HT Alchemy Privacy Policy

1. About this policy

HT Alchemy is an independent CHPP application for Hattrick. It is not operated by Hattrick Ltd.

This policy explains how HT Alchemy handles information when you connect your Hattrick account and use its youth, senior, Transfer Market, Club Chronicle, match-order, reminder, analytics, feedback, and related functions.

HT Alchemy is designed around the following privacy principles:

1. Persistent team-related data remains in the browser on the user’s device.
2. HT Alchemy does not maintain a central database of users, teams, players, matches, lineups, or other Hattrick team data.
3. HT Alchemy does not perform account-changing Hattrick actions automatically.
4. Every Hattrick write operation requires both an appropriate CHPP permission and a deliberate user action.
5. Optional analytics and feedback processing occur only after the user chooses to enable or submit them.
6. Information about other Hattrick teams is obtained only from data that Hattrick makes publicly available and exposes through its authorised interfaces.
7. HT Alchemy does not bypass Hattrick security, access private accounts, exploit vulnerabilities, impersonate users, or use any other unauthorised method to obtain information.

These principles reflect the transparency, purpose limitation, data minimisation, security, retention, and user-control principles described in Hattrick’s privacy policy.

2. Local-first storage of team data

HT Alchemy does not operate a server-side user-account or team-data database.

It does not centrally store persistent copies of:

• your teams or academies;
• your players;
• your matches;
• your lineups;
• your match orders;
• your training information;
• your transfers or bids;
• your saved Transfer Market searches;
• your opponents;
• your Club Chronicle information;
• your reminders;
• your simulations; or
• your calculated or predicted results.

When HT Alchemy requests information from Hattrick, the request passes through an HT Alchemy server route. This is necessary because CHPP access credentials must be protected from browser JavaScript.

The server route uses the authorised CHPP session to request the selected information from Hattrick and returns the result to the user’s browser. The response is processed transiently for that request. HT Alchemy is designed not to write returned team data to a permanent server-side database.

Any persistent team-related data retained by HT Alchemy is stored in the browser on the user’s own device, mainly through:

• localStorage; and
• IndexedDB.

The project uses local settings, persisted interface state, and IndexedDB-backed data as its principal persistence mechanisms. No permanent team-data database is required for the application architecture.

Club Chronicle data is stored locally in IndexedDB. Records may contain cached panel data, comparison baselines, detected updates, update history, and update timestamps.

HT Alchemy does not automatically synchronise locally stored team data between devices.

HT Alchemy does not intentionally send locally stored player, team, match, lineup, transfer, training, or Club Chronicle data to:

• analytics providers;
• advertising providers;
• data brokers;
• GitHub;
• YouTube; or
• general-purpose artificial-intelligence services.

3. Hattrick authorisation

You must connect HT Alchemy to Hattrick through Hattrick’s CHPP authorisation process before HT Alchemy can access protected information relating to your own Hattrick account.

HT Alchemy does not receive, request, or store your Hattrick password.

During the CHPP connection process, you select which optional permissions to grant. Depending on the permissions selected, HT Alchemy may be authorised to:

• read Hattrick information;
• place a transfer bid;
• submit match orders;
• change senior training; or
• perform another operation expressly covered by the selected CHPP permission.

Optional write permissions are not required for unrelated read-only functions.

Declining a write permission prevents HT Alchemy from using the corresponding write function.

Granting a permission does not itself cause any write operation to be performed.

4. Protection of CHPP credentials

The CHPP access token and access-token secret are stored together in an encrypted and authenticated HttpOnly cookie.

The cookie contains encrypted session data. It does not contain the encryption key.

The encryption key:

• is held in server-side environment configuration;
• is not stored in localStorage;
• is not stored in IndexedDB;
• is not placed inside the CHPP session cookie;
• is not sent to the browser;
• is not available to browser JavaScript; and
• is not available through the user’s local HT Alchemy data.

The server obtains the encryption key from the server-only CHPP_COOKIE_SECRET environment variable and uses AES-256-GCM to encrypt and authenticate the CHPP session.

Because the cookie is HttpOnly, ordinary browser JavaScript cannot read the encrypted CHPP token or secret. In production, the cookie is also marked Secure and uses SameSite=Lax.

The CHPP session expires no later than 16 weeks after it is created.

