, kill points, roles, captain duties, who each profile is shown to, the date each member joined, the date of each profile's last update and the profile links. A leader can make you a rally or garrison captain whatever your profile's visibility: your name, avatar (as on the member list) and VIP level, your commanders in that slot (and which of them you have fully expertised) and the sets a leader picked for it are then shown on the kingdom's captain showcases, to its members and leaders, and to everyone when its page is public; anyone who can see a captain showcase can save it as an image. Leaving the kingdom takes you off all of these (an image someone already saved stays with them).

The leader log. A kingdom's leaders, and site admins, can see a log of what its leaders did there: approvals and rejections, removals, king and officer roles, invites sent and cancelled and changes to its page settings, each with the date and time, the leader's name and the name of the player it was about, and when a member joined through an invite or left. Beside a leader's name the log shows their Discord username, for as long as a profile here carries that Discord account, and after that says it is no longer here. A line keeps the names as they were when it was written, so changing your name later does not change the lines already written. Lines are kept for 180 days, whichever kingdom you are in by then. The log writes a limited number of lines a day for each leader and member, and for the whole kingdom; past that limit a line is not written, and one line in the log says that some may be missing. The member list also shows the kingdom's leaders the date you joined and who approved you, by name and Discord username. Deleting your account blanks your name in these lines and takes your Discord ID, your Discord username and the link to your profile out of them; deleting a secondary profile does the same for the lines about it.

A kingdom's recruiting details and its share link. A kingdom's leaders can add recruiting details to its page: whether it takes new members, a minimum power and kill points, a migration window, a Discord invite and who to contact (text the leaders write themselves). While the page is public anyone can see them there. Sharing a kingdom hands out a meta-rok.com/k/... link; for a public kingdom, the preview card Discord and other apps show for it carries the kingdom's description, picture, member count and recruiting details, and for any other kingdom only the kingdom number already in the link.

Leadership verification. To know who is a king or officer, the site fetches a roster of kingdom leaders from codexhelper.com (the TKC leadership list), which is keyed on Discord user IDs. The roster is fetched server-side, cached for five minutes, and compared against the Discord ID of the signed-in user. Nothing about you is sent to codexhelper.com; the site only reads their list. Because the roster is Discord-based, kingdom leadership cannot be verified for a profile with no Discord login; linking a Discord account to it (see Signing in) is what enables it. A verified king can also manually promote members to king or officer; those promotions are stored on this site.

Kingdom leaders can see the profiles of their kingdom's members that are set to kingdom or leadership visibility, including activity times set to leadership only. This already applies while your application is pending: the kingdom number on your profile is what decides it.

Who can approve you. While your application to a kingdom is pending, your profile editor and the kingdom pages show you the Discord usernames and roles (king or officer) of that kingdom's verified leaders, from the roster or, for a manually promoted leader, from their MetaRoK profile, so you know whom to ask. Their Discord user IDs are never shown. If you are a verified leader, players with a pending application to your kingdom see your Discord username and role this way.

Speedup tracker. The Codex Helper bot in the TKC Discord server lets players post screenshots of their speedups, action points, gems and equipment or armament materials, and to claim a Governor ID for each bot profile. When you open your profile editor, and when a leader opens their kingdom's dashboard, the site asks codexhelper.com for the scans that match a profile: by the Governor ID set on it and, for a main profile, by its Discord user ID; on a kingdom dashboard that is done for every approved member, whether or not they have ever used the bot (for those who have not, the answer is simply empty). A Governor ID claim in the bot is used only when it was made from the Discord account linked to your main profile, so typing someone else's Governor ID into meta-rok shows nothing of theirs; a login with no Discord linked is not looked up by Governor ID at all. Nothing is sent to codexhelper.com except those IDs. Through its Discord user ID, a main profile gets your main bot profile's scans only when the bot does not say which Governor ID that bot profile claims (on a kingdom dashboard, not while another of your profiles there already shows the same scans under its Governor ID), or when the main profile has no Governor ID and none of your profiles holds the one that bot profile claims; otherwise they go to whichever of your profiles holds that Governor ID. The site also reads the scan history the bot holds for the matched bot profiles, and keeps one copy of each scan per day so it can draw how the numbers change over time, with the Governor ID your main bot profile claims, so that profile's scans are kept once and found by that ID too; copies older than about 400 days are deleted by a daily clean-up, which runs when anyone on the site first opens a speedup tracker that day, whether or not anyone opens that record again. Everything the bot scanned is shown to you on your profile editor. The leaders of a kingdom you are an approved member of, and site admins, see only your speedups and action points on the kingdom dashboard (alongside every other linked member's, because that is who the tracker bot serves); your gems, VIP points and material stacks are never included in that view. A profile with neither a Governor ID nor a Discord login is never looked up. Leaving the kingdom removes you from its dashboard. The stored scans are keyed on the Discord ID of the account that made the bot claims rather than on the profile, so deleting a secondary profile does not touch them. Deleting your account (see Retention and deletion) deletes the scans stored for the Discord account linked to it at that moment with the Governor ID its main bot profile claims, and the site's lookup records for that Discord ID and for your profiles' Governor IDs. Scans stored for a Discord account you unlinked earlier stay keyed on that Discord ID (they come back if you link it again), and deleting your account does not reach them: link it again before you delete, or ask through the contact form. What the bot itself holds is kept by codexhelper.com under its own rules.

