1. What This Policy Covers

This Policy explains how information is handled when you use the EvolvedWOTLK website, create or use a website/game account, play on the realm, use account or support features, connect Discord, or interact with public services such as the Armory, leaderboard, online roster, voting pages, downloads, and Realm Status tools.

This Policy applies to information handled by the project operator. Discord, Cloudflare, voting providers, and other external services have their own privacy practices for information they process directly.

2. Information We Handle

2.1 Account and Profile Information

• Realm account ID and username, email address where held by the account system, and password-verifier data used to authenticate your account. The website does not store readable passwords.
• Website profile settings, selected characters, public Armory and Discord visibility choices, and avatar images you upload. Avatars are processed into a standard web image format.
• Remembered-device records and two-factor settings, including encrypted authenticator configuration, hashed recovery codes, and temporary email-verification records where those features are enabled.

2.2 Technical and Security Information

• IP address, browser user-agent, session and login times, security events, account changes, rate-limit events, and information used to detect suspicious access or abuse.
• Administrative audit records may include a staff member's account ID and username, the action and time, the affected account or record, and a reason or operational note.
• Vote-verification records may include the account, voting provider, request IP address, session identifier, a user-agent hash, and callback details.
• Cloudflare Turnstile may process browser and connection signals, such as IP address, user-agent information, TLS fingerprint, and the website challenge identifier, to detect automated abuse during registration and selected login challenges.
• When a security record's approximate location is viewed, its IP address may be sent from the website server to ipwho.is for a country, region, or city lookup. The resulting location is approximate.

2.3 Game and Public Activity Information

• Character and guild information needed to run realm features, such as character name, level, class, race, faction, guild, online state, equipment, achievements, and progression.
• Public roster and live-map information, including a character's name, guild, class or race, online state, and current in-game zone or map position. Staff/GMs are excluded from public map coordinates.
• Voting history, Vote Points, daily-reward claims, VoteShop purchases, reward-delivery status, and related operational records.
• Website profile pages are not publicly available at this time. Some account avatars may appear in public leaderboard interfaces. Public character/Armory visibility is controlled by the relevant account and feature settings.

2.4 Reports, Support, and User Submissions

• Player reports, report messages, staff replies, status history, and information you provide to explain an incident.
• Images uploaded as report evidence, along with text or external media links you choose to submit. Evidence is available to the reporting player and authorized staff for investigation and support.
• Information in support or account requests, including identity details needed to verify account ownership before making a privacy or security change.

2.5 Discord and Connected Services

• If you link Discord, the project stores your Discord user ID, username, display name, avatar URL, linked realm account, selected main character, visibility choices, and link timestamps.
• Verification codes are stored as hashes rather than readable codes. Link, unlink, profile-change, and security-event records are used to operate and protect the integration.
• When you follow a link to an external voting site, such as EpicTop100, TopG, XtremeTop100, or GTop100, that provider receives information directly from your browser under its own notice. The website receives the information needed to verify a vote.
• When you use Discord, Discord processes your account and interaction data under its own notice. The project bot receives the information needed to provide the selected integration or send a configured service notice.

2.6 Where Information Comes From

Information comes from you when you register, change settings, use a feature, or contact support; from the realm and website databases associated with your account; from Discord or a voting provider when you choose those integrations; and automatically from browser requests, sessions, security controls, and service-monitoring systems.

3. Why We Use Information

Some information, such as an account name, password, and an email address where required by the account system, is needed to create or secure an account or provide a feature you request. If you do not provide information required for a feature, we may be unable to create your account or provide that feature. Optional settings and integrations can be left unused.

4. Who Can See Information

The project operator and authorized staff can access account, security, report, and game information when needed to run the service, provide support, moderate reports, or protect users and infrastructure. Access is limited to operational needs.