Temporary OAuth request cookies are cleared after the authorisation process completes or fails.

Rotating or removing the server-side encryption key invalidates existing encrypted CHPP session cookies because the server can no longer decrypt them.

5. Disconnecting HT Alchemy

You can disconnect HT Alchemy from Hattrick.

When you disconnect:

• HT Alchemy attempts to invalidate the CHPP token at Hattrick;
• the encrypted CHPP session cookie is cleared;
• temporary OAuth cookies are cleared; and
• the browser can no longer use the previous HT Alchemy CHPP session.

The local session is cleared even if Hattrick’s token-invalidation endpoint cannot be reached.

Disconnecting CHPP does not necessarily delete locally cached team data. Local browser data can be removed separately through HT Alchemy’s Storage Management functions or through the browser’s site-data controls.

6. No automatic Hattrick actions

HT Alchemy does not independently or autonomously:

• submit a lineup;
• submit match orders;
• change a tactic;
• change a team attitude;
• add a substitution;
• set man marking;
• place a transfer bid;
• change training;
• buy or sell a player;
• send a Hattrick message; or
• make another change to your Hattrick account.

Every operation that changes data in Hattrick requires:

1. the relevant CHPP write permission granted by the user; and
2. a deliberate action by the user in HT Alchemy.

Granting a CHPP permission by itself does not cause HT Alchemy to perform an action.

A recommendation, predicted rating, simulation, optimiser result, reminder, warning, or suggested lineup does not automatically cause a Hattrick write operation.

HT Alchemy may perform read-only requests or local calculations as part of a feature that the user has deliberately opened, enabled, or requested. For example, it may:

• refresh information requested by the user;
• retrieve information required by an opened tool;
• calculate a recommended lineup;
• calculate Team Spirit;
• calculate predicted ratings;
• analyse an opponent;
• update a locally displayed result; or
• determine whether a locally configured reminder is due.

These read-only and local operations do not modify the user’s Hattrick account.

HT Alchemy does not use automated decision-making that produces legal or similarly significant effects concerning a person.

7. Hattrick information processed

The exact information processed depends on the functions the user chooses to use.

HT Alchemy may process:

• Hattrick manager user ID and login name;
• Supporter status;
• granted CHPP permissions;
• team and academy IDs and names;
• leagues, cups, fixtures, and competition information;
• senior and youth player information;
• skills, ratings, form, stamina, experience, loyalty, age, wages, TSI, injuries, and specialties;
• match history, events, results, formations, tactics, and sector ratings;
• lineups, substitutions, behaviours, attitudes, set-piece takers, and man-marking selections;
• training and staff information;
• transfers, listings, bids, transfer searches, and market-price information;
• arena, fan club, coach, press, login, and Club Chronicle information;
• opponents and other Hattrick teams deliberately selected for analysis;
• reminders and relevant dates;
• locally entered simulations and overrides; and
• calculated, inferred, estimated, recommended, or predicted values.

This information is processed only to provide the Hattrick-related function selected by the user.

8. Information concerning other Hattrick teams and users

Some HT Alchemy functions can analyse or infer information relating to teams, managers, or players belonging to other Hattrick users. Examples include:

• opponent analysis;
• Transfer Market searches;
• Club Chronicle watchlists;
• league analysis;
• fixture analysis;
• transfer comparisons;
• likely training assessments;
• formation or tactic assessments;
• player-position assessments; and
• other game-related estimates derived from available match and team information.

8.1 Only publicly available Hattrick information is used

All such analysis and inference is based exclusively on information that Hattrick itself makes publicly available about the relevant team, manager, player, match, transfer, or competition and exposes through Hattrick or its authorised CHPP interfaces.

HT Alchemy does not obtain access to another user’s private Hattrick account.

HT Alchemy does not use another user’s password, CHPP token, session cookie, private messages, unpublished match orders, private team settings, or other information that Hattrick has not made publicly available.

Where HT Alchemy infers information, it does so by calculating or estimating from publicly available Hattrick game data. For example, it may compare publicly visible matches, player appearances, formations, ratings, transfers, or other historical game information.

An inference produced by HT Alchemy is not hidden information obtained from Hattrick. It is an estimate produced by applying calculations or rules to publicly available information.