Likes

Likes you leave on a profile or kingdom page are stored with your profile ID and counted on that page. The site no longer has comments: comments written before 9 October 2026, and the commenter blocks set on them, are not shown anywhere any more and are deleted with the profile or account they belong to.

RoKdle

RoKdle is the daily commander guessing game. Playing signed out stores nothing on the server: your guesses, today's board and your streak live only in your browser's local storage, together with a progress note the server signs after each guess (that day's guesses, so the next guess is checked against them rather than against your browser's word), and every guess is sent to the server to be checked without being kept. When you sign in, the boards you played signed out that day are carried into your account as your login's plays for that day (a puzzle your account already played that day keeps the play it has) and cleared from your browser. Playing signed in stores, against your login's main profile, the commanders you guessed for each day and mode, whether you solved it, the points earned, your streak and your totals. Those totals put you on the public weekly, monthly and all-time leaderboards, which show your display name, avatar, score and number of solves to everyone, including signed-out visitors and search engines. Your Governor ID and Discord ID are used to link your name to your profile page only when your profile is public; otherwise the row links by profile ID and shows only the name and an uploaded or premade avatar (never your Discord picture, whose address carries your Discord ID). Signing in is how you opt in to that, and it brings that day's signed-out boards with it; playing without signing in keeps you off the boards entirely. The page also shows the day before's answer in each mode, with how many signed-in players played and solved it and their average number of guesses: counts across every signed-in player, never who played. Linking two logins merges their RoKdle history into the kept profile. The rows belong to your login rather than to one profile, so deleting a secondary profile leaves them alone (apart from any history a merge left on that profile, which goes with it); deleting your account deletes them all and takes you off the leaderboards. One automated check runs on the stored plays: when a week ends, only one Classic puzzle a login solved on the first guess that week keeps its points, and every other Classic puzzle it solved on the first guess that week is set to zero points. Nothing else is changed or removed.

Any earlier RoKdle puzzle can be played for practice, signed in or out. A practice board stays in your browser's local storage (rok:rokdle:practice, the 60 boards you played last). Each guess sends the board's list of commanders to the server in the request's address, to be checked and not kept: nothing about it is stored, scored or tied to your account, and it counts towards no streak, though the address is in the request records for at most seven days like any other (see Browsing without an account). The stats panel shows how many guesses your solves took. Signed in, that is worked out from your stored plays and shown only to you, with a copy in your browser (rok:rokdle:dist: your login's ID and the counts): your next solve replaces it, and it is removed when this browser next opens a page here signed out. Signed out, it is counted in your browser with your other RoKdle stats.

While the profile you are using is an approved member of a kingdom, the page also offers that kingdom's own leaderboard, which that kingdom's approved members can open. Other members see you there only when your main profile is the member, with its name and avatar and your login's score and number of solves, whichever profile played. A secondary profile approved in a kingdom shows only on your own copy of that board, with its name and avatar: a score belongs to the whole login, so on a board others read it could be matched to your main profile's on the public boards. As on the public boards, a row links by Governor ID or Discord ID and shows a Discord picture only for a public profile. Your profile also shows a free badge once your login's best streak has reached 7, 30 or 100 days, to anyone who can see the profile; nothing else of the streak is shown.

