This policy explains how Limitless WoW ("we") handles personal data when you use our website and game server. We collect as little as we need to run the Service.
What we collect
- Account data: your email address and a one-way hash of your password (we never store or see your password in plain text), your BattleTag and account creation date.
- Technical data: IP addresses used to register, log in to the website or game, and vote; login attempts; game client information sent when you connect.
- Game data: characters, items, achievements, Mythic+ runs, chat and other gameplay data stored by the game server.
- Donation data: amount, currency, date and status of donations, and the email address given to our payment processor. Card details are handled entirely by Stripe and never reach our servers.
- Support messages you send us.
Why we use it
- To create and secure your account, let you log in and recover access (performing our agreement with you).
- To prevent cheating, fraud, abuse, ban evasion and multiple-account voting (our legitimate interest in protecting the Service).
- To credit donations and vote rewards and keep records of them.
- To send service emails: password resets, email-change confirmations and security notices. We do not send marketing email.
What is public
Character names, level, race, class, guild, equipment, talents, achievements and Mythic+ results are shown publicly on the armory and leaderboards. Your email address, IP addresses and donation history are never public.
Who we share it with
- Stripe processes donations under its own privacy policy.
- Our email and hosting providers process data only to deliver the Service.
- If Cloudflare Turnstile is enabled, Cloudflare processes limited technical data to tell humans from bots.
- We may disclose data when required by law or to protect players from serious harm.
We do not sell personal data.
How long we keep it
- Account and game data: while your account exists.
- Login and vote logs with IP addresses: up to 12 months.
- Donation records: as long as needed for accounting and fraud prevention (usually up to 7 years).
- Password-reset and email-change links expire within 24 hours and are stored only as hashes.
Your rights
Depending on where you live (for example under the GDPR or UK GDPR), you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to your local data protection authority. To make a request, email [email protected] from your account email address. Deleting your account permanently removes your characters and cannot be undone. We may keep records we are required to keep, such as donation records and ban records needed to prevent evasion.
Security
Passwords are hashed, sessions use secure HTTP-only cookies, and administrative access is restricted. No system is perfectly secure, so use a unique password for your account.
Children
The Service is not intended for children under 13. If we learn that a child under 13 has created an account, we will delete it.
Changes
We will update the date at the top of this page when this policy changes. See also our Cookie Policy.