Privacy notice

Contact and scope

WoW Forever Friends is an independent fan community. For privacy questions, requests about your information or operator details, contact hello@wowforeverclub.org. This notice covers wowforeverclub.org; external websites have their own policies.

Information we use

Accounts: your email address, display name, a salted password hash, account timestamps and a hashed sign-in token. We use these to sign you in, recover accounts and operate the community. Passwords are not stored as readable text.

Google sign-in, if you choose it: Google shares a verified email address, display name and stable Google account identifier so we can create a free Visitor account or sign you into a connected account. Existing password accounts must sign in before connecting Google. We request only basic identity details, not access to Gmail or Drive. Google access and identity tokens are used during sign-in and are not retained; the account identifier remains linked to your Club account. Contact support to request disconnection.

Community activity: posts, comments, replies, helpful votes, poll choices, visitor points, reports, contributions and memorial submissions. Posts and approved memorials can be public under your display name. Account email addresses and private reports are not published in public comments. Do not post someone else’s private information.

Newsletter: your email address, consent date and signup source, plus unsubscribe tokens and campaign delivery records. Joining is optional; account registration alone does not subscribe you.

Paid membership: payment-provider identifiers, subscription and paid-period records, membership choices and payment-event references. If you request a physical badge, we store the recipient name and postal address you submit for fulfilment. Stripe handles card entry; the site does not store full card details.

Technical records: the server receives IP addresses, request paths, browser information and timestamps for operation, security and troubleshooting. Public character requests may be sent to Blizzard when the Armory is enabled. It is currently unavailable.

Why we use it

We use account and membership details to provide services you request; community records to display contributions and support moderation; and technical records to maintain security and reliability. Optional newsletters use the consent given when joining. Billing records may also need to be kept for accounting, disputes or applicable legal obligations. We do not sell mailing lists or personal account information.

Cookies and local storage

The essential fellowship_session cookie supports sign-in. It is Secure, HttpOnly and SameSite=Lax, and expires after 30 days unless cleared or replaced earlier. Logging out revokes the session. A password reset revokes existing sessions.

When you start Google sign-in, the essential __Host-wowfc_google cookie binds the response to your browser for up to 10 minutes. The server stores a short-lived, single-use login attempt to prevent forged or replayed sign-ins.

Collection, progress and saved-record preferences can be stored in your browser’s local storage. You can clear them in your browser settings. Blocking essential cookies prevents sign-in.

Pages load fonts from Google Fonts, which receives connection information such as your IP address. External social links, videos, payment pages and other services apply their own privacy policies when opened.

Service providers and access

Our hosting and backup providers store site records for us. Hostinger processes website and support email; copies of support mailbox messages are forwarded to the operator’s Gmail account, so Google also processes those messages. Stripe processes payments and subscription management. Blizzard supplies public game data. UptimeRobot checks the public health endpoint; it is not given account records.

Authorised operators can access records for support, moderation and maintenance. Providers may process data in countries outside your own. Ask hello@wowforeverclub.org for information about the providers, locations and safeguards relevant to your request.

How long we keep it

Account and community records are kept while needed to operate the account, preserve discussions, handle moderation or resolve disputes. Signed-in users can start or cancel a deletion request from the account dashboard. Support verifies a request before completion, addresses active billing and explains records that must be retained. Public contributions may need to be removed or anonymised separately from billing records.

Sign-in cookies last up to 30 days; password-reset links expire after 30 minutes and can be used once. Expiry prevents use but does not itself remove every security record from the database.

Unsubscribing removes your email from the active newsletter list. Limited consent, delivery or suppression records can remain where needed to honour opt-outs or resolve delivery issues.

Automatic server backups use a 14-day retention window. Private manual recovery copies are retained until replaced or no longer needed. Deleted information can remain in a backup until that copy is replaced or expires; restored data must be checked against deletion requests.

Your choices and requests

Use the unsubscribe link in a newsletter to stop updates. Use the account dashboard to manage blocked users or start an account-deletion request. Email hello@wowforeverclub.org to ask for access, correction, a copy of your information, or to raise an objection or restriction request. We may ask for enough information to verify that the account is yours, but will not ask for your password.

Your rights and any lawful retention obligations depend on the rules that apply to your circumstances. You can also raise a concern with the relevant data-protection authority. This notice does not limit those rights.

Updates

Last updated: 18 October 2026. We will update this page when site practices change.