8.2 No hacking, circumvention, or unauthorised access

HT Alchemy does not use and is not designed to use:

• hacking;
• exploitation of security vulnerabilities;
• password guessing;
• credential theft;
• token theft;
• account impersonation;
• session hijacking;
• access-control bypasses;
• scraping of restricted or private areas;
• interception of another user’s communications;
• unauthorised API access;
• manipulation of Hattrick systems;
• automated probing of private endpoints;
• reverse engineering intended to defeat access restrictions; or
• any other underhanded or unauthorised method

to obtain information concerning another Hattrick user.

HT Alchemy relies on Hattrick to determine which information is publicly available and which information CHPP products are authorised to access.

If Hattrick does not expose information as public or available through an authorised interface, HT Alchemy does not attempt to circumvent that restriction.

8.3 Purpose limitation

Public Hattrick information concerning other users is processed only to provide the game-related feature selected by the HT Alchemy user.

HT Alchemy does not use this information to:

• identify a manager outside Hattrick;
• discover a person’s real-world identity;
• create a commercial profile of a natural person;
• build an advertising audience;
• combine it with external personal data;
• contact the other manager outside Hattrick;
• monitor private activities;
• maintain a central cross-user database; or
• train a general-purpose artificial-intelligence model.

8.4 Local storage of results

Where an analysis of another Hattrick team is retained, the resulting public data, cache, estimate, or inference is stored locally in the requesting user’s browser.

It is not added to a central HT Alchemy database of other users or teams.

8.5 Accuracy of inferences

Calculated or inferred information may be incomplete, outdated, or incorrect.

HT Alchemy does not represent an inference as confirmed private knowledge about another user. Users should treat inferred values as game-related estimates based on the publicly available Hattrick information that existed at the time of analysis.

9. Information stored locally in the browser

HT Alchemy may store the following information locally:

• application settings;
• selected language;
• selected currency;
• layout and display preferences;
• analytics-consent choice;
• selected teams and academies;
• cached player and team data;
• cached Hattrick responses;
• match and lineup state;
• manually entered or simulated values;
• lineup exclusions;
• optimisation settings;
• saved Transfer Market searches and profiles;
• transfer-search results and market summaries;
• Club Chronicle tabs and watchlists;
• Club Chronicle caches, baselines, detected updates, and update history;
• analyses and estimates relating to publicly available information about other Hattrick teams;
• Team Spirit settings and calculations;
• reminders, snooze state, and dismissal state;
• freshness timestamps;
• user-modification timestamps;
• locally generated estimates and recommendations; and
• other information required to restore the application state.

This data remains in the browser profile and on the device where it was stored.

It is not automatically uploaded to a central HT Alchemy database.

It is not automatically transferred to another device.

It is not automatically shared with another HT Alchemy user.

HT Alchemy may also use encrypted HttpOnly essential or functional cookies to retain browser-specific application access or state. These cookies are not used for advertising, are not sold, are not included in settings exports, and do not store inferred player values.

10. User-initiated export and import

HT Alchemy may offer functions for exporting, importing, or transferring local application data.

These functions operate only when initiated by the user.

A user may deliberately:

• export local settings;
• import previously exported settings;
• transfer Club Chronicle watchlists;
• create or scan a transfer QR code; or
• restore application data from a local backup.

HT Alchemy does not automatically export or transmit this information.

Exported files or QR codes may contain locally stored application information. The user is responsible for:

• storing exports securely;
• not sharing QR codes with unauthorised persons;
• deleting old backups when no longer required; and
• understanding that imported data may replace existing local data.

11. Access to locally stored data

Browser storage is not an encrypted personal vault.

A person who has access to the user’s:

• device;
• operating-system account;
• browser profile;
• browser developer tools; or
• exported backup files

may be able to inspect locally stored HT Alchemy information.

The CHPP session credentials receive additional protection because they are stored inside an encrypted HttpOnly cookie and the encryption key is available only to the server.

Team-related data stored in localStorage or IndexedDB is not protected by that CHPP-cookie encryption key.

Users should avoid using HT Alchemy on a shared or untrusted browser profile unless they accept that another user of that profile may be able to access the locally stored information.

12. Deleting local information

Users can remove locally stored HT Alchemy information by:

• using HT Alchemy’s Storage Management functions;
• resetting relevant application settings;
• deleting saved searches or profiles;
• deleting Club Chronicle tabs or watchlists;
• dismissing or deleting reminders where supported;
• clearing cookies;
• clearing localStorage;
• clearing IndexedDB; or
• clearing all site data through the browser.

