Privacy Policy

Account Information

When you create an account, we collect the following information:

• Email Address -- Used for account creation, password recovery, and important service communications.
• Username -- A display name you choose during registration, visible to other users in certain contexts.
• Password -- Hashed using bcrypt. Your password is never stored in plaintext and cannot be recovered or viewed by anyone, including administrators.

Battle.net Account Link

If you choose to link your Blizzard Battle.net account, we store a Battle.net identifier and basic profile information provided through Blizzard's official OAuth2 flow. We never receive or store your Battle.net password.

Usage Data

We automatically collect certain information when you use the Service, including:

• Pages visited and features used (such as which game version tabs you browse, items you search for, and price charts you view)
• General interaction patterns and navigation behavior
• Browser type, version, operating system, and device information
• Referring URLs and search terms that led you to the site
• IP addresses (hashed using HMAC-SHA-256 with a server-side salt and anonymized for security auditing purposes only -- raw IPs are never stored and the salted hash cannot be reversed)
• Approximate geographic region (derived from IP address for region selection, not stored)

Advertising Data (Collected by Third Parties)

When you visit our Service, our advertising partner Google AdSense may automatically collect certain information through cookies and similar technologies, including:

• Your browser type, version, and language preferences
• Device identifiers and operating system information
• IP address (used by Google for geographic targeting and fraud prevention)
• Pages you visit on our Service and the content you interact with
• Ad impressions, clicks, and engagement metrics
• Information from other websites you have visited that participate in Google's advertising network, used to serve interest-based advertisements

This data is collected and processed directly by Google under Google's own Privacy Policy. We do not have access to the raw advertising data Google collects. See Section 5 (Advertising) for full details on how Google uses this information and how you can opt out.

Contact Form Submissions

When you use the contact form, we collect your name, email address, and message content. This information is used solely to respond to your inquiry and is not shared with third parties. An optional subject field is also collected if provided.

Information We Do NOT Collect

We do not collect the following:

• We do not collect your Battle.net password, game credentials, or authentication tokens beyond the OAuth2 session
• We do not collect in-game data from your WoW characters (gold, inventory, mail, guild bank)
• We do not collect payment or financial information of any kind
• We do not collect social media account data beyond what you voluntarily provide
• We do not collect precise location data -- only approximate region derived from IP address for server selection, which is not stored
• We do not install or require any addons, browser extensions, or client software
• We do not use fingerprinting or hidden tracking techniques beyond standard cookies described in this policy

Contractual Necessity

Processing that is necessary to provide the Service you requested. This includes account creation, authentication, session management, password recovery, and delivering core features such as price tracking, favorites, and alerts.

Legitimate Interest

Processing that serves our legitimate business interests, provided those interests do not override your fundamental rights and freedoms. This includes security monitoring, fraud prevention, abuse detection, rate limiting, service performance optimization, and aggregated analytics to improve the Service.

Consent

Processing that relies on your explicit, informed consent. This includes optional Battle.net account linking, receipt of non-essential communications, and the use of advertising cookies by Google AdSense to deliver personalized advertisements. You may withdraw your consent at any time -- for example, by unlinking your Battle.net account, adjusting your cookie preferences, opting out of personalized ads via Google Ads Settings, or deleting your account entirely.

Legal Obligation

Processing that is necessary to comply with a legal obligation to which we are subject, such as responding to lawful requests from public authorities or retaining certain records as required by applicable law.

Essential Cookies (First-Party, Strictly Necessary)

These cookies are strictly necessary for the Service to function correctly. They cannot be disabled without breaking core functionality. They do not collect information for marketing purposes.

• Session Cookie (connect.sid) -- Maintains your login state and CSRF protection while you are signed in. This is an HttpOnly, Secure cookie that cannot be read by client-side JavaScript. It expires when your session ends or after a period of inactivity. It is regenerated on security-sensitive actions (login, password change) to prevent session fixation.
• Preference Cookies -- Store your selected region, realm, game version, and display preferences (such as faction and sort order) so the Service remembers your choices across page loads. These are first-party cookies that do not leave your browser.

Advertising Cookies (Third-Party -- Google AdSense)

This site displays advertisements served by Google AdSense (publisher ID: ca-pub-6448200357413737). Google and its advertising partners use cookies (including the DoubleClick/IDE cookie, NID, and others), web beacons, and similar technologies to serve ads, measure their effectiveness, and personalize the advertising experience.

For full details on which advertising cookies are set, how personalized and non-personalized ads work, and how to opt out, see Section 5: Advertising.

Analytics (Third-Party -- Cloudflare Web Analytics)

We use Cloudflare Web Analytics to collect anonymized, aggregated usage statistics. Cloudflare Web Analytics is a privacy-first analytics tool that:

• Does not use cookies or track individual users
• Does not collect personally identifiable information
• Collects only aggregated metrics such as page views, visit counts, and referrer data
• Complies with GDPR, CCPA, and other privacy regulations by design
• Does not follow users across websites or build advertising profiles

Managing Cookies

Most web browsers allow you to control cookies through their settings. You can typically find these in the "Options," "Settings," or "Preferences" menu of your browser. The following links may help you understand your options:

• Cookie settings in Chrome
• Cookie settings in Firefox
• Cookie settings in Safari
• Cookie settings in Microsoft Edge

Please note that disabling essential cookies may prevent you from using core features of the Service, such as staying logged in or saving your preferences. Blocking advertising cookies will not remove ads but will cause you to see generic, non-personalized advertisements instead.

