Privacy Policy | TheWoWDB.com

Information We Collect

Usage data: Like most websites, our infrastructure and security/CDN provider (Cloudflare) automatically logs standard technical information such as IP address, browser type, device type, referring/exit pages, and timestamps. This is used for security (blocking abusive traffic, bot mitigation), performance, and basic traffic analytics.
Cookies and similar technologies: Cloudflare may set cookies for security and performance (for example, to distinguish humans from bots and to load balance traffic). These are standard infrastructure cookies and are not used by us to build advertising profiles.
Optional account data: If you choose to sign in with Battle.net, we store the account and character information listed under "Battle.net Sign-In and Character Data" below. If a Google sign-in is offered, what that route stores is listed under "Signing In with Google" below. Signing in is entirely optional and every tool on the site works without it. We never see or store your Battle.net or Google password, and there are no subscriptions or payment processing anywhere on the site.
Voluntary contact: If you email us or use the form on our Contact page, we will see your message and any name or email address you choose to send. A message sent through the form is stored in our database with its topic and text, the name and email address if you chose to give them (both fields are optional), and the IP address and browser user-agent it was sent from, which we keep only to spot abuse of the form. We use all of it to answer you, and never sell it.

Battle.net Sign-In and Character Data

TheWoWDB.com offers an optional sign-in through Blizzard's official Battle.net OAuth service. You are never asked for your Battle.net password: you authenticate on Blizzard's own site, and Blizzard tells us only what you approve. We request the openid and wow.profile permissions. If you never sign in, nothing in this section applies to you.

When you sign in, we store the following:

Battle.net account identifier: A stable, opaque account ID issued by Blizzard. This is the key that recognizes you on return visits. It is never shown publicly.
BattleTag: Your BattleTag (for example, Player#1234), used as a display name. Blizzard does not provide us with your email address at any permission level, so we do not have one for Battle.net accounts.
Your World of Warcraft character roster: Fetched once at sign-in. For each character we store the name, realm, region, class, race, gender, faction, level, and Blizzard's character ID. This is what lets you post as one of your characters instead of an anonymous handle.
Session record: A hashed session token plus its creation, expiry, and revocation times, and the IP address and browser user-agent used to sign in. Sessions expire after 30 days. The raw token is stored only in a cookie on your device, never in our database.

Your Blizzard access token is never stored. It is used once, at the moment of sign-in, to read your character roster, and is then discarded. We cannot act on your Blizzard account, see your gold, make purchases, or read anything beyond the character list described above. Refreshing your roster simply means signing in again.

If you use the optional community features, we also store:

Comments: The text you post, what it was posted on, the time, your account, and the character you chose to post as. Comments are public. Readers see only the single character you posted as, together with its realm, class, race, and faction. The rest of your roster is never exposed, and which characters share an account is not published.
Saved items: The items you bookmark, with their region.
Keybinds: Your custom keyboard shortcuts for the site.
Discord link (optional): If you link a Discord account, its Discord user ID and a short-lived verification code.

This information is used only to operate these features. It is not sold, not used to build advertising profiles, and not shared with advertisers. You can sign out at any time from the account menu, which revokes the session. To have your account, character records, and comments deleted, contact us through the Contact page.

Signing In with Google

The account system supports a second sign-in route, through Google. It is not enabled at present: Battle.net is the only sign-in offered on the Account page today, and no "Sign in with Google" button is shown anywhere on the site. This section sets out what that route stores whenever it is switched on, so that nothing is collected before it is disclosed. As with Battle.net, you would authenticate on Google's own page and we would never see or store your password.

If you sign in with Google, we request three permissions (openid, email and profile) and store what they return:

Your email address: The verified address on your Google account, stored in lower case. It is the account key for this sign-in route, so one address is one account. It is not used to send you anything: this site has no newsletter and no mailing list, and nothing on it emails you.
Your Google account identifier: The opaque, stable identifier Google issues for this site (the sub claim), stored alongside the address so the account can be matched back to the same Google account. It is never shown publicly.
Your display name: The name on your Google profile, used as your display name in the account menu, stored up to 120 characters.
Your avatar address: The web address of the profile picture Google hosts for you, stored up to 500 characters. We store the link, never a copy of the image.
Timestamps: When the account was first created and when you last signed in.
Session record: The same record described for Battle.net above: a hashed session token with its creation, expiry and revocation times, plus the IP address and browser user-agent used to sign in. Sessions expire after 30 days, and the raw token is stored only in a cookie on your device, never in our database.

We do not ask Google for, and never receive, your contacts, calendar, files, search or video history, or anything else outside the three permissions above. No Google access token is kept. It is used once, at the moment of sign-in, to confirm who you are, and is then discarded. We cannot act on your Google account.

This information is used only to operate your account, and is kept for as long as the account exists. It is not sold, not used to build advertising profiles, and not shared with advertisers: no advertising network on this site is sent your email address, display name, or avatar. Signing in is optional and every tool on the site works without it. You can sign out at any time from the account menu, which revokes the session, and you can ask us to delete your account and everything stored with it through the Contact page.

Cookies

Cookies are small text files stored on your device. We use them, or allow trusted third parties to use them, for the following purposes:

Essential / security cookies: Set by Cloudflare to help protect the site from abuse and route traffic efficiently. These are necessary for the site to function reliably.
Sign-in cookie: Set only if you sign in with Battle.net. It holds your session token so the site remembers you, expires after 30 days, and is cleared when you sign out. It is not used for advertising.
Analytics cookies: Set by Google Analytics 4 (the _ga and _ga_RMD2ZSN755 cookies) once you accept the consent banner, so we can measure aggregate traffic. See the Analytics section below for exactly what they hold and how to opt out.
Advertising cookies: TheWoWDB.com may display advertisements served by Google AdSense and other Google advertising products. Google and its advertising partners may use cookies (including the DoubleClick cookie), device identifiers, and similar technologies to serve ads based on a visitor's prior visits to this or other websites. The section below covers which advertising networks run on the site.

