Privacy Policy

1. About this policy

This policy describes how the ArdenWoW project handles information collected through its website and account registration service.

For account support, purchase or privacy requests, contact support@ardenwow.com.

2. Information we process

We process your email address, a salted password hash, registration and verification dates, the terms version you accepted, and reward eligibility. A game account identifier and access-email status may be added when those features are connected. Confirmation, recovery and session tokens are stored as hashes for validation. If you turn on two-factor log-in, we store your authenticator key encrypted, with a copy in the game server so the game can check your codes, and your recovery codes as keyed hashes. We remove them when you turn it off. So that it does not ask again on every log-in, the game server keeps the IP address where you last entered a code for up to 30 days. To warn you about sign-ins from somewhere new, the website keeps a keyed hash of each network you signed in from, on the website or in the game, never the address itself, and the game server keeps the addresses your game account signed in from. Both remove an entry after a year without use. When a sign-in comes from a network your account has not used before, we email you its IP address. Pending outgoing messages, including their email links, are encrypted until delivery or expiry. Infrastructure providers may process IP addresses, device information, request logs and delivery events. To investigate player reports, support requests and abuse, the game server keeps records of in-game activity, such as interactions with other players and item transactions, for up to 45 days. Only authorized staff can review them. The game server also publishes game data on this website, where anyone can see it: character and guild names, leaderboard rankings and, in the Armory, each character's level, race, class, guild and rank, equipped items, stats, professions and achievements. It is not linked to your email or to your website or game account. Staff characters are not listed, and a character that is deleted or banned is removed at the next update. Never send us your password by email.

3. Why we use it

We use registration data to provide the account and game service you request, verify ownership of your email, manage rewards, send access information, and prevent abuse. Where applicable, the legal bases are performance of the requested service, legitimate interests in security and service reliability, and compliance with legal obligations. Separate optional marketing would require its own appropriate consent process; this form does not enroll you in unrelated newsletters.

4. Service providers

Railway hosts the website; the configured PostgreSQL service stores registrations; Resend processes recipient addresses and message content to deliver account emails; and hCaptcha processes verification and device/network information to detect abuse. PayPal and Terminal3 process Donation Points payments under their own privacy policies: we send Terminal3 your account identifier, email address and registration date to process the payment and prevent fraud, and we keep each order's package, amount, status and the provider's transaction reference. We never receive your card details. We do not sell your personal information. Providers may process data outside your country under their applicable contractual safeguards. See Resend Privacy Policy, hCaptcha Privacy Policy and Railway Privacy Policy.

5. Cookies and verification

The registration application does not currently use advertising or analytics cookies. hCaptcha may use cookies or similar technology for security and verification under its own policy. We use an essential HttpOnly session cookie to keep you signed in, with a maximum duration of seven days and a 24-hour inactivity limit. If you tick Remember this browser when signing in with two-factor log-in, a second essential HttpOnly cookie skips the code in that browser for up to 30 days. The hCaptcha widget loads when configured on registration, login and email-request pages. Your browser communicates directly with hCaptcha.

6. Retention and security

Verification links expire after 24 hours and password-reset links after 30 minutes. Pending accounts can request a new link and are removed after 30 days if still unconfirmed. Expired sessions, recovery tokens and rate-limit records are removed through our maintenance process. Outgoing message bodies are removed after delivery or expiry; routine delivery metadata is retained for up to 30 days, while announcement campaign identifiers remain to prevent duplicate announcements. Confirmed registration data is kept while needed to provide game access, account services and rewards, or until you delete the account or a valid deletion request is processed, subject to legitimate legal or security retention needs. Hosting logs, email-provider records and backups follow the configured provider retention periods. We restrict access and store password hashes rather than readable passwords.

7. Your choices and rights

You can delete your website account yourself under Account Details on your account page. Payment records are then kept without your email for accounting, and a linked game account and its characters are removed only on request. You can contact the operator to request access, correction or deletion of your information. Depending on your location, you may also have rights to portability, restriction, objection, withdrawal of consent and complaint to a data protection authority. We may need to verify your identity before fulfilling a request. Deleting an account may prevent us from providing its access and rewards.

8. Children and updates

This registration service is not directed at children below the age at which they can lawfully use it without parental authorization. Contact us if you believe a child has provided information without required authorization. We will update this notice when processing changes and publish the revision date above.