Privacy policy

The short version

You can use almost all of this site without giving anything. The Squad Builder runs in your browser and saves squads to your own device. The database, guides and class pages need no account and set no tracking cookies. You only hand over anything when you choose to: subscribing to alerts, submitting a correction, or creating an account to post in the forum.

Nothing here is sold. Most pages carry Google advertising and up to three affiliate adverts from shops, and those are the things here that can follow you off this site. The pages that exist to do something rather than to tell you something carry none — signing in, your account, the publishing and correction forms, this page, the Terms, and any page that does not exist. If you are reading from the UK, the EEA or Switzerland you are asked before advertising stores anything — including before the affiliate network is contacted at all — and you can change that answer at any time from the link at the foot of any page. Decline and the adverts still appear, served from here, storing nothing.

Who is responsible for it

The data controller for everything described below is TSMW Development LTD, an independent UK software studio registered in England and Wales under company number 17204316. It built Zero Company Builds and runs it. The registered office is on the public register at Companies House rather than published here.

A policy that says “we” and never says who has told you nothing. The rights further down are exercised against a named company, and that is the name. Requests go to privacy@zerocompanybuilds.com. The studio’s own inbox, contact@tsmwdevelopment.com, reaches the same person if you would rather write there.

What is collected, and only when

Passwords are stored only as a bcrypt hash. Nobody here can read yours, including us — a reset replaces it rather than recovering it.

Your IP address is used transiently for rate limiting, to stop the forms being flooded. It is held in memory, never written to the database, and disappears when the server restarts.

Who else processes it

Named specifically, because “our trusted partners” tells you nothing:

• Vercel — hosting and aggregate analytics. Serves every page and records page counts.
• Neon — the Postgres database holding accounts, forum posts, corrections and alert subscriptions.
• Resend — sends the emails. Sees the address and the message.
• Discord — only if you sign in with it. It tells us your username, avatar and email address. It does not tell us your friends, servers or messages, and we do not ask.
• Google — serves the ads, through AdSense. Its script runs in your browser on the pages that carry advertising, listed below, so on those pages it sees the page address, your IP address and your browser, and it may read and write its own identifiers on your device. What it does with them is governed by Google’s policies rather than this one: how Google uses information from sites that use its services.
• Google, again — counts the page views, through Google Analytics. A second product from the same company and a separate entry rather than a clause on the one above, because it behaves differently: its script runs on every page of this site rather than only the ones that carry advertising, this one included. It sees the page address, your IP address and your browser, and it stores an identifier so that two page views in a row can be recognised as one visit — but not in the UK, the EEA or Switzerland unless you have agreed to it, where it is told to store nothing until the consent prompt says otherwise. It is what says which pages are worth writing more of. The same Google policy linked above governs what it does with any of it.
• Awin — the affiliate network behind the G FUEL, G2A, Akko adverts in the sidebar. Each is sold in particular countries only and is shown to nobody else, so most readers never meet most of them. Simply seeing one sends Awin nothing at all. There is no script and no picture fetched from them: every creative is a copy held on this site and served from here, so page load makes no request to Awin and sets none of their cookies. That is deliberate — an image request to an affiliate network sets a tracking cookie the moment a page loads, before anyone has been asked anything. Awin is contacted only when you follow an advert, at which point it records the click, sets its own cookies on its own domain and redirects you to the shop. That is how this site is credited for a sale. What Awin does with any of that is governed by Awin’s privacy policy rather than this one.
• Bitbucket — holds the source code. No reader data goes there.

Google and Awin are the two advertising companies involved, and they do different things: Google chooses and serves whatever ads appear, and Awin serves one advert that was picked by hand and pays this site a commission if you buy from it. There was a third, Adsterra, filling fixed slots in the sidebar and under each heading; it was removed on 30 August 2026 and nothing on this site contacts it any more. If another is ever added, it will be named in this list before it serves a single advert, not afterwards — a policy that describes the vendors you had last month is a policy nobody can rely on.

One advert on this site involves no other company at all. In the margin of every page — this one included — there is a link to Damn, Zombies, a game made by the same studio that builds this site. It is marked as an advert wherever it appears, and it is worth being precise about what it is: a picture and a link, both served from this site. It loads no third-party script, stores nothing on your device, and nobody is told that you saw it or that you followed it. Following it takes you to another website, and what happens there is covered by that site’s own privacy policy rather than this one.

Cookies

The only cookie this site sets itself is the one that keeps you signed in after you sign in, plus the short-lived tokens that make that sign-in secure. None of them follow you anywhere else.

Google Analytics sets one more, and it is worth separating from the two below it because it does not look like a third-party cookie: it is stored under this site’s own address, named _ga, and it is written by Google’s script rather than by this site. It holds a random number and no name, address or anything you typed. Its job is to tell a reader who opened four pages from four readers who opened one each — without it, this site cannot tell whether a guide was read or merely landed on. Unlike the advertising below, it is on every page here, including this one. Blocking it in your browser, or any content blocker, stops it, and nothing on this site stops working when you do.

In the UK, the EEA and Switzerland that cookie is not set until you agree to it. The measurement script still runs and still counts that a page was opened, but it is told to store nothing on your device unless the consent prompt described further down comes back with a yes. What that costs is the ability to tell one reader’s four pages from four readers’ one each — which is worth less than storing something on your device before asking. The prompt is Google’s, and it is carried by the advertising script, so on the pages that have no advertising — this one included — there is nothing to answer and nothing is stored either.

Google’s advertising script is the exception, and it is worth being blunt about it: it is a third party, and it can store an identifier on your device to choose ads and to count whether they were seen. It is what pays for the hosting.