Paid tiers

MetaRoK is free to use. Three paid memberships, Supporter, Strategist and Coaching, add extras. They are sold on Patreon, under Patreon's terms and privacy policy. Payment, billing, VAT, refunds and receipts all happen at Patreon. MetaRoK receives no payment or card details. The site learns your tier in one of two ways, and when both apply the higher tier counts: from the Discord role Patreon gives you, or from Patreon itself once you connect Patreon.

The Discord role. Patreon's own Discord integration gives a member a role for their tier in the Cortex Discord server. When you are signed in with a login that has a Discord account linked, the MetaRoK bot (the same Discord application you sign in with) asks Discord for your membership in that one server and reads only its list of roles. This needs no extra permission from you: the login still asks Discord for the identify scope only, and the site still never sees your email address or your list of servers. The check runs for everyone who is signed in with a Discord account linked, member or not, because that is how the site tells the two apart. A login with no Discord account linked is never checked.

Connect Patreon. Any login, Discord or Google, can connect the Patreon account it pays with, from any of its profiles, under Your perks on the pricing page or on the Account tab of your profile. You sign in on Patreon's own site, so MetaRoK never sees your Patreon password. The site asks Patreon for the identity scope only, never for your email address. It exchanges the one-time code Patreon sends back for an access token, uses that token for one read straight away and never stores it. From that read it keeps your Patreon user ID, your membership of MetaRoK's own Patreon page (no other creator's) and the ID of the Discord account you connected on Patreon, if any; Patreon's answer also lists any other accounts you connected there, which the site drops. Connecting Patreon is not a login: it never signs you in and never changes which profile you are signed in to.

What Patreon sends afterwards. Patreon keeps a connection current by sending the site a signed update whenever a membership of MetaRoK's Patreon page changes. It sends one for every member, whether or not they ever connected Patreon here, and each one carries that member's details, such as their name, email address and the IDs of other accounts they connected on Patreon. The site checks the signature, then picks out only the Patreon IDs, the membership status, charge dates and entitled amount, the tier IDs and the ID of the Discord account Patreon has for the member. Everything else in the update is discarded without being stored or logged, and an update about a patron who never connected Patreon here stores nothing about them at all.

What is stored, per login (every profile of the login shares one tier):

the tier the last Discord role check saw ("none" when you hold no paid role or are not in the server), the Discord user ID that was checked, when a paid role was first seen in the current unbroken run, and when the last check happened;
that same record doubles as the cache: a check less than about five minutes old is reused, so page views do not wait on Discord (each server copy also keeps the answer in memory for up to a minute);
if you connected Patreon: your Patreon user ID and member ID; the membership status, free trial and gift flags, charge status and dates, membership start and billing interval Patreon last reported; the tier IDs and the amount it said you are entitled to; the tier and the paid-until date the site works out from them, and whether you need to reconnect; when a paid tier was first seen on the connection and when its current unbroken paid run started (for the Founder frame); when Patreon last sent an update; when the connection was made and last updated; and the ID of the Discord account connected on your Patreon account. That Discord ID is never shown to anyone. It is used only to keep one membership from counting on two logins (the connection gives no tier while another login carries that Discord account and gets a paid tier through its Discord role) or earning two Founder frames. The connection is kept until you disconnect it, delete your account, connect the same Patreon account on another login (it moves there) or reconnect with a different Patreon account (which replaces it); a merge moves it, or, when both logins have one, keeps the connection that gives the higher tier (the main profile's when both give the same tier or neither gives one) and removes the other, as described under Signing in;
where an admin grants a complimentary tier: the tier, an optional end date, an optional note and which admin granted it;
a Founder record (a number, a date, and the Discord user ID and Patreon user ID behind it: the ones your login had when it earned the frame, plus whichever of the two it gains later by linking Discord or connecting Patreon; on a login with no Discord, the Discord account connected on your Patreon account) for the first 100 logins whose paid membership the site has seen without a break for 8 days or more: through the Discord role counted from the first check after you sign in with Discord, through Connect Patreon from the first time the connection showed a paid membership (never a free trial or a gift). Disconnecting Patreon keeps the record, Patreon user ID included;
for Strategist and above, which tier list move notices you dismissed, so the notification bell does not show them again. Until 18 October 2026 it also kept the last month whose Account Report you opened or dismissed; that record is no longer read or updated. The report itself is worked out from your profile each time it is opened and is not stored.