You can manage or disable cookies at any time through your browser settings. Disabling cookies may affect how parts of the site function.

Google AdSense and Third-Party Advertising

This site may participate in the Google AdSense program and display ads from Google and its advertising partners. As part of this program:

Google uses cookies to serve ads based on a user's previous visits to this and other websites.
Google's use of advertising cookies enables it and its partners to serve ads to our visitors based on visits to this site and/or other sites on the Internet.
Users may opt out of personalized advertising by visiting Google Ads Settings.
For more on how Google uses data when you use our site, see How Google uses information from sites or apps that use our services.
Third-party vendors, including Google, may also use cookies to serve ads based on a user's prior visits. Users can opt out of third-party vendor cookies for personalized advertising by visiting www.aboutads.info.

Which Advertising Networks We Use

Two kinds of advertising network serve ads on this site. The first is Google, through the Google AdSense program and Google's other advertising products, described in the section above. The second is Infolinks.

Infolinks operates independently of Google and of us: it is its own controller of the data it collects through its ad units, it may set its own cookies and device identifiers to select and measure ads, and it publishes its own privacy policy and opt-out at the link above.

Which networks are active is a configuration setting that can change without a policy update. We do not send any advertising network your account details, BattleTag, character roster, or email address.

Advertising is not served on this Privacy Policy page, on our Terms page, or on account, sign-in, and administrative pages.

Affiliate Links

Some outbound links on this site may be affiliate links. If you follow one and buy something, we may earn a commission at no extra cost to you. This never changes what we recommend, and market data, prices, and rankings on this site are calculated from Auction House snapshots alone and are never influenced by an affiliate relationship.

Affiliate links are marked where they appear, and the merchant sets and sees the terms of any purchase you make. We do not receive your payment details.

Analytics

This site uses Google Analytics 4, a web analytics service provided by Google LLC, under the measurement ID G-RMD2ZSN755. It is active on every page of the site, including this one. We use it to understand aggregate traffic patterns, such as which pages and tools are actually used, so we can decide what to build and fix next.

When analytics storage is allowed, Google Analytics sets first-party cookies in your browser. The two you will see are _ga, which holds a randomly generated visitor identifier, and _ga_RMD2ZSN755, which holds session state for this property. Both are set for up to 2 years and can be deleted at any time from your browser settings.

Google Analytics receives the page you viewed, the page that referred you, an approximate location derived from a truncated IP address, your device and browser type, and on-site events such as outbound link clicks and site searches. It does not receive your name, email address, BattleTag, or character roster. We have not enabled Google Signals, user-provided data, or any cross-device identity feature, and we do not use analytics data to build advertising profiles ourselves.

Google's own handling of this data is described in the Google Privacy Policy and in How Google uses information from sites or apps that use our services. You can block Google Analytics on every site you visit with the Google Analytics Opt-out Browser Add-on.

Consent Banner

On your first visit, a banner asks you to accept or decline the cookies used for analytics and advertising. Your answer is stored in your own browser (a wgfConsent value in local storage), never on our servers, and you can change it by clearing this site's storage in your browser settings.

We implement Google Consent Mode v2, and the starting position depends on where you are. For visitors in the European Economic Area, the United Kingdom, and Switzerland, analytics_storage, ad_storage, ad_user_data and ad_personalization all start as "denied", so until you accept, Google Analytics and Google's advertising products write no cookies and read no existing ones. Everywhere else the same four start as "granted", which means cookies can be set before you answer the banner. Your own answer then overrides the starting position wherever you are: accepting sets all four to "granted", and declining sets all four to "denied".

While consent is denied, the Google Analytics tag still loads and sends Google a cookieless signal that a page was viewed, which Google uses for aggregate modelling. It cannot be tied to a returning visitor because no identifier is stored on your device.

Declining does not remove advertising from the site. Ads may still be shown, but without cookie-based personalization. Declining does stop analytics and advertising cookies from being written to your device.

Children's Privacy

TheWoWDB.com is not directed at children under the age of 13, and we do not knowingly collect personal information from children. World of Warcraft itself requires players to meet Blizzard Entertainment's age requirements.

Data Sharing

We do not sell personal information. Aggregate or technical data may be processed by our infrastructure providers (such as Cloudflare) and, where ads are displayed, by Google as described above, solely to operate, secure, and monetize the site. Account and character data from Battle.net sign-in is not shared with advertisers or any third party. Blizzard Entertainment is the source of that data, not a recipient of anything we hold. The only account data that ever becomes public is a comment you choose to post and the single character you post it as.

Your Choices

Use the site without signing in. Every tool works for signed-out visitors.
Sign out at any time from the account menu, which revokes your session immediately.
Request deletion of your account, stored characters, and comments through the Contact page.
Revoke this site's access to your Battle.net account at any time from your Battle.net account settings.
Disable or clear cookies through your browser settings.
Opt out of personalized Google ads via Google Ads Settings.
Opt out of interest-based advertising from many providers via www.aboutads.info.

Changes to This Policy

We may update this Privacy Policy from time to time, for example as we add new features, analytics, or advertising partners. Material changes will be reflected by updating the "Effective Date" above.

Contact

TheWoWDB is owned and operated by Christopher Lucas, sole proprietor, in Nevada, United States. He is the data controller for the information described in this policy.

Questions about this Privacy Policy can be sent via the Contact page.