How Google AdSense Works

Google AdSense is a program run by Google LLC that allows website publishers to serve automatic text, image, video, and interactive media advertisements on their sites. When you visit a page on our site that contains ads:

• Google's ad-serving technology loads on the page and requests an advertisement from Google's ad servers.
• Google may read existing cookies on your browser or place new cookies to determine which ads to show you.
• The ads you see may be based on the content of the page you are viewing (contextual targeting), your general geographic location, and -- if you have not opted out -- your browsing history across Google's advertising network (interest-based targeting).
• Google collects data about ad impressions, clicks, and your interaction with ads. This data is used to measure ad performance, prevent fraud, and improve the advertising experience.

Personalized vs. Non-Personalized Ads

Personalized ads (also called interest-based ads) use data collected from your browsing activity across websites to show you advertisements that are likely to be relevant to your interests. Google builds an advertising profile based on the websites you visit, the apps you use, and other online activity.

Non-personalized ads are based solely on the content of the page you are currently viewing and your general geographic location. They do not use cookies for ad targeting, though they may still use cookies for frequency capping and ad fraud prevention.

If you are located in the European Economic Area (EEA) or the United Kingdom, Google will request your consent before serving personalized ads, in compliance with GDPR. You can change your consent choice at any time.

Your Advertising Choices

You have several options for controlling the ads you see on the Service:

• Opt out of personalized ads via Google: Visit Google Ads Settings to control what information Google uses to show you personalized ads, or to turn off personalized ads entirely.
• Opt out via industry programs: Visit the Digital Advertising Alliance (DAA) or the Network Advertising Initiative (NAI) to opt out of personalized ads from participating companies.
• For EU/UK users: Visit Your Online Choices to manage your preferences for online behavioral advertising.
• Browser settings: Configure your browser to block third-party cookies, which will prevent most personalized advertising tracking. See Section 4 for browser-specific instructions.

Technical Safeguards

• Encryption in Transit -- All connections to the Service are encrypted using HTTPS/TLS. Unencrypted HTTP requests are automatically redirected to HTTPS.
• Password Hashing -- User passwords are hashed using bcrypt, an adaptive hashing algorithm specifically designed to resist brute-force and rainbow table attacks. Passwords are never stored in plaintext.
• Session Security -- Login sessions use secure, HttpOnly cookies with CSRF (Cross-Site Request Forgery) protection. Sessions are regenerated on authentication state changes (login, password change, email change) to prevent session fixation attacks.
• IP Anonymization -- IP addresses stored for security auditing are hashed using HMAC-SHA-256 with a server-side salt before storage. The salted one-way hash ensures they cannot be reversed to identify individuals, even with knowledge of the hashing algorithm.
• Rate Limiting -- API endpoints and authentication routes are protected by rate limiting to prevent brute-force attacks and abuse.

Operational Safeguards

• Database Security -- All data is stored in encrypted databases hosted on secure infrastructure with strict access controls. Only essential systems have access to production data.
• Account Lockout -- Repeated failed login attempts trigger temporary account lockouts to protect against credential stuffing attacks.
• Credential Sanitization -- API keys, tokens, and sensitive credentials are scrubbed from error logs and diagnostic output to prevent accidental exposure.

Automated Decision-Making

We use automated processing for the following limited purposes:

• Rate Limiting and Abuse Detection -- Automated systems monitor request patterns to detect and block abusive behavior (such as scraping or brute-force attacks). These systems may temporarily restrict access based on detected patterns.
• Account Lockout -- Automated systems temporarily lock accounts after repeated failed login attempts. This is a security measure and does not involve profiling.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Google AdSense may use automated processes to select which ads to display, but this does not affect your access to or use of the Service.

European Economic Area (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR). Our legal basis for processing your personal data depends on the type of data and how we use it:

• Contractual Necessity -- Processing required to provide the Service you requested (account creation, authentication, service delivery).
• Legitimate Interest -- Processing for security monitoring, fraud prevention, service improvement, and analytics, where our interests do not override your fundamental rights.
• Consent -- Processing based on your explicit consent, such as optional Battle.net account linking or personalized advertising via Google AdSense. You may withdraw consent at any time.

Under the GDPR, you have the right to access, rectify, erase, restrict processing of, and port your personal data. You also have the right to object to processing and to lodge a complaint with your local data protection authority. To exercise these rights, contact us at [email protected].

California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information:

• Right to Know -- You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete -- You have the right to request deletion of your personal information, subject to certain legal exceptions.
• Right to Opt Out of Sale -- We do not sell your personal information as defined by the CCPA. However, certain advertising activities (such as personalized ads served by Google AdSense) may constitute a "sale" or "sharing" under CCPA definitions. You can opt out of personalized advertising by visiting Google Ads Settings.
• Right to Non-Discrimination -- We will not discriminate against you for exercising any of your CCPA rights.

To submit a CCPA request, contact us at [email protected]. We will verify your identity before processing any request and respond within 45 days.