Deleting browser data may remove:

• the CHPP session;
• cached team and player information;
• application settings;
• saved searches;
• reminders;
• watchlists;
• simulations;
• historical comparison data;
• estimates concerning other publicly visible Hattrick teams; and
• other locally persisted state.

After deletion, the user may need to reconnect to Hattrick and configure the application again.

13. Technical request information

When a user accesses HT Alchemy, the hosting infrastructure necessarily processes limited technical information required to deliver and secure the service.

This may include:

• IP address;
• request date and time;
• requested URL or server route;
• HTTP method;
• response status;
• browser user agent;
• referral information;
• hosting request identifier;
• deployment identifier;
• security information; and
• error or diagnostic information.

This technical processing is separate from the persistent team data stored in the browser.

HT Alchemy is designed not to include CHPP tokens, CHPP secrets, or the server-side encryption key in ordinary production logs.

OAuth error logging may include limited technical details such as:

• request host;
• request route;
• response status;
• error code;
• OAuth processing phase; and
• hosting request identifier.

Production logging deliberately limits detailed error output.

14. Analytics

HT Alchemy includes Google Analytics and Vercel Web Analytics.

Neither analytics system is loaded unless the user explicitly grants analytics consent.

If the user refuses consent:

• Google Analytics is not loaded;
• Vercel Web Analytics is not loaded; and
• the core application remains available.

The application checks the locally stored consent status before rendering either analytics component.

The consent choice is stored locally in the browser.

The user can later change the analytics choice in Settings.

Analytics is intended to provide general information about application usage and performance.

HT Alchemy does not intentionally use analytics to:

• identify individual Hattrick managers;
• collect Hattrick player or team payloads;
• collect lineups or match orders;
• collect transfer searches;
• collect Club Chronicle content;
• collect analyses of other Hattrick teams;
• build advertising profiles;
• personalise advertising;
• sell user information; or
• combine analytics information with locally stored team data.

15. Feedback submissions

HT Alchemy does not automatically submit crash reports, bug reports, or feature requests.

Feedback is sent only when the user:

1. opens the feedback form;
2. enters information; and
3. presses the submission button.

A submitted report may include:

• the text entered by the user;
• application version;
• selected language;
• submission time;
• browser user agent;
• Hattrick manager user ID;
• Hattrick login name; and
• diagnostic metadata containing localStorage key names and approximate sizes.

The diagnostic storage metadata reports key names and estimated sizes. It does not send the contents of the corresponding localStorage values.

The resulting GitHub issue may include the user’s Hattrick login name, user ID, and a Hattrick contact link.

Feedback is optional.

Users should not include:

• CHPP credentials;
• passwords;
• private messages;
• real-world contact details;
• financial information;
• medical information; or
• other sensitive personal information

in a feedback submission.

16. YouTube content

HT Alchemy contains optional YouTube links and embedded instructional videos.

A video is loaded only when the user chooses to open it.

HT Alchemy uses the youtube-nocookie.com privacy-enhanced embed domain.

Opening or playing a video creates a connection to Google or YouTube. They may receive ordinary technical request information such as:

• IP address;
• browser information;
• device information; and
• the requested video.

HT Alchemy does not automatically open or play YouTube videos merely because the user visits the application.

Locally stored Hattrick team data is not intentionally included in YouTube requests.

17. When information is shared

HT Alchemy does not sell personal data.

HT Alchemy does not rent personal data.

HT Alchemy does not provide locally stored Hattrick data to data brokers.

HT Alchemy does not use Hattrick data for personalised advertising.

HT Alchemy does not use Hattrick data to train general-purpose artificial-intelligence models.

Information is transmitted only where required for a function selected or authorised by the user.

Hattrick

Hattrick receives:

• CHPP authorisation requests;
• CHPP read requests;
• user-initiated CHPP write requests; and
• token-invalidation requests.

Information about other Hattrick teams is obtained only from information that Hattrick itself makes public or exposes through an authorised interface. HT Alchemy does not transmit or use unauthorised requests to obtain private information about other users.

Vercel

Vercel provides hosting and application delivery. It may process ordinary technical request and hosting information.

Vercel Web Analytics receives analytics information only after analytics consent.