The Discord role records of paid members are re-checked from time to time even when they do not visit, so a cancelled membership is noticed; a Patreon connection is kept current by the updates Patreon sends. These records are kept while your login exists (a Patreon connection for the time given above) and are deleted with the rest of your account when you delete it (see Retention and deletion). Deleting your account gives up a Founder frame and its number, which can then go to the next member who qualifies; the same Discord or Patreon account can earn a frame again only from scratch (8 days without a break, counted anew), and only while places remain.

Badges and Founder frame. The paid-tier badge is opt-in per profile and off until you turn it on. Where it is on, it shows the tier name, and nothing else about your membership, on that profile and its showcase and on the RoKdle leaderboards, to everyone who can see those. A Founder can put the Founder frame on their avatar, where it shows like any other avatar frame.

Screenshot import and progress history

Supporters can fill in their profile from an in-game screenshot. You choose the screenshot in your browser, or paste it; a stats or armament screenshot is sent to be read the moment you choose it.

Stats and armament screens. The whole screenshot (a Governor Profile or More Info window, or a commander's Formation screen with its Armament Info) is converted to a JPEG image, scaled down when it is larger than the readers take (nothing else from your device) and goes to the MetaRoK server, which passes it to Anthropic's Claude API. Two different Claude models each read the names and numbers on it, so the two readings can be compared; on a Formation screen that is the formation, the inscriptions and the set's stat lines, and the server then matches each inscription against the site's own inscription list. Anthropic does not train its models on this traffic and keeps it only for a limited time under its own privacy policy. The result comes back to your browser. When everything on it was read for certain, your browser saves it straight away, exactly like an edit you make by hand, and lists what it saved. Otherwise (something not read for certain, or a stats screenshot that may be from another account) nothing is saved until you check it on a review screen (for stats, each value beside a snippet of your screenshot cut out on your device), and only what you confirm there is saved (the stats you tick, or the armament set you add). The models see everything on the image, so if it shows something you would not want read (chat, other players), crop it on your device before you choose it.
Screenshots kept to improve the reader. The import window has a "Keep a private copy" box, ticked to start with, that lets MetaRoK keep a copy of the stats or armament screenshot it sends to the models, with what each model read from it, the result sent back to your browser, the time, and which login and profile imported it. Untick it before you choose or paste a screenshot and nothing from that import is kept; the window remembers an unticked box on that device, in your browser's local storage. The copies are kept so that misreads players report can be looked into and the readers checked again on real screenshots, and for nothing else. They are stored privately in Cloudflare R2, never shown on the site or to other players, and only site admins can open them; they are not shared with anyone. Each one is deleted 90 days after the import, and at once when you delete the profile it was imported to or your account. A screenshot turned away before it reached the models (no membership, the monthly allowance used up, too many at once) is not kept.
Equipment screens never leave your device: the pieces are matched against the site's own equipment icons in your browser, unless you send one with a report (next).
Reporting a misread. The import window's "Something read wrong?" sends MetaRoK a report: your note, if you write one (at most 500 characters), with which login and profile sent it. For an import whose copy was kept, the report points at that copy. An equipment screenshot, or a stats or armament screenshot whose copy you chose not to keep, goes with a report only when you tick the box that says so (ticked to start with): it is then kept privately like those copies, with what the import showed you, for 90 days. A report is deleted once it is more than 90 days old, the next time anyone sends a report or an admin opens the list of reports, and at once when you delete the profile that sent it or your account. Only site admins see reports; a report changes nothing on your profile.
Monthly allowance. The server counts stats and armament imports together per calendar month (one number and the month, kept for each Discord and Google account linked to your login) and deletes the count after its month is over. The count belongs to the Discord or Google account, not to your MetaRoK profile, so it is kept when you unlink that login or delete your account, until its month is over: deleting your account and signing in again does not reset the allowance.
Progress history. Each saved stats import adds a dated record of the numbers it saved or found unchanged (power, kill points, dead troops, highest acclaim, and units killed, healed and lost) to that profile's history. On every account, with a membership or without, changing your power or kill points on your profile adds one too, holding both as saved (nothing is added while they match your latest record). Changes less than ten minutes after a record was started update that record instead of adding one, and a profile keeps its 500 newest. Only you can see your history; it is not shown on your public profile. It stays readable if your membership ends, and it is deleted with the profile, or with your account. You can remove any record on the Progress tab, or save the whole history as an Excel file there (made in your browser).
When your stats changed. Your profile also keeps the date its stats last changed (the day in UTC, not the time), whether you edited one or an import saved or confirmed them. It is part of your profile like the stats themselves: anyone who can see your profile can see it. Your march showcase, and the images saved from it, print it only if you turn that on in your profile editor; it is off unless you do. An image saved while it showed keeps it. So does a link preview made then, until you next save your showcase as an image in your profile editor, turn the preview off or make your profile anything but public.

