Privacy Policy

Account Information

When you create an account, we collect the following information:

• Email Address -- Used for account creation, password recovery, and important service communications.
• Username -- A display name you choose during registration, visible to other users in certain contexts.
• Password -- Hashed using bcrypt. Your password is never stored in plaintext and cannot be recovered or viewed by anyone, including administrators.

Battle.net Account Link

If you choose to link your Blizzard Battle.net account, we store a Battle.net identifier and basic profile information provided through Blizzard's official OAuth2 flow. We never receive or store your Battle.net password.

Usage Data

We automatically collect certain information when you use the Service, including:

• Pages visited and features used (such as which game version tabs you browse, items you search for, and price charts you view)
• Account-level feature usage for signed-in users, such as saved preferences, favorites, alerts, session activity, and support or abuse-prevention context
• General interaction patterns and navigation behavior
• Browser type, version, operating system, and device information
• Referring URLs and search terms that led you to the site
• IP addresses (hashed using HMAC-SHA-256 with a server-side salt and anonymized for security auditing purposes only -- raw IPs are never stored and the salted hash cannot be reversed)
• Approximate geographic region (derived from IP address for region selection, not stored)

Advertising Data (Collected by Third Parties)

When the Service is monetised through a third-party advertising partner, that partner may automatically collect certain information through cookies and similar technologies, including:

• Your browser type, version, and language preferences
• Device identifiers and operating system information
• IP address (used by the advertising partner for geographic targeting and fraud prevention)
• Pages you visit on our Service and the content you interact with
• Ad impressions, clicks, and engagement metrics
• Information from other websites you have visited that participate in the same advertising network, used to serve interest-based advertisements

This data is collected and processed directly by the advertising partner under that partner's own privacy policy. We do not have access to the raw advertising data they collect. See Section 5 (Advertising) for full details on how third-party advertising cookies work and how you can opt out.

Contact Form Submissions

When you use the contact form, we collect your name, email address, and message content. This information is used solely to respond to your inquiry and is not shared with third parties. An optional subject field is also collected if provided.

Information We Do NOT Collect

We do not collect the following:

• We do not collect your Battle.net password, game credentials, or authentication tokens beyond the OAuth2 session
• We do not collect in-game data from your WoW characters (gold, inventory, mail, guild bank)
• We do not collect payment or financial information of any kind
• We do not collect social media account data beyond what you voluntarily provide
• We do not collect precise location data -- only approximate region derived from IP address for server selection, which is not stored
• We do not install or require any addons, browser extensions, or client software
• We do not use fingerprinting or hidden tracking techniques beyond standard cookies described in this policy

Contractual Necessity

Processing that is necessary to provide the Service you requested. This includes account creation, authentication, session management, password recovery, and delivering core features such as price tracking, favorites, and alerts.

Legitimate Interest

Processing that serves our legitimate business interests, provided those interests do not override your fundamental rights and freedoms. This includes security monitoring, fraud prevention, abuse detection, rate limiting, service performance optimization, and first-party account and aggregate analytics to improve the Service.

Consent

Processing that relies on your explicit, informed consent. This includes optional Battle.net account linking, receipt of non-essential communications, and the use of non-essential analytics cookies, GA4 User-ID, Google advertising features, and advertising cookies by our third-party advertising partners where consent is required. You may withdraw your consent at any time -- for example, by unlinking your Battle.net account, adjusting your cookie preferences, opting out of personalized ads via the Digital Advertising Alliance (DAA) or the Network Advertising Initiative (NAI) opt-out tools, or deleting your account entirely.

Legal Obligation

Processing that is necessary to comply with a legal obligation to which we are subject, such as responding to lawful requests from public authorities or retaining certain records as required by applicable law.

Essential Cookies (First-Party, Strictly Necessary)

These cookies are strictly necessary for the Service to function correctly. They cannot be disabled without breaking core functionality. They do not collect information for marketing purposes.

• Session Cookie (bbb.sid) -- Maintains your login state and CSRF protection while you are signed in. This is an HttpOnly, Secure cookie that cannot be read by client-side JavaScript. It expires when your session ends or after a period of inactivity. It is regenerated on security-sensitive actions (login, password change) to prevent session fixation.
• Preference Cookies -- Store your selected region, realm, game version, and display preferences (such as faction and sort order) so the Service remembers your choices across page loads. These are first-party cookies that do not leave your browser.

