Privacy

We only need to know that you are you.

GitHub login requests no repository scopes. Clash of Git stores your immutable GitHub account ID, public username, public avatar URL, public contribution totals, game state, and a hashed session identifier.

We do not store the GitHub OAuth access token used to sign you in. A separate server credential reads the same public contribution information visible on GitHub profiles. We never read repository contents.

Sessions remain signed in for up to 30 days of inactivity, expire after 180 days at the latest, and use a secure HTTP-only cookie.

We store concise in-game product events such as base claims, attacks, builds, pushes, and referral opens so we can measure whether the game works. They contain GitHub IDs and game results, never code, repository data, OAuth tokens, or session tokens. Deleting your game data removes events tied to your identity.