Coaching calls

Coaching members get one live 30-minute call a month with Cortex. Calls are booked in the Coaching members' channel on the Cortex Discord server or by direct message with Cortex on Discord, under Discord's own terms; no other booking tool is used, and MetaRoK stores nothing about the booking. For the review, Cortex may look at the profile you share on meta-rok.com. Nothing from the call is published.

We keep a short log of your coaching calls (the date, how long it took and a note by the coach). Only admins see it, and it is deleted with your account.

Governor ID reports

If someone else's profile holds your in-game Governor ID, you can file a report. The report stores your profile ID, your display name and, when that profile has a Discord account linked, your Discord user ID, the Governor ID, the profile holding it when you filed, a required in-game screenshot and an optional message. The screenshot is private: it is kept in Cloudflare R2, is never served at a public address and only site admins can open it. Reports are reviewed by site admins, who can release the ID from the profile holding it, give it to you, or dismiss or delete the report. Your notification bell tells you how your report ended, and tells the player whose profile the ID was taken from that it was released or given to the player who reported it, without saying who that was (see Account notices under Signing in). Reports are kept so that repeat disputes can be understood. A report and its screenshot are deleted when an admin deletes the report, and when the profile that filed it is deleted, on its own or with your account. A report someone else filed about a Governor ID one of your profiles held stays with them; only its link to the deleted profile is removed.

Feedback

The Feedback button sends your message together with the page you were on, the profile you sent it from, your display name and, when that profile has a Discord account linked, your Discord user ID and username, so the site owner can follow up. Feedback is visible only to admins, and it is deleted with the profile you sent it from, or with your account.

An admin may reply to a message you sent with the Feedback button. The reply is kept with your message and deleted with it. Your notification bell tells you about the reply with an account notice, which keeps the reply and the first 80 characters of your message and is kept and deleted like the others (see Account notices under Signing in), so it can outlive the message. Messages sent through the contact form are answered by email (see Contact form).

Contact form

The contact form works with or without signing in. It stores your message, the email address you give for the reply and, if you fill it in, your name; if you are signed in, it also records your profile, your display name when you leave the name empty and, for Discord logins, your Discord user ID and username. When you report a mistake from a page, the form also stores that page's address. Messages land in the admin inbox, visible only to admins, and nothing is emailed automatically: the reply is written to the address you gave. Your IP address is used as a rate-limit key in short-lived storage for up to an hour. A message sent while signed in is deleted with the profile it was sent from, or with your account. A message sent while signed out is linked to no profile, so it stays in the inbox until an admin deletes it; you can ask for yours to be deleted at any time.