Google

Google Analytics receives analytics information only after analytics consent.

Google or YouTube receives information when the user chooses to open YouTube content.

GitHub

GitHub receives information only when the user deliberately submits a bug report or feature request.

Authorities and security providers

Information may be disclosed where required by applicable law, a valid court order, a competent authority, or where reasonably necessary to investigate and respond to a serious security incident.

18. Retention

CHPP session

The encrypted CHPP session cookie expires no later than 16 weeks after issue.

It may be cleared earlier if:

• the user disconnects;
• the CHPP token is invalidated;
• the browser cookies are cleared;
• the session is rejected as invalid; or
• the server-side encryption key is rotated.

Temporary OAuth information

Temporary OAuth request cookies are cleared after the connection process completes or fails.

Team and application data

Persistent team-related and application data remains in the browser until:

• the user deletes it;
• the application replaces it;
• the application expires it;
• the user imports replacement data;
• the browser removes it; or
• the user clears the site’s storage.

This includes locally retained public information and estimates relating to other Hattrick teams.

HT Alchemy does not retain a permanent server-side database copy of this browser-stored team data.

Feedback

Submitted GitHub issues may remain available for:

• investigating defects;
• assessing feature requests;
• avoiding duplicate reports;
• maintaining development history; and
• documenting completed work.

Analytics

Analytics data is retained according to the configured analytics settings and the applicable provider’s retention rules.

Future analytics processing stops when consent is withdrawn.

Technical logs

Technical hosting, security, and error logs are retained only for the period provided by the hosting infrastructure or for as long as reasonably necessary to investigate a specific operational or security incident.

19. Security

HT Alchemy uses security measures intended to reduce unauthorised access, including:

• HTTPS;
• encrypted and authenticated CHPP-session storage;
• AES-256-GCM encryption for the CHPP session;
• a server-side encryption key that is not provided to the browser;
• HttpOnly CHPP session cookies;
• Secure cookies in production;
• SameSite=Lax cookie restrictions;
• same-origin validation for sensitive actions;
• user-selected CHPP permissions;
• separation between browser-side team-data storage and server-side credential handling;
• clearing of temporary OAuth cookies;
• limits on feedback-field lengths;
• use of Hattrick-authorised interfaces; and
• avoidance of a central persistent team-data database.

No internet service, cookie mechanism, browser-storage system, or encryption system can guarantee absolute security.

Although the encryption key is not locally available and the CHPP credentials cannot be directly read by browser JavaScript, a stolen valid encrypted session cookie could potentially be replayed until it expires or the upstream CHPP token is invalidated.

Users are responsible for:

• securing their device;
• securing their browser profile;
• protecting exported data;
• protecting transfer QR codes;
• reviewing write operations before confirming them;
• reviewing feedback before submitting it; and
• disconnecting HT Alchemy when it is no longer used.

20. User control

Users retain direct control over most persistent information because it is stored locally in their browser.

Users can:

• decline analytics consent;
• withdraw analytics consent;
• decline optional CHPP permissions;
• avoid all Hattrick write functions;
• review a proposed operation before submitting it;
• disconnect CHPP;
• invalidate the CHPP token;
• delete local application data;
• clear cookies;
• clear localStorage;
• clear IndexedDB;
• delete exported data;
• avoid opening YouTube content;
• avoid submitting feedback; and
• stop using HT Alchemy.

Where applicable law provides additional rights, those rights may include:

• access;
• correction;
• erasure;
• restriction;
• objection;
• data portability; and
• withdrawal of consent.

Most team-related data can be removed directly by deleting the browser data because HT Alchemy does not maintain a persistent central copy.

Privacy-related matters must not be submitted through a public feedback issue where they would expose additional personal information.

21. Children

HT Alchemy does not request a date of birth and does not attempt to determine the user’s age.

The application is not intended for children under 13.

A person who cannot legally consent to the relevant online processing should use HT Alchemy only with appropriate authorisation from a parent or legal guardian and in accordance with Hattrick’s rules.

22. Changes to this policy

This policy may be updated when:

• application functions change;
• data-processing practices change;
• service providers change;
• security practices change; or
• legal requirements change.

The current version will remain available through:

Help > Privacy

Where a change affects optional consent-based processing, the user will be asked for any new consent required before that processing begins.

The “last updated” date identifies the current version.