Advertising Cookies (Third-Party Advertising Partners)

When the Service is monetised through a third-party advertising partner, that partner and its sub-partners use cookies, web beacons, and similar technologies to serve ads, measure their effectiveness, and personalize the advertising experience. Typical advertising cookies carry an opaque identifier, support frequency capping, and may signal interest categories used for behavioural targeting.

For full details on how third-party advertising cookies work, how personalized and non-personalized ads differ, and how to opt out, see Section 5: Advertising.

Infrastructure Analytics (Cloudflare Edge Traffic)

We do not load the Cloudflare Web Analytics browser beacon. Cloudflare still processes standard HTTP request metadata as our DNS, CDN, and security provider so it can route traffic, cache content, mitigate abuse, and provide aggregated edge traffic reports.

• Cloudflare edge processing may include standard request data such as IP address, user agent, requested path, referrer, timestamp, and security events.
• We use Cloudflare's edge traffic summaries for reliability, performance, capacity planning, and abuse prevention, not advertising.
• Cloudflare edge analytics are not the same as GA4 browser analytics and do not receive your account identifiers, favorites, search text, watchlists, or in-app preferences from us.

Analytics (Third-Party -- Google Analytics 4)

We use Google Analytics 4 (GA4) to measure aggregate traffic to the Service -- pageviews, visitor counts, country, device class, traffic sources, top pages, and engagement signals such as session duration. GA4 helps us understand which features are used and which pages need attention; it is also a requirement for the third-party advertising networks that fund the Service.

Google Analytics Advertising Features. GA4 is configured with allow_google_signals: true and allow_ad_personalization_signals: true, and is linked to Google Signals. Consent Mode keeps ad storage, ad user data, and ad personalization denied until you accept optional cookies. After Accept, this enables: (a) Demographics & Interest Reports -- Google associates your visit with the aggregated age, gender, and interest categories it has for your Google account (when you are signed in and have Web & App Activity association enabled); (b) Cross-device measurement -- Google deduplicates your visits across devices on which you are signed in to the same Google account; (c) Remarketing audiences -- eligible to be exported to a linked Google Ads account, if one is connected in the future. We do not currently have a Google Ads link, but the data is collected in a form that would make such a link possible.

Custom event parameters. GA4 also receives the following custom parameters with each event: game_version (which WoW edition you are browsing -- e.g. Retail, MoP Classic, TBC Classic), region (US or EU AH region), and user_type (anonymous or authenticated -- never any account-identifying value). No usernames, emails, Battle.net IDs, item search strings, or watchlist contents are ever sent to GA4.

BigQuery export. GA4 offers a native BigQuery Export integration. If it is enabled for our property, event-level GA4 data may be exported to a Google Cloud BigQuery dataset in our Google Cloud project via Google's standard GA4–BigQuery integration, for aggregate analysis and ad-network onboarding diligence. We do not operate a separate real-time streaming pipeline. Any exported data is subject to the same restrictions described above -- no personally identifying information is included -- and to GA4's and the dataset's retention settings.

IP anonymization remains on. We continue to set anonymize_ip: true; Google truncates visitor IPs before processing. We also send url_passthrough: true (Google passes ad click identifiers through navigation URLs when cookies are denied) and ads_data_redaction: true (Google redacts IP + device identifiers from ad-related beacons when ad_storage is denied).

Consent Mode v2. GA4 is controlled by the cookie consent banner via Consent Mode v2. Where analytics consent is required and has not yet been granted, or when you choose Essential Only, GA4 runs in "cookieless" mode -- no analytics cookies are written and only modeled, aggregated signals reach Google. Outside opt-in regions, GA4 analytics storage may be granted by default so GA4 can set cookies such as _ga and _ga_<MID> to count returning visitors. Advertising storage, advertising user data, and ad personalization remain denied unless you accept optional cookies. You can withdraw or change your choice at any time using the cookie preference controls below or by clearing site data to re-trigger the banner.

Authenticated User-ID. When you are signed in, GA4 may also receive a server-generated, non-reversible pseudonymous cross-session identifier. This value is derived with a server-side secret and sent via GA4's User-ID mechanism so Google can stitch your sessions across devices and browsers when you are signed in to both the Service and the same Google account. The value carries no email, no Battle.net handle, no username, no raw database id, and no user-typed content. When it is sent depends on your region. In opt-out jurisdictions (currently the United States) a signed-in account holder who has accepted the Terms of Service receives the User-ID by default, under the opt-out model described in Section 12, without needing to accept optional cookies. In opt-in regions (the EEA, the United Kingdom, and Switzerland) the User-ID is sent only after you grant analytics consent on the cookie banner. In every case it is suppressed when you choose Essential Only, send a Global Privacy Control signal (see Section 13), sign out, or delete your account.

