FF
PRIVATE PILOT DATA POLICYUseful history.
Bounded retention.
FactionForge keeps enough evidence to explain activity, wars, and payouts while limiting how long detailed observations and credential-bearing backups remain.
Time-bound detail Immediate live-key deletion Faction-scoped access
PILOT POLICY · UPDATED OCTOBER 3, 2026
Retention and deletion
This policy applies to the private faction pilot.
- Roster and activity
- Raw snapshots are retained for 90 days.
- Battle stats
- Only a player’s own key can supply their API battle-stat snapshot. It remains under their Torn player ID after sign-out or key disconnection until replaced, manually deleted on request, or the faction account is deleted. The faction battle-stats view keeps the latest snapshot; Chain Target audit and review history can retain earlier values. New players’ contributed stats are visible to current faction members by default; each player can select “Hide from Faction” at any time. This hides stats from other ordinary members, while the player, current faction leadership, and authorized faction admins retain access, including for previously hidden snapshots. Verified platform root administrators can view stored snapshots across factions, including former members, through an audited directory.
- Member dashboard
- Vault collection stores only faction money and points from your money response; other personal wealth is discarded. Members see their own balances, requests, notifications and recognition awards. Current authorized faction leadership can see the faction vault snapshot and request queue, including request notes and payment or fulfillment references. Requests, rule versions and reward awards stay with the faction account to explain reservations and fulfillment. Banker confirmation is not independent proof from Torn.
- Personal reminders and training
- Each reminder and daily training collection is opt-in. The dashboard exposes these observations only to their owner, including when that owner hides battle stats from ordinary faction members. No leadership or root daily-history view is provided. The enabled member worker retains up to 366 daily training snapshots and removes expired inbox entries: predicted reminders expire one day after their due time, and request updates after seven days. Readiness keeps only the latest selected observation; disabling reminders clears it and removes notifications for disabled categories. Stopping training preserves existing daily history until expiry; Delete daily history erases it and stops collection. Disconnecting stops key use but preserves saved preferences, balances and records. These controls do not erase separately contributed Battle stats or Chain Target records. If the worker is disabled, pilot retention remains an operator responsibility.
- Chain Target profiles
- Verified sign-in records your name, current faction, activity and status, plus battle stats if your key permits them. This profile starts hidden, and a platform root can approve it for other signed-in players to view as a target, including its saved stats and observation times. The target board may show a labeled stat-only win estimate and possible respect range based on those records. Root approval is separate from your “Hide from Faction” choice for faction-shared battle stats. Root administrators can also import and correct target records. A profile remains after key disconnection until updated or handled through a deletion request. With the current sign-in consent, background jobs refresh approved targets’ public profile details and registered players’ own profiles; private battle stats are refreshed only with that player’s own permitted key. Legacy keys are not enrolled until a new sign-in accepts this notice. Background refreshes never approve a target or replace a root-locked field. Disconnecting stops use of your key, but an already approved public profile can still be refreshed using another consenting key. Imports, corrections and applied background changes are audited.
- Wars and payouts
- Detailed war snapshots and events are retained for 180 days. Completed-war summaries and finalized payouts remain while the faction account exists.
- Target contribution history
- Root-authorized contributors can submit target information for review. Submitted data, contributor Torn IDs, decisions, reviewing root Torn IDs, reasons and the comparison evidence recorded at review are retained to explain accepted and rejected changes. Contributors can read only their own submitted data and review status. Hidden target records, other contributors’ submissions, API stat comparisons and the complete review log remain root-only. Revoking contribution access stops new submissions without erasing this history. Deletion requests follow the manual pilot process below.
- Departed members
- History is retained for 180 days, except records required to explain a finalized payout.
- Security records
- Routine security logs are retained for 90 days. Chain Target correction and import history stays with its target record so root administrators can explain later changes.
- Billing and internal points
- The local billing preview records trial claims, access terms, point awards, point spending and provider subscription/payment identifiers for reconciliation. Webhook storage keeps event identifiers and payload hashes, not complete payment payloads. Provider credentials are encrypted and available only to the server; old versions remain available to service their existing contracts. Root settings show metadata, not stored secrets. Internal points are not cash or Torn points. Faction Leaders and family owners can subscribe through configured live Stripe or PayPal checkout. Sandbox checkout is restricted to platform root testing. Payment details are entered on the provider’s website, not stored by FactionForge. Financial-record retention and erasure must be finalized before public paid launch.
- Torn API keys
- Disconnecting removes the live encrypted key immediately and revokes all sessions. Encrypted backup copies expire within 30 days.
- Backups
- Production-host backups are kept for 14 days; the independently access-restricted Mac copy is kept for 30 days.
- Account deletion
- During the private pilot, the operator completes account or faction deletion requests manually within 30 days.
- Pilot limitation
- Application-row retention is enforced manually until automated aggregation, expiry, and verified erasure ship. The service will not open as a public paid product before those controls exist.
Scoped access and audited administration.
Ordinary workspace access remains faction-scoped. Authorized platform roots can inspect recorded faction members, activity, wars, payouts, operations and stored battle stats through MFA-protected, audited views. Each player’s privacy choice controls what ordinary faction members can see; current faction leadership and authorized faction admins retain access to hidden stats, and the choice does not restrict the root battle-stat directory. Family managers see audit metadata only for currently associated factions and their agreed history-sharing window. API keys, session tokens and authenticator secrets are never shown in support views.