Privacy Policy

1. Data We Collect

We collect the following data when you use the Platform:

• Discord account: Username, email address, avatar URL, and Discord user ID. Collected during sign-in via Discord OAuth.
• Battle.net account (optional): Battle.net ID, BattleTag, and OAuth tokens. Collected when you link your Battle.net account.
• WoW character data: Character names, realms, levels, classes, races, factions, item levels, and specs. Synced from Blizzard's API when you link Battle.net or click Sync.
• Profile information: Display name, bio, and timezone. Provided by you in profile settings.
• Guild data: Guild membership, roles, event signups, war stories, comments, announcements, and application messages. Created through your use of the Platform.
• Uploaded images: Banner images uploaded to your guild or legion. Stored on Vercel Blob storage. The image URL is associated with the guild record, not your user account, but the upload action is recorded in the guild's audit log alongside your user ID.
• Event attendance records: Whether you were marked present, late, no-show, or excused for guild events you signed up for, recorded by guild officers. Used to compute attendance rates visible to members of guilds you belong to.
• Error reports: When something breaks in the Platform, we collect the error message, stack trace, URL path, browser information, and your Discord user ID so we can fix the bug. Sent to Sentry (see Third-Party Services below).
• Aggregate usage analytics: Page views, visit counts, and referral sources — collected in a cookieless, privacy-preserving way via Vercel Web Analytics.
• Feedback and reports: Messages submitted through the Feedback page or war story report feature.

2. How We Use Your Data

• To authenticate you and maintain your session
• To sync and display your WoW characters
• To power guild management features (roster, events, recruitment, announcements)
• To send email notifications (feedback confirmations, war story reports, invite requests)
• To send Discord webhook notifications to guilds you belong to
• To enforce platform rules and prevent abuse (rate limiting, audit logging)
• To improve the Platform based on usage patterns and feedback

3. Cookies

The Platform uses only strictly-necessary cookies for authentication and security: a session cookie from NextAuth and a CSRF protection cookie. These are required for the Platform to function and are exempt from consent requirements under GDPR and the ePrivacy Directive.

We do not use cookies for advertising, cross-site tracking, or analytics. Our analytics provider (Vercel Web Analytics) is cookieless by design.

4. Data We Do NOT Collect

• We do not collect passwords (authentication is handled by Discord and Blizzard)
• We do not collect payment information (no paid features currently)
• We do not use advertising or cross-site tracking cookies
• We do not sell, rent, or trade your data to third parties

5. Third-Party Services

The Platform uses the following third-party services:

• Discord — Authentication (OAuth) and outbound webhook notifications to guild channels. Subject to Discord's privacy policy.
• Blizzard / Battle.net — Character data sync (OAuth + API). Subject to Blizzard's privacy policy.
• Vercel — Hosting, deployment, cookieless web analytics (page views, visit counts, referrer), and Blob storage for uploaded banner images. Subject to Vercel's privacy policy.
• Sentry — Error tracking. Receives error messages, stack traces, URL paths, browser information, and your Discord user ID when the Platform encounters an exception. Used solely for debugging. Subject to Sentry's privacy policy.
• Neon — Database hosting (PostgreSQL). Subject to Neon's privacy policy.
• Resend — Email delivery (sent from noreply@doomrah.gg). Subject to Resend's privacy policy.

6. Data Storage & Security

Your data is stored in a PostgreSQL database hosted by Neon. The Platform is deployed on Vercel. All data is transmitted over HTTPS. We implement security measures including input validation, rate limiting, role-based access control, and automated testing. However, no system is 100% secure and we cannot guarantee absolute security.

7. Data Visibility

• Your Discord username and avatar are visible to other guild members
• Your characters are visible to members of guilds those characters belong to
• Your display name and bio are visible on your profile
• War stories and comments are visible to guild members
• Your event attendance records are visible to other members of the same guild, subject to that guild's per-role attendance visibility setting. Officers can always see attendance for guilds they manage.
• When you apply to a guild, officers reviewing your application may see your attendance summary from other Doomrah guilds you belong to (limited to guilds that have opted into transparent attendance sharing)
• Your email address is never exposed to other users
• Public guild profiles show guild-level information only, not individual member details

8. Data Retention

We retain your data for as long as your account is active. If you request account deletion, we will remove your personal data within 30 days. Some data may be retained in anonymized form for platform analytics. Audit logs are retained for platform integrity and may reference your actions without identifying personal information.

Uploaded banners: When a banner is replaced or cleared, the previous image is deleted from Vercel Blob storage as part of the same action. Banners may also be removed if they violate the Terms of Service. We may preserve copies of removed images as needed to comply with legal obligations or to assist law enforcement.

9. Your Rights

You have the right to:

• Access — Request a copy of the data we hold about you
• Correction — Update or correct your personal information via profile settings
• Deletion — Request deletion of your account and associated data
• Portability — Request your data in a machine-readable format
• Withdraw consent — Unlink your Battle.net account at any time; revoke Discord access via Discord settings

To exercise these rights, contact us via the Feedback page or our Discord.

10. Children's Privacy

The Platform is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, contact us and we will delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via the Platform. The "Last updated" date at the top reflects the most recent revision.

12. Contact

Questions about your privacy? Use the Feedback page or reach out on our Discord.