Cookies and browser storage

__Host-rok_session (called rok_session before November 2026; one set under that name before the change is still read until 15 December 2026, and cleared when the new one is set): set when you sign in. A signed token that identifies your active profile. It also records which of your logins (Discord or Google) signed that browser in, as a one-way fingerprint rather than that account's ID, so that unlinking the login signs out every browser it signed in, and when that sign-in happened, so that changes to your logins and deleting your account can ask for a fresh one (see Signing in). Renewed once a day while you use the site, it is kept for 30 days after your last visit, and never more than 90 days after you signed in, after which you sign in again. It is not readable by page scripts, is only sent over HTTPS, and no other site, subdomains of meta-rok.com included, can set or replace it. Signing out, "Sign out everywhere" or deleting your account clears it in that browser; in any other browser where you were signed in, it stops working the next time that browser talks to the site after "Sign out everywhere", unlinking a login from another browser, or the deletion.
__Host-rok_active: set while you use one of your secondary profiles (see Your profile), for 30 days. It holds only that profile's ID, so your next sign-in in this browser opens that profile instead of your main one; the site uses it only when the profile still belongs to the login you sign in with. It is not readable by page scripts and is only sent over HTTPS. It is cleared when you switch back to your main profile, when you sign in again from a prompt that needs your main profile, and when you sign out everywhere or delete your account; signing out keeps it.
__Host-rok_oauth_state and __Host-rok_oauth_next: set for ten minutes while a login, or connecting Patreon, is in progress, to protect it against forgery (random values and, for a login, a signed note of when it started, so the site refuses it after ten minutes) and to return you to the page you came from. They are cleared as soon as the login or the connection completes or fails, and by signing out, signing out everywhere or deleting your account.
__Host-rok_oauth_link: set for ten minutes while you are linking a second login or connecting Patreon. It holds a signed note of which profile started the link (for Patreon, which login), so what comes back can only be attached to that profile or login from that browser. It is cleared when the link or the connection completes or fails, and by signing out, signing out everywhere or deleting your account. Like the two above, it is not readable by page scripts, is only sent over HTTPS, and no other site, subdomains of meta-rok.com included, can set or replace it.
rok_in: set to 1 while you are signed in, renewed for 30 days on each visit. Page scripts can read it, so a page can keep the room for what you see signed in (your account menu, your profile editor, your plan) and start loading it before your login has been checked, and so the graphic maker does not ask for your profile while you are signed out. It holds nothing about you and grants nothing. It is cleared when you sign out, sign out everywhere or delete your account, or on your next visit after your login has ended; otherwise it expires 30 days after your last visit.
rok_adfree: set to 1 for 30 days when you are signed in with a paid tier. It is readable by page scripts on purpose: a page reads it before loading anything else, so it can skip the ad and consent scripts entirely. It is cleared when you sign out, sign out everywhere or delete your account, and when your tier ends. It is only a display hint and grants nothing: every paid feature is checked on the server.

MetaRoK itself sets no analytics or advertising cookies, and its analytics uses none (see Analytics). On the pages that show ads, Google and its partners may set their own cookies, and Google's consent message stores your choices in its own cookies (see Advertising). The site also uses your browser's local storage for display preferences (for example the height of the tier list maker's unranked pool) and session storage to carry an unsaved tier list or talent build across a sign-in; both stay on your device. Session storage also holds rok-pricing-join: which tier's Patreon checkout you opened from the pricing page and when, for the reminder to connect Patreon when you come back; it is gone when the tab closes. It also holds rok-tab-seen: that this browser tab has already opened a page of the site, for the first-page rule under Advertising; it is gone when the tab closes. A small board, whose page address after meta-rok.com is 200 characters or fewer, also travels in the sign-in request itself, as Browsing without an account describes. Local storage also holds rok_nav, a copy of what the header's account area last showed you (your profile's name and picture, your paid tier, your kingdom number and whether you lead it, whether you are an admin, how many notifications you had, how many applications were waiting in a kingdom you lead, and how much room it took), the same for the other profiles on your login that you switched between on that device, and a short-lived note that you just started a login or a profile switch, so the next page draws the header at once instead of shifting while the site checks your login. It is refreshed on every page, is never sent to the server and grants nothing: what you can see and do is still decided by the server on every request. When you sign out, delete your account or the site finds you signed out, it is emptied except for the sizes the header took, which say nothing about who you are. Local storage also keeps rok:changelog:seen, the newest changelog release your browser has seen, so the footer's Changelog link can mark a newer one with a dot; it is never sent to the server. On the tier lists it keeps rok-install: how many times you opened a tier list, when you last dismissed the hint to add MetaRoK to your home screen, and whether the site was installed, since a phone or tablet shows that hint from the second tier list you open, not again for 60 days after you dismiss it and never once the site is installed; it is never sent to the server. In the profile editor it keeps two keys per profile, rok-setup-hidden: and rok-setup-shared: followed by that profile's id: that you hid its setup checklist on this device, and that the checklist's Share step counts as done on this device (you shared or copied the profile's link or saved its showcase image here, it had a link preview, or it was already set up but for that step); neither is ever sent to the server. A service worker keeps a copy of the site's own artwork and of the four tier list pages (Open Field, Rally and Garrison, Swarming and Investment) on your device, for speed and offline use. It ignores requests to other websites entirely (ads, Google's consent tools, Discord avatars): those go straight to the network. What the graphic maker keeps in your browser (its IndexedDB storage and its gm- local storage entries) is listed under Graphic maker.

