Privacy Policy

Version 2 · October 31, 2026

This policy explains which personal data ForeverDB processes when you visit the website, sign in, use the ForeverDB Uploader or contact us, why we do it, and what rights you have. We only collect what we need to run the site, and we say so whenever we need your consent.

1. Controller

Alexander Bangert
In der Auen 117
51427 Bergisch Gladbach
Germany

Email: info@foreverdb.app
Phone: +49 176 93119313
Website: https://www.foreverdb.app

2. Summary

  • You can use ForeverDB without an account and without cookies.

  • We count page views with a self-hosted, cookieless analytics tool (Plausible) that does not store your IP address.

  • Google Analytics is only loaded if you allow it in the privacy settings.

  • If you create an account, we store your email address or the account ID of the login provider you chose (Discord or Battle.net).

  • If you use the ForeverDB Uploader, the game data you upload is published on the site. Your characters are only recorded if you switch this on in the addon, and you can hide their pages at any time.

  • We do not sell your data.

3. Hosting and server logs

Website. The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, your browser sends technical data to Vercel: IP address, date and time, the page requested, the referring page (referrer), browser, operating system and language. Vercel uses this data to deliver the page, protect it against attacks and record errors.

API, database, files and search. Our backend runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Helsinki, Finland. This includes the database, uploaded files (screenshots, feedback attachments, game data) and the item search. The search is queried directly from your browser, so our servers receive the same technical data as above.

We store server logs only as long as we need them to operate the service and investigate errors or attacks, and delete them after 30 days at the latest.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a secure and reliable website. We have concluded data processing agreements with Vercel and Hetzner. Vercel Inc. is certified under the EU-US Data Privacy Framework, so transfers to the USA are covered by an adequacy decision of the European Commission (Art. 45 GDPR).

4. Cookies and local storage

We only set cookies that the site needs, and with your consent the cookies of Google Analytics (see section 6.3).

  • fdb-session: keeps you signed in. Duration: 30 days, renewed while you use the site.

  • Consent settings (c15t): remembers your privacy choices. Duration: until you change or delete them.

  • _ga, _ga_<ID>: Google Analytics, only with your consent. Duration: up to 2 years.

In addition, the site stores your own settings in your browser's local storage, for example the colour theme, the map layer and your quest checklist. This data stays on your device and is not sent to us.

Legal basis: Section 25 (2) no. 2 TDDDG for storage that is strictly necessary for the service you requested, and Art. 6 (1) (b) and (f) GDPR. For Google Analytics: your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR).

5. Privacy settings

When you first visit the site, a banner asks for your privacy choices. Your decision is stored in your browser only; we have no server-side record of it. You can change it at any time via "Privacy settings" at the bottom of every page.

6. Analytics

6.1 Plausible Analytics

We count visits with Plausible Analytics, which we host ourselves; the data is not shared with Plausible Insights OÜ or anyone else. Plausible sets no cookies and stores no IP addresses. To tell visits apart, it creates a daily changing hash from the IP address, browser and website; the hash is discarded after 24 hours, so you cannot be recognised on another day or on other websites.

We record the pages viewed, the referring website or campaign parameter (utm_source), country, browser, operating system and device type, as well as anonymous events on our site: links followed between pages, searches, whether a page stayed open for at least 10 seconds, and whether an ad blocker prevents ads from loading. All data is only evaluated in aggregate.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is understanding how the site is used in order to improve it, in a way that does not identify you.

6.2 Vercel Speed Insights

We measure the loading speed of our pages with Vercel Speed Insights. It sets no cookies and records performance values (such as loading times), the page, browser, device type and country. The data is processed by Vercel Inc. (see section 3) and only evaluated in aggregate.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a fast and working website.

6.3 Google Analytics

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics is only loaded once you allow the "Analytics" category in the privacy settings. Without your consent, or after you decline, no data is sent to Google.

Purpose: We use Google Analytics to measure the reach of our website and to demonstrate it to advertising partners, for example the number of visitors, the pages viewed and the countries visitors come from.

Data processed: Pages viewed and the time of each visit, the referring page, browser, operating system, device type, screen resolution and language settings. Google Analytics also uses a randomly generated identifier to recognise returning visits. Your IP address is necessarily transmitted to Google; Google uses it only to determine your country and does not store it. We have disabled more granular location and device data collection. Google Signals, which links data to Google accounts, and data sharing for Google's own purposes are also disabled.

Retention: Data on individual visits is deleted automatically after 2 months. After that, only aggregated statistics remain, which do not identify individual visitors.

Legal basis: Your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future via "Privacy settings" at the bottom of every page.

Data processing agreement and transfers: We have concluded a data processing agreement with Google. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, so the transfer is covered by an adequacy decision of the European Commission (Art. 45 GDPR). More information: https://policies.google.com/privacy

7. Account and sign-in

You need an account only to contribute, for example to upload screenshots or to link the ForeverDB Uploader. You can sign in in three ways:

  • Email code: You enter your email address and receive a one-time code. The email is sent via Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France), which processes your email address on our behalf under a data processing agreement. Codes expire after 15 minutes and are deleted one day after they expire.

  • Discord: We receive your Discord user ID and display name (scope identify). We do not receive your email address or access to your servers or messages. Provider: Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. https://discord.com/privacy

  • Battle.net: We receive your Battle.net account ID and BattleTag. Provider: Blizzard Entertainment. https://www.blizzard.com/privacy

For your account we store: email address (if you signed in by email), display name, the linked login providers, your role, the time of your last sign-in, and when you accepted the terms and this privacy policy. For each sign-in and session we store the IP address and browser identifier (user agent) to protect your account against misuse. Sessions, including this data, are deleted 30 days after they end, that is after you sign out or the session expires.

When you sign in with Discord or Battle.net, the provider learns that you are signing in to ForeverDB. Discord and Blizzard may process data in the USA under their own privacy policies.

Legal basis: Art. 6 (1) (b) GDPR (providing your account). For IP addresses and user agents: Art. 6 (1) (f) GDPR; our legitimate interest is preventing misuse of accounts.

Deleting your account: Write to us at the email address in section 1 and we will delete your account and the data linked to it, unless we need to keep something for legal reasons.

8. ForeverDB Uploader and game data

The ForeverDB Uploader is an optional desktop app. It reads data that the World of Warcraft client and the ForeverDB addon store on your computer and uploads it to us. This includes:

  • Game observations: quests, NPCs and their locations, loot, merchants and encounters. We publish them in aggregated form as part of the database.

  • Characters, only if you enable it: character data is only recorded if you switch on character capture in the ForeverDB addon. It is off by default. If you enable it, we receive the name, realm, level, class, race, faction, guild and guild rank, equipment, talents, professions, character stