Privacy Policy.
Last updated: 2026-10-08. Hammerstein.ai is operated by Conflict Simulations LLC.
The short version
There are no third-party advertising trackers on any page. The Meta Pixel is disabled. We use HeyCatch (heycatch.ai) for product analytics: pageviews, clicks, and short-link attribution. Those events go to HeyCatch's servers (in.heycatch.ai). We also keep first-party logs: page events go to Cloudflare Functions; API usage telemetry (endpoint, model, token counts, duration) goes to Cloudflare Analytics Engine. If you have an account, we hold your email address and subscription status. Your session content (board states, queries, orders) is not sold, shared, or used to train models.
Who we are
Hammerstein.ai is operated by Ray Weiss / Conflict Simulations LLC (a United States limited liability company). Contact: [email protected].
What we collect
Account data
When you subscribe, your email address is stored by our payment processor (Stripe) and a subscriber token is issued. We hold your email address and subscription status in Cloudflare D1 to validate tokens and run the account portal. We do not store payment card details; Stripe handles all card data under their privacy policy.
Match tester signup
If you sign up to test Match, we receive your email address and the games you list, by email. We use them only to invite you to test Match and to tell you when it opens. Ask and we delete them.
Continue with Google
If you choose Continue with Google, Google sends us your Google account ID, your email address, whether Google has verified that address, and your name. We use the address to find your subscription, to create your free account, or to fill it in at checkout or on the Match tester list. We store the Google account ID with your subscription or free account so that only that Google account can sign in to it. We do not store your name, and we never receive your Google password or anything else in your Google account. Pages with the button load Google's sign-in script from accounts.google.com, which may set Google's own cookies under Google's privacy policy.
Free accounts
If you use Continue with Google and do not have a subscription, we create a free account for you. We store the email address Google gives us, your Google account ID, and the date the account was created. We also count how many free turns your account uses, so your allowance follows you on any device. Those counts are kept under a random account number, not your name or email. We keep a free account until you delete it. You can download it or delete it at any time on your account page. Deleting it erases your email address and Google account ID immediately. If you subscribe from your free account, we keep a record linking the free account to your subscription, and deleting your subscription's data deletes that record too. We do not send email to free accounts.
Referrals
If you share your referral link, or sign up through someone else's, we store which link was used, the email address and Google account ID of the person who signed up, their account and Stripe customer numbers, the dates they signed up and started paying, and whether the reward was given, so that we can give each reward once and refuse self-referrals, and your browser keeps the code from a link you followed until you sign in.
Session and campaign data
Wargamer, Kriegsspiel, Chat, and Matrix sessions generate query content (board states, turn questions, orders issued). For free demo users, campaign logs are stored only in your browser's localStorage and are never sent to our servers. For Regular and Lifetime subscribers, campaign logs are synced server-side to Cloudflare D1 to enable cross-device continuity. This data is not used for model training and is not shared with third parties except as described below.
Analytics
We use a third-party product analytics tool plus first-party logs. We do not use an advertising network.
- HeyCatch: product analytics for pageviews, clicks, and short-link attribution. The SDK loads from esm.sh and sends events to HeyCatch's servers (
in.heycatch.ai). HeyCatch may store identifiers in your browser so visits can be related. That processing is governed by HeyCatch's privacy policy. - Cloudflare Functions logs: page views, form interactions, and outcome categories (e.g. turn completed / error) are sent to
/api/eventand written as structured JSON to Cloudflare's server-side log stream. We never log the content of your board state, turn question, or orders. - Cloudflare Analytics Engine: API call metadata only. Endpoint, model, token counts, duration, and outcome. No prompt or response content is logged.
Server logs
Cloudflare Pages Functions produce standard server logs (IP address, request path, response code, timestamp). These logs are used for debugging and security purposes and are retained according to Cloudflare's standard log retention schedule.
What we do not collect
- No advertising cookies or cross-site advertising pixels. The Meta Pixel is explicitly disabled on all pages.
- No fingerprinting scripts.
- No advertising analytics that track you across other websites.
How we use your data
- Account email: to issue your subscriber token, send your welcome email, and (if you contact support) to respond to you.
- Campaign data (subscribers): to provide cross-device session continuity.
- Analytics events: to understand where users encounter friction and improve the product.
- Improvement opt-in: if you explicitly enable the "Allow my chat content to help improve Hammerstein" toggle on your account page (off by default), your session content may be reviewed and used for manual prompt tuning. You can withdraw at any time by toggling it off.
Third-party processors
- HeyCatch — product analytics (pageviews, clicks, short-link attribution). Events go to
in.heycatch.ai. Governed by HeyCatch's privacy policy. - Stripe — payment processing and billing portal. Governed by Stripe's privacy policy. Stripe receives your email and payment details when you subscribe.
- Anthropic — AI inference for Wargamer, Chat, Kriegsspiel, Matrix, and RPG turns. Your query is sent directly to Anthropic's API and answered by Claude Sonnet 5.5, or Claude Sonnet 5 for Chat turns. Governed by Anthropic's privacy policy. We do not pass your account email or subscriber token to Anthropic.
- OpenRouter — backup AI routing. If Anthropic's API is unavailable, your query is transmitted to OpenRouter and forwarded to the same Anthropic Claude model. Wargamer turns that include pasted rules and no board photo, and RPG rulebook condensing, go through OpenRouter to DeepSeek V4.1 Flash. Governed by OpenRouter's privacy policy. We do not pass your account email or subscriber token to OpenRouter.
- Google — optional sign-in (Continue with Google). Receives the request when you use the button and returns your Google account ID and verified email address to us. Governed by Google's privacy policy.
- Resend — transactional email delivery (welcome email on subscription). Governed by Resend's privacy policy. Receives your email address to send the welcome email.
- Cloudflare — hosting, edge functions, D1 database, KV storage, and analytics. Governed by Cloudflare's privacy policy.
We do not sell your data to any party. We do not share your data with advertising networks.
Data retention
Subscriber account data (email, subscription status) is retained for as long as your subscription is active and for 30 days after cancellation, after which it is deleted on request or purged automatically. Free accounts are kept until you delete them. Campaign session data stored in Cloudflare D1 is retained for as long as your account is active. You may request deletion at any time (see Your Rights below).
Match rulebook storage follows the retention and deletion schedule on the tested-games page.
Your rights
You have the right to request access to, correction of, or deletion of any personal data we hold about you. Subscribers can erase their Hammerstein-stored account data themselves from the Account page (Delete account data). You can also email [email protected] with the subject line "Privacy Request" and we will respond within 30 days. Self-serve erasure does not cancel Stripe billing; cancel via Manage subscription if you want charges to stop. If you are located in the European Economic Area, you have additional rights under the GDPR, including the right to lodge a complaint with your local supervisory authority.
Children
Hammerstein.ai is not directed at children under the age of 13 (or under 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at the address above and we will delete it.
Changes to this policy
We may update this policy from time to time. Material changes will be noted with an updated "Last updated" date at the top of this page. Continued use of the service after a material change constitutes acceptance of the revised policy.