The short version: we run no ads, use no tracking cookies, and never sell data. We collect the minimum needed to run your account, credit your donations and keep the site secure — and our visitor statistics are engineered so we can't identify you even if we wanted to. That's why you don't see a cookie banner here: we don't do anything that would need one.

Who we are

WOW Legends (wow-legends.eu) is a small, donation-funded hobby project. For anything privacy-related — questions, corrections, data requests — use the contact form and we'll respond by email.

What we collect, and why

• Your account — username, email address and a password hash (Argon2id — we never store or see your actual password). If you enable two-factor authentication, we store its secret and hashed recovery codes. We log login timestamps and IP addresses for security (spotting break-in attempts, rate-limiting).
• Support & contact messages — what you send us (message, email, optional ticket attachment), plus the submitting IP for abuse prevention. Attachments are stored outside the public web directory, readable by admins only.
• Donations — payments are handled entirely by Ko-fi; we never see your card or bank details. Ko-fi sends us your name, email and amount so we can credit the right account automatically.
• Hosted AI chat (optional) — if you use our hosted AI for bot chat, the message content is relayed to our upstream AI inference provider to generate the reply and metered against your credits. It's not used for advertising or sold. Common sense still applies: don't tell a game bot your passwords.
• API & security logs — API calls are logged (endpoint, status, timing, IP) for abuse prevention and capacity planning. These records delete themselves after about 90 days.
• Visitor statistics — cookieless by design. We store no raw IP: a visit is counted as sha256(secret salt + UTC day + IP + browser) — an irreversible hash that rotates every single day, so it can count "unique visitors today" but can't identify you or follow you across days. No third-party analytics.

Cookies

Only the strictly necessary kind: a session cookie when you log in, an optional "remember me" token if you tick it, and a trusted-device cookie if you use 2FA. No tracking cookies, no ad cookies, no third-party analytics cookies — which is why there's no consent banner: there's nothing to consent to.

Third parties we rely on

• Hetzner (Germany) — hosts this website. Data lives in the EU.
• Cloudflare — sits in front of the site for security and caching.
• Ko-fi — processes donations (see their own privacy policy for payment data).
• Our email provider — sends transactional mail only (verification, password resets, support replies). No newsletters, no marketing mail.
• YouTube — video embeds use the privacy-enhanced youtube-nocookie.com player and load nothing at all until you click play.

How long we keep things

Account data: for as long as your account exists. API/security logs: ~90 days, then auto-deleted. Support tickets: kept so we can reference past issues, deleted on request. Server backups rotate on a fixed schedule.

Your rights

Under the GDPR you can ask us at any time to see, correct, export or delete the personal data we hold about you — including deleting your whole account. One message via the contact form does it; no hoops. You also have the right to complain to your local data-protection authority.

Children

The site isn't directed at children under 16, and we don't knowingly collect their data.

Changes

If this policy changes, the update lands here with a new date. No silent rewrites.

Last updated: 7 July 2026 · Also see our Terms.