We never send the following to GA4: character names, Battle.net IDs, email addresses, watchlist or favorite contents, raw item search strings, seller names, authentication tokens, or any other identifier that could re-identify you. Only canonical URL paths (without query strings), the SSR-emitted page title, the custom parameters above, and the region-gated pseudonymous User-ID for authenticated visitors (as described above) are reported.

You can withdraw GA4 analytics consent at any time by using the cookie preference controls in this section, choosing Essential Only on the cookie banner, or clearing site data in your browser to re-trigger the banner. See Section 4 Managing Cookies (below) for browser-specific instructions, and Section 10: Your Rights for how to request access, correction, or deletion of any data we hold.

Managing Cookies

Most web browsers allow you to control cookies through their settings. You can typically find these in the "Options," "Settings," or "Preferences" menu of your browser. The following links may help you understand your options:

• Cookie settings in Chrome
• Cookie settings in Firefox
• Cookie settings in Safari
• Cookie settings in Microsoft Edge

Please note that disabling essential cookies may prevent you from using core features of the Service, such as staying logged in or saving your preferences. Blocking advertising cookies will not remove ads but will cause you to see generic, non-personalized advertisements instead.

How third-party ad cookies work

Most third-party advertising networks operate on the same general mechanics. When you visit a page on our site that contains ads:

• The advertising partner's ad-serving technology loads on the page and requests an advertisement from its ad servers.
• The advertising partner may read existing cookies on your browser or place new cookies to determine which ads to show you and to enforce frequency capping.
• The ads you see may be based on the content of the page you are viewing (contextual targeting), your general geographic location, and -- if you have not opted out -- your browsing history across other sites in the same advertising network (interest-based or behavioural targeting).
• The advertising partner collects data about ad impressions, clicks, and your interaction with ads. This data is used to measure ad performance, prevent fraud, and improve the advertising experience.

Personalized vs. Non-Personalized Ads

Personalized ads (also called interest-based ads) use data collected from your browsing activity across websites to show you advertisements that are likely to be relevant to your interests. Most third-party advertising partners build an advertising profile based on the websites you visit, the apps you use, and other online activity.

Non-personalized ads are based solely on the content of the page you are currently viewing and your general geographic location. They do not use cookies for ad targeting, though they may still use cookies for frequency capping and ad fraud prevention.

If you are located in the European Economic Area (EEA) or the United Kingdom, our advertising partner is required to request your consent before serving personalized ads, in compliance with GDPR. You can change your consent choice at any time through the cookie consent banner on this site.

Your Advertising Choices

You have several options for controlling the ads you see on the Service:

• Opt out via industry programs: Visit the Digital Advertising Alliance (DAA) AdChoices opt-out or the Network Advertising Initiative (NAI) opt-out to opt out of personalized ads from participating advertising networks. These industry-wide opt-out tools cover most major advertising partners and remain effective when our specific advertising partner changes.
• For EU/UK users: Visit Your Online Choices to manage your preferences for online behavioral advertising.
• Browser settings: Configure your browser to block third-party cookies, which will prevent most personalized advertising tracking. See Section 4 for browser-specific instructions.

Technical Safeguards

• Encryption in Transit -- All connections to the Service are encrypted using HTTPS/TLS. Unencrypted HTTP requests are automatically redirected to HTTPS.
• Password Hashing -- User passwords are hashed using bcrypt, an adaptive hashing algorithm specifically designed to resist brute-force and rainbow table attacks. Passwords are never stored in plaintext.
• Session Security -- Login sessions use secure, HttpOnly cookies with CSRF (Cross-Site Request Forgery) protection. Sessions are regenerated on authentication state changes (login, password change, email change) to prevent session fixation attacks.
• IP Anonymization -- IP addresses stored for security auditing are hashed using HMAC-SHA-256 with a server-side salt before storage. The salted one-way hash ensures they cannot be reversed to identify individuals, even with knowledge of the hashing algorithm.
• Rate Limiting -- API endpoints and authentication routes are protected by rate limiting to prevent brute-force attacks and abuse.