Detailed Armory pages follow the public Armory privacy setting. The public online roster and live map may still show limited live game information, including a character's current in-game zone or map position; the current Armory setting does not hide those roster/map details. Staff/GMs are excluded from public map coordinates. Discord's optional public-whois setting controls what the linked Discord integration displays. Account profile pages are not currently public; if they are introduced later, this Policy and the available visibility controls will be updated before launch.

The Realm Status page, status API, and widget publish service health, population summaries, maintenance notices, and incident updates. They are not intended to publish private account details. We do not sell personal information or use it for third-party advertising.

5. Service Providers and Data Locations

• Self-managed hosting: the website runs on the operator's dedicated server in Germany. The game realm and Discord bot run on the operator's dedicated servers in The Netherlands.
• Cloudflare Turnstile: used for anti-bot checks. Cloudflare receives technical challenge signals directly from your browser and processes them to provide Turnstile. See the Turnstile Privacy Addendum.
• ipwho.is: receives an IP address when the approximate-location lookup described above is requested. The website uses its response to show approximate location in security tools.
• Discord: receives Discord account and message data when you use Discord features, link accounts, or interact with the project's bot and notices. Discord describes its own handling in its Privacy Policy.
• External assets and game resources: pages may load interface libraries from jsDelivr and game icons or data from Wowhead, Zamimg, and other linked game-resource providers. When your browser requests an external asset, that provider may receive standard connection information such as your IP address and the requested resource.
• Email delivery: security and two-factor messages are sent through the mail delivery service configured on the website server. The specific relay depends on the server configuration.

The project operator does not control external providers' independent processing. Some providers may process data in countries outside The Netherlands or the European Economic Area under their own arrangements and privacy notices. Contact us if you need information about a particular provider or applicable transfer safeguards.

6. Retention

We keep information only for the period needed for the purposes above, subject to these operational limits. Account removal may cause earlier deletion. A limited record may be retained where needed to resolve an active safety matter, protect the service, comply with law, or establish or defend a legal claim.

7. Account Removal and Privacy Requests

Email privacy@evolvedwotlk.com to request account removal or exercise a privacy right. We may ask you to verify control of the account before acting. Where a request is valid and can be fulfilled, we will delete or de-identify the relevant information in active systems. Information still needed for a limited security, investigation, or legal purpose may be retained only for that purpose and then deleted. Deleted information may remain in backups until the 90-day backup period expires.

Depending on the circumstances and applicable law, you may request access, correction, deletion, restriction, or portability of your information, object to processing based on legitimate interests, or withdraw consent where processing relies on consent. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Children and Age Eligibility

The service is intended for players aged 12 or older, consistent with the operator's stated PEGI 12 content-rating basis. This service age is not the legal age for giving consent to personal-data processing. Under Dutch law, where processing for an online service offered directly to a child relies on consent, a parent or guardian must provide that consent for a child under 16. The project does not currently collect a date of birth or verify age during registration.

In The Netherlands, people aged 12 and over may contact an organization themselves to exercise privacy rights; a parent or guardian may also act for a child aged 12 to 15. We will handle requests in line with the rules that apply to the person and the request. The Dutch Authority explains these rules in its guidance on consent and children's data and privacy rights.

9. Cookies and Similar Technologies

The website uses first-party cookies for sessions, optional remembered login, and saved appearance or account-interface preferences. It does not currently use analytics or advertising cookies. Cloudflare Turnstile may process the technical signals needed for its security challenge. See the Cookie Policy for the cookie inventory and browser controls.

10. Security

The project uses access controls, encrypted connections, password-verifier storage, protected sessions, rate limits, and security monitoring to reduce risk. No internet service can guarantee that information will never be accessed, lost, or disclosed improperly. Please use a unique password and contact us promptly if you believe your account has been compromised.

11. Changes to This Policy

We may update this Policy when features, providers, or legal requirements change. The current version and effective date are shown above. If a material change affects how information is used, we will highlight it on the website where appropriate.

12. Version History

13. Contact

For privacy questions, account-removal requests, or requests to exercise your rights, contact Middel at privacy@evolvedwotlk.com.