Third parties

Cloudflare hosts the site. The pages and the server code (a Cloudflare Worker), its logs, the database (D1), the cache (KV) and uploaded images, report screenshots, the graphic maker's images and kept import screenshots (R2) all run on Cloudflare's infrastructure, and Cloudflare Web Analytics counts the visits (see Analytics). Requests are subject to Cloudflare's privacy policy.
Google AdSense and Google's consent tools show the ads and the consent message on the ad pages, for visitors without a paid tier, as described in Advertising.
Discord handles the Discord login, and the MetaRoK bot asks Discord for your roles in the Cortex Discord server (see Paid tiers); Coaching calls are booked there too (see Coaching calls). Google handles the Google login. Their own policies apply to what they record about that sign-in. If you use a Discord avatar, your browser loads it from Discord's image servers when it is displayed.
Patreon sells the paid tiers and handles payment, under its own terms. The site links to Patreon and embeds nothing from it. If you connect Patreon, you sign in on Patreon's site (its own policies cover what it records about that) and Patreon sends the site your membership; it also sends signed updates about every member of MetaRoK's Patreon page, of which the site keeps only what Paid tiers describes.
Anthropic reads, through its Claude API, the stats and armament screenshots a Supporter chooses to import (see Screenshot import). Nothing else is sent to it.
codexhelper.com provides the kingdom leadership roster and the speedup tracker scans, as described above. The site reads from it; the only things it sends are the Governor IDs and Discord user IDs of the players whose scans it is asking for.
YouTube and Discord are linked from the footer. Following a link takes you to their site under their terms.

Moderation and admins

A small number of admin accounts, identified by Discord ID, can view every profile and kingdom regardless of visibility, read feedback, contact messages and Governor ID reports with their screenshots, resolve Governor ID disputes, see the paid-tier records described above (for a Patreon connection, on the Subscribers and Coaching tabs, its tier, paid-until date and state, never a Patreon ID or the Discord account connected on Patreon), grant or end a complimentary tier, re-check a login's tier, open any profile's Account Report, with the list of profiles on its login, to prepare a Coaching call, and look at the import screenshots kept to improve the reader, with what was read from them (see Screenshot import). Admin access exists to run the site and handle abuse, not to browse private data for its own sake.

Retention and deletion

Your data is kept for as long as the profile it belongs to exists, and what belongs to your whole login (saved tier lists and talent builds, saved graphic designs and brand kits with their images, RoKdle, paid-tier records, a Patreon connection) for as long as your account exists; a Patreon connection can end sooner, as Paid tiers describes. Some records go on their own sooner: speedup tracker scans about 400 days after the scan, kingdom invitations and pairing suggestions at the latest 90 days after they were sent, the lines of a kingdom's leader log after 180 days, dismissed account notices once they are 90 days old (at your next dismiss), and kept import screenshots 90 days after the import (see each section). You can edit or clear any profile field yourself, delete a secondary profile, and delete your whole account.