Operational Safeguards

• Database Security -- All data is stored in encrypted databases hosted on secure infrastructure with strict access controls. Only essential systems have access to production data.
• Account Lockout -- Repeated failed login attempts trigger temporary account lockouts to protect against credential stuffing attacks.
• Credential Sanitization -- API keys, tokens, and sensitive credentials are scrubbed from error logs and diagnostic output to prevent accidental exposure.

Automated Decision-Making

We use automated processing for the following limited purposes:

• Rate Limiting and Abuse Detection -- Automated systems monitor request patterns to detect and block abusive behavior (such as scraping or brute-force attacks). These systems may temporarily restrict access based on detected patterns.
• Account Lockout -- Automated systems temporarily lock accounts after repeated failed login attempts. This is a security measure and does not involve profiling.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Our third-party advertising partners may use automated processes to select which ads to display, but this does not affect your access to or use of the Service.

European Economic Area (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR). Our legal basis for processing your personal data depends on the type of data and how we use it:

• Contractual Necessity -- Processing required to provide the Service you requested (account creation, authentication, service delivery).
• Legitimate Interest -- Processing for security monitoring, fraud prevention, service improvement, and analytics, where our interests do not override your fundamental rights.
• Consent -- Processing based on your explicit consent, such as optional Battle.net account linking or personalized advertising via our third-party advertising partners. You may withdraw consent at any time.

Under the GDPR, you have the right to access, rectify, erase, restrict processing of, and port your personal data. You also have the right to object to processing and to lodge a complaint with your local data protection authority. To exercise these rights, contact us at support@bootybaybroker.com.

United Kingdom (UK GDPR)

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 give you the same access, rectification, erasure, restriction, portability, and objection rights described above, with oversight by the Information Commissioner's Office (ICO). Non-essential analytics and advertising stay off until you opt in via the cookie banner.

Switzerland (revFADP)

If you are in Switzerland, the revised Federal Act on Data Protection (revFADP) applies, with oversight by the Federal Data Protection and Information Commissioner (FDPIC). You have rights of access, rectification, and erasure. We treat Swiss visitors with the same default-denied Consent Mode posture as the EEA/UK -- non-essential analytics and advertising stay off until you opt in via the cookie banner.

Brazil (LGPD)

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you rights of access, correction, deletion, portability, and information about data sharing, enforced by the Autoridade Nacional de Proteção de Dados (ANPD). You control non-essential analytics and advertising via the cookie banner and Global Privacy Control. Brazil is NOT part of the signed-in default-on analytics enabled for account holders in opt-out jurisdictions -- it remains opt-in via the banner.

Canada (PIPEDA)

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) gives you rights of access and correction and the ability to complain to the Office of the Privacy Commissioner of Canada (OPC). You control non-essential analytics and advertising via the cookie banner and Global Privacy Control. Canada is NOT part of the signed-in default-on analytics enabled for account holders in opt-out jurisdictions -- it remains opt-in via the banner.

Australia (Privacy Act)

If you are in Australia, the Privacy Act 1988 and the Australian Privacy Principles (APPs) give you rights of access and correction, with oversight by the Office of the Australian Information Commissioner (OAIC). You control non-essential analytics and advertising via the cookie banner and Global Privacy Control. Australia is NOT part of the signed-in default-on analytics enabled for account holders in opt-out jurisdictions -- it remains opt-in via the banner.

California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information:

• Right to Know -- You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete -- You have the right to request deletion of your personal information, subject to certain legal exceptions.
• Right to Opt Out of Sale or Sharing -- We do not sell your personal information as defined by the CCPA. However, certain advertising activities (such as personalized ads served by our third-party advertising partners) AND the GA4 + Google Signals flow (and any GA4 BigQuery Export, where enabled) described in Section 4 may constitute a "sale" or "sharing" under CCPA / CPRA definitions (when Signals is on, GA4 event data including custom dimensions is shared with Google and may be used by Google to associate visits with the visitor's Google account profile data on Google's side; where a BigQuery export is enabled it delivers event-level data into our Google Cloud project). You can opt out of personalized advertising by visiting the Digital Advertising Alliance (DAA) or Network Advertising Initiative (NAI) opt-out tools.
• Right to Non-Discrimination -- We will not discriminate against you for exercising any of your CCPA rights.

To submit a CCPA request, contact us at support@bootybaybroker.com. We will verify your identity before processing any request and respond within 45 days.