The affiliate adverts set nothing at all until you follow one, and that is worth being precise about because it has not always been true. Their pictures used to be fetched from Awin, whose server set a cookie called AWSESS on its own domain as it sent them — on page load, before you had done anything. Every creative is now a copy held on this site and served from here, so no request reaches Awin while you are reading and none of their cookies are written. Following an advert sets them, on Awin’s domain and then on the shop’s, which is the mechanism that credits this site for a sale — but by then you have chosen it.

There are two prompts and they are not the same one. Google’s, which arrives with its advertising script, governs Google’s ad partners — and Awin is not one of them, so no answer you give Google is consent for Awin. This site’s own prompt is what names Awin, under the advertising heading, alongside the storage permissions passed on to Google. Because the adverts now store nothing on your device unless you follow one, that answer no longer gates anything that happens while you read; Awin is named there because following an advert still hands you to them, and that is worth knowing before you click.

Nor does it cover the page counter, which is not an advertising partner of anyone. So this site runs a second prompt of its own, and that is the one that governs the counter and the storage permissions this site passes on to Google. It was originally added for a second ad network, Adsterra, which Google’s prompt could not speak for; that network was removed on 30 August 2026 and the prompt stayed, because the counter still needs asking about and because the permissions it sets are real either way.

You will see it if you are in the UK, the EEA or Switzerland, and it is worth describing exactly as it is rather than flatteringly. It appears over the page and asks before anything is stored. Advertising is switched on in it by default, and the way to switch it off is the Options link beside the accept button — one click, on the same screen, and then the advertising row. Measurement is presented as always on. Nothing is stored until you answer, and if you never answer, nothing is stored at all. You can change any of it whenever you like: Cookie settings at the bottom of any page clears your answer and asks again.

Two prompts is one more than anybody wants, and it is worth saying why rather than pretending it is elegant. Google requires its own certified consent tool for its advertising in these countries and will not accept a substitute; that tool, in turn, can only ask about its own partners. So Google’s prompt covers Google’s ads, and this site’s covers everything else.

It does not run everywhere. It is loaded on the pages that exist to tell you something — the homepage, the Squad Builder, builds, classes, Operators, the database, guides, questions, tier lists, synergies, the release and requirements pages, updates, sources and this site’s About page. It is not loaded when you sign in, on your account or its preferences, on the password reset and email verification pages, on the alert confirmation and unsubscribe pages, on the form for publishing a build, on the corrections form, on the moderation pages, on the Terms, on this page, or on any address that does not exist. Those pages are there for you to do something, and an advert on one is an advert beside a button you were about to press. Nor is it loaded on the forum or on the community builds, which are written by readers rather than by this site and are not checked before they are public.

The affiliate adverts are each shown only to readers in the countries that advert is sold in, on fewer pages still, and in one fixed place rather than wherever a script decides: the sidebar of the pages that carry an article or an entry — the Operator, class, ability, talent, build, guide, question, tier list and synergy pages, and the release date, requirements and About pages. It is on none of the pages listed above as carrying no advertising, and it is not in the Squad Builder, where an advert would sit among the controls you are trying to press.

Readers in the UK, the EEA and Switzerland are asked about that before it happens, by a consent prompt Google runs on this site’s behalf. Say no and the advertising you are shown is not personalised — it is not chosen from anything you have done before, here or anywhere else. It is worth being precise about what that does not mean: Google may still process technical information and may still store something on your device for purposes such as counting how often an advert is shown to you, measuring it in aggregate and detecting fraud, where that is permitted. “Not personalised” is a statement about what decides the advert, not a promise that nothing is stored. The site works either way, and nothing here is withheld from readers who decline. Your answer is remembered so you are not asked again, and you can change it whenever you like, from the “Privacy and cookie settings” link at the foot of any page that carries advertising.

Not, as it happens, at the foot of this page. The prompt is run by Google’s own consent tool, which arrives with the advertising script — so on the pages that load no advertising, and this is one of them, there is nothing there to reopen. Any of the content pages has it: the homepage will do. Two other limits worth stating rather than hiding: the link appears only if the prompt applies to you at all, so readers outside the UK, the EEA and Switzerland will not see one, and it is a control over advertising rather than over this site. Wherever you are, you can switch personalised advertising off for your Google account, on every site, at My Ad Center, and a content blocker will stop the script loading at all.

Saved squads and your theme preference live in your browser’s own storage. They never reach the server, and clearing your browser data removes them.

Email

Patch alerts are double opt-in: nothing is sent to an address until someone clicks a link delivered to it. Every alert carries an unsubscribe link.

Marketing email — occasional notes about new tools and major data additions — is separate and off unless you tick the box. You can change that any time on your account page, or from the manage-preferences link in the footer of any such email, without signing in.

How long it is kept

• Accounts and posts — until you ask for them to be deleted.
• Alert subscriptions — until you unsubscribe. Unconfirmed ones are not kept indefinitely.
• Corrections — kept after they are handled, because the record of what was changed and why is part of how this site shows its working.

Your rights

Under the UK GDPR you can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, or object to it being processed. Ask and it will be done — there is no form and no fee.

You can delete your account yourself, immediately, from your account page. It removes the account, its forum threads and posts, its email preferences and any alert subscription attached to it. Sub-forums you created stay, because the threads inside them belong to the people who posted. Nothing is retained afterwards and no confirmation email is needed.

Contact: privacy@zerocompanybuilds.com. If you are not satisfied with the response you can complain to the Information Commissioner’s Office at ico.org.uk — the controller to name is TSMW Development LTD, company number 17204316.

Children

This site is not aimed at children under 13 and accounts are not knowingly created for them. If you believe one has been, say so and it will be removed.

Changes

If this policy changes in a way that affects what is collected or who processes it, the date at the top changes and anyone holding an account will be told. Silent edits to a privacy policy are how trust in one is lost.