Privacy Policy

Last updated October 28, 2026

What We Collect

You can read every public page on Everything WoW without an account. When you sign in, we store the email address your magic link was sent to. If you sign in with Discord, we store the identifier Discord gives us so we can recognize you on your next visit. If you sign in with or link Battle.net, we never store your Battle.net account name or your Battle.net identifier; we store a one way hash of that identifier, which lets us match you to the same account again and cannot be read back into the original value. We also store the display name you choose, the region you select, the comments and votes you post, and the characters you claim.

When you upload a file from the Everything WoW Companion, the upload is recorded against a contributor hash computed from your account identifier rather than from your name, and an upload you send while signed out is attributed to nothing.

Analytics

Everything WoW counts its own traffic. No analytics script, advertising pixel, or tracking cookie from any other company runs in your browser on this site. We are paid for none of this data, and we build no advertising profile about anyone ourselves.

We record six kinds of event: a page view, an entity page view, a search, a tool use, a Companion upload, and a character lookup. Each record holds the address of the page, the kind of page and the identifier of the thing on it, the country your request resolved to, and a one way hash of your internet protocol address that is salted with the day and a secret we hold. A page view also holds the name of another site that linked to the page and any campaign tags in its address, and every record from a browser that sends the Global Privacy Control signal is marked as such. A search is recorded as having happened and the words you typed are never recorded.

Our own server sends Google Analytics a summary of these records so we can read our traffic in Google's reports. A summary holds the kind of event and when it happened, the path of the page, the kind of page and the identifier of the thing on it, the name of the site that linked you here, any campaign tags in the address you arrived at, the country your request resolved to, the day's address hash as a code that changes every day, and a visit number our server works out from that code and the half hour the event fell in. It never holds your internet protocol address, a user identifier, an email address, or any other information you gave us, and your browser never contacts Google for any of this.

In the European Union, the rest of the European Economic Area, the United Kingdom, and Switzerland, where the law asks for your consent first, and wherever we could not determine your country, the site asks before any summary of your visit is sent, and sends one only after you choose Accept or turn Analytics on. Wherever you are, we send no summary of what you do after you choose Reject or turn Analytics off, and none for a visit from a browser that sends the Global Privacy Control signal. Under our setting, Google keeps the event level data in the summaries we send for fourteen months and the totals in its standard reports for longer, and it may use the summaries under its own terms, including to improve its services and, unless you turned Advertising off, for advertising measurement and personalization.

The address hash changes every day, so two records made on different days cannot be connected to each other, and it cannot be read back into your address. No cookie is set for any of this.

The choice panel sets one cookie, ewow_consent, which records only your choice: the version of the panel you answered and whether Analytics and Advertising are on. It holds no identifier and lasts thirteen months, and our server writes your choice beside each event it records so the summaries follow it. You can change it at any time with Analytics Choices in the footer or on the Your Privacy Choices page. A choice is also recorded on our server with the day's address hash, the country your request resolved to, and the two switches, and that record is deleted after thirteen months.

Cookies

Everything WoW sets a small number of cookies of its own. The cookie named ewow_account is a signed in marker that carries no name, no address, and no token; it lets the server decide whether to render an account link, and it lasts one year. The cookie named ewow_bnet holds your Battle.net session details for the short window in which you can claim a character; it is not readable by scripts in your browser and it lasts ten minutes. Six more cookies hold only technical state: one carries the short-lived value that protects a Battle.net sign in, one remembers the country your request resolved to for a day, one remembers which game version you are browsing, one remembers which Classic dataset you chose, and one tells the assistant that two questions came from the same browser. Your sign in session itself is kept by your browser's local storage rather than by a cookie. The technical cookies are named ewow_bnet_state, ewow_discord_state, ewow_country, ewow_version, ewow_dataset, and ewow_ask, and the Discord sign in session cookie is named ewow_discord. The cookie named ewow_consent records the choice you make in the analytics choice panel and lasts thirteen months.

The Assistant

When you ask the assistant a question we open a session and store a hash of your address that changes every day, an identifier for your browser, and when the session expires. Each message adds a row holding its role, its classification, and a token count, and not the message itself. Your question and the answer are cached for seven days, a character question never is, everything is deleted after thirty days, and none of it is joined to your name.

Who Else Sees Your Data

Our database, authentication, and email delivery run on Supabase through Lovable Cloud. Cloudflare serves the site and protects it from abuse. Blizzard Entertainment's API provides the game data and, when you sign in with Battle.net, confirms your identity to us. Discord provides sign in when you choose it. Cloudflare Turnstile checks that a comment comes from a person rather than a script. Google Analytics receives the summaries the Analytics section describes, from our server and never from your browser, and Google may use them under its own terms as that section says. We share nothing with anyone else.

How Long We Keep It

Your account record, your comments, your votes, and your claims are kept until you ask us to delete them. Event records are deleted ninety days after they are made by a nightly job, which keeps only a daily count of each kind of event.

Deleting Your Account

There is no self service delete control on your account page yet, so email support@everythingwow.com from the address you sign in with and we will remove your account, your claims, and your comments.

Character Data From Blizzard

Character and guild pages are built from Blizzard's Profile API, which publishes that data by Blizzard's own design. We cache what we read so a page loads quickly. If you sign in and claim a character you own, you can hide it from lookups on this site. A Companion upload is recorded against a contributor hash and carries no account data.

Game Data

Game data provided by Blizzard Entertainment through the Battle.net API. Everything WoW is a fan site and is not affiliated with or endorsed by Blizzard Entertainment.

Contact

Write to support@everythingwow.com with any question about this policy.