Secondary profiles can be deleted from the Account tab of your profile (under "Profiles on this login") or from the profile switcher in the avatar menu. Deletion removes the profile and everything attached to it: the likes it gave and received, any comments and commenter blocks left from before comments were removed, leader notes left on it, the invites and pairing suggestions addressed to it, its captain slots and manual king or officer promotions, the feedback and contact messages sent from it, the Governor ID reports it filed with their screenshots, its progress history, its uploaded images and the import screenshots kept from it, plus any RoKdle history or paid-tier records a merge left on it. Your main profile, your other profiles, your logins, your account notices (the notice of a reply to feedback sent from the deleted profile keeps the reply and the first 80 characters of that message), your saved tier lists and talent builds, your saved graphic designs and brand kits with their images, your RoKdle history and your speedup tracker data stay.
Your whole account is deleted from the Account tab of your main profile (from a secondary profile, switch to your main profile first): choose "Delete my account...", type DELETE and confirm. That permanently deletes your main profile and every secondary profile, each with everything listed above; your Discord and Google logins on this site (the Discord and Google accounts themselves are not touched); your saved tier lists and talent builds; your saved graphic designs, brand kits and the images uploaded to them; your RoKdle history and leaderboard places; your paid-tier records (the role checks, your Patreon connection, any complimentary tier, a Founder record and the Strategist notification state); the speedup tracker data described under Kingdoms and leadership; the notes you left and the pairing suggestions and invites you sent as a kingdom leader, and invites sent to your Discord account; every king or officer promotion you held; your account notices; and every uploaded image (a link preview and a saved board's short link picture included), report screenshot and kept import screenshot. It signs you out in that browser, and any other browser signed in to the account loses its session the next time it talks to the site. Signing in again later starts a new, empty account.
A paid membership is cancelled at Patreon. Deleting your account, disconnecting Patreon or unlinking Discord does not cancel it or stop its billing, and cancelling it does not delete your MetaRoK data. Deleting your account also gives up a Founder frame and its number; disconnecting Patreon does not (see Paid tiers).

Deleting your account does not reach:

the monthly screenshot import count, which is keyed on your Discord and Google account IDs and kept until its month is over (see Screenshot import);
the request records in Cloudflare's Workers Logs (see Browsing without an account), including the line that logs the deletion, which Cloudflare deletes after at most seven days;
the visit totals in Cloudflare Web Analytics, which are not linked to you (see Analytics);
copies of uploaded images in the caches of browsers that loaded them, which can persist for up to a year after deletion, and copies of a link preview that an app which showed it keeps under its own rules;
copies of public reads held in Cloudflare's edge cache (kingdom pages and captain lists, like counts, leadership badges, profile, kingdom and saved board link preview cards and the RoKdle leaderboards), for up to about a minute;
a kingdom's RoKdle leaderboard as a server last read it, with your name, avatar and score on it, which that kingdom's members can still be shown for up to a minute, or up to ten minutes for a week or month that is over;
the RoKdle page's counts for the day before (how many signed-in players played and solved each puzzle, and their average number of guesses), which are not linked to you and can still count your plays until the next 00:00 UTC (see RoKdle);
rate limit counters: those tied to your login or your IP address expire within an hour, except the graphic maker's count of checks for images nothing uses, tied to your login, which expires within a day, like the limit on account deletions, keyed on your Discord and Google account IDs;
king or officer promotions and captain slots you gave other members of your kingdom, which stay with them, with your Discord ID and name removed from the record (those you gave under a Discord account you unlinked earlier keep that account's ID, and a promotion the name you had);
a kingdom's leader log lines by you or about you, which stay with that kingdom until their 180 days are over, with your name, Discord ID and profile link removed, and the approvals you gave other members, which stay with them (the date they joined) without your Discord ID (those lines and approvals, when you made them under a Discord account you unlinked earlier, keep that account's ID, and the lines the name you had; see Kingdoms and leadership);
Governor ID reports other players filed about an ID one of your profiles held, which stay with them without the link to your profile;
contact messages you sent while signed out, which are linked to no profile; ask for them to be deleted through the contact form;
speedup tracker scans stored for a Discord account you unlinked before deleting (see Kingdoms and leadership);
Cloudflare's point-in-time recovery for the database, which can restore it to any minute of the past 30 days at most, so deleted rows stay recoverable there until they are older than that;
what Patreon, Discord, Google, codexhelper.com and Anthropic hold, which their own policies cover;
what your own browser keeps in its local storage (RoKdle played signed out and your practice boards, display preferences, in another browser you were signed in on, the header's copy of your name until that browser next opens a page here, and in any browser you played RoKdle in while signed in, the copy of your guess counts until that browser next opens a page here) and the graphic maker's drafts, pictures, cutouts and fonts in its IndexedDB storage, until you clear it.

Contact

Questions about this policy, requests for a copy of the data held about you, and requests to delete anything you cannot delete yourself (such as a contact message sent while signed out) go to the contact form or to the Cortex Discord server. Changes to this policy are posted on this page with a new "last updated" date, and notable changes are also listed in the changelog.