Privacy policy

Reading the site

Reading pages requires no account. No profile is built, nothing is written to our database about your visit, and the site sets no cookie of its own for reading — only, and only after you answer it, the cookie that remembers your answer about visit statistics.

Your browser keeps a few things for you locally: which colour scheme you chose, and any unsaved planner sheet you were working on. Those stay on your device. They are not sent to us and we cannot read them.

Visit statistics

Where this site is configured to count visits, it uses Google Analytics — and only after you have agreed. Until you answer, and if you refuse, the tag is never loaded, no request goes to Google, and no statistics cookie exists in your browser.

If you do agree, Google’s tag is loaded on each page. It sets cookies on this site’s domain and sends Google the page you are on, the page that sent you here, rough details of your browser and device, and your IP address. What Google then does with that, and how long it keeps it, is governed by Google’s own terms, not by this page.

You can change your answer at any time on the cookies page, which is linked from the bottom of every page on this site.

If you create an account

An account is optional and is needed only to save builds, keep favourites, or submit a guide. When you create one, this is what is stored about you:

• Your email address, kept in lower case and used to sign you in and to send you account letters. It is unique — one account per address.
• Your password, which is never stored. What is stored is an argon2id hash of it, from which the password cannot be recovered.
• The display name you chose, which is shown publicly beside anything you publish.
• The interface language you last used, and your role on the site (ordinary reader, editor or administrator).
• When the account was created and when it was last changed.
• While a verification or password-reset letter is outstanding: a hash of the link’s token and the moment it stops working. The token itself is never stored.

Staying signed in

Signing in creates a session that lasts 30 days. The row recording it holds which account it belongs to, when it was made, when it expires, and a keyed hash of the session token — not the token itself. No IP address and no browser identification is recorded with it.

The token that identifies your session is kept in your browser’s local storage, not in a cookie. This has a consequence worth knowing: clearing your cookies does not sign you out of this site, and clearing site data does.

Signing out marks that session as revoked, and it stops working immediately. Resetting your password ends every other session on the account.

What you publish

Anything you deliberately publish is stored with your account against it: your builds and tier lists, your favourites, and any guide you write, together with its text, its language, its review status and — where one was given — the reason it was rejected.

A build or a tier list is private until you mark it public. A guide is visible only after review. Once something is public it can be read by anyone and indexed by search engines, and your display name is shown with it.

You can delete your own builds, tier lists, favourites and guides yourself, at any time.

The contact form

This site has a contact form that anyone can use, with no account. When you send a message through it, this is what is stored: the message itself, whatever contact you chose to leave (an email, a handle, or nothing), the interface language you were reading in, and the moment it arrived.

Your IP address is not stored with it. To stop the form being flooded, the number of recent submissions is counted per IP address in memory for sixty seconds and then forgotten — the same rate limiter described below — but that count is never written into the message or anywhere else.

A message stays until a moderator removes it by hand. If you left no contact, there is no way to reach you back, and that is fine — the message still arrives.

Combat logs

This site accepts uploaded combat logs, and this is the part readers are least likely to expect, so it is spelled out.

An upload does not need an account: one sent without a signed-in session is recorded with no uploader at all. The upload is kept exactly as it was sent, in full, alongside the zone, the time it started, how long it lasted, the size of the group, and the game, region and client versions reported by whatever produced it.

For every member of the group — not only the person uploading — the log stores the in-game character name, the class, the item level, the damage done and taken, healing, deaths, and a snapshot of the gear. Those other players did not agree to any of this, and character names uploaded this way can be looked up publicly on this site afterwards.

If you upload a log, you are publishing other people’s character names along with your own. If a name of yours is in one and you want it gone, it has to be removed by hand — see the section on your rights below.

Letters we send

There are exactly two: the one confirming your address when you register, and the one with a password-reset link when you ask for it. There is no newsletter and nothing is ever sent for marketing.

Where this site is configured with a mail provider, your address and display name are passed to that provider so it can deliver the letter. Where no provider is configured — which is the case on some deployments of this site — the letter is written into the server log instead and never sent to anybody, and the registration screen says so rather than telling you to check your inbox.

A verification link stops working after 24 hours; a password-reset link after one hour.

Server logs and rate limits

The web server this site runs behind keeps a standard access log, which includes the IP address of each request. That is ordinary server operation and is not used to build anything about you.

To stop one client flooding the site, the API counts recent requests per IP address. That count is held in memory for sixty seconds and then gone; it is never written to the database or to a file.

How long things are kept

Honestly: there is no automatic deletion on this site. Nothing here is scheduled to expire and nothing runs to clean it up.

That means expired sessions and sessions you signed out of remain as rows after they have stopped working; an unused password-reset hash stays on your account row after the hour is up; and an account, its builds, its guides and any combat log stay until somebody removes them by hand.

This is a description of the site as it is, not a retention period we are claiming to enforce.

Your rights, and what this site can actually do today

You can see what is held about you on your profile page, and you can change your display name and your interface language there. You can delete your own builds, tier lists, favourites and guides whenever you like.

What this site has NOT built is self-service account deletion and self-service data export. There is no button for either. A request to delete an account, to remove a character name from an uploaded log, or to receive a copy of what is held has to be made to the operator and carried out by hand.

If you are in the EU or the UK, the law gives you the right to access, correct, delete and take away your data, and to object to it being processed. Those rights apply to this site; the paragraph above is about the machinery, not about the right.

Changes to this page

When what the site does changes, this page changes with it, and the date at the top is the date of the last change. There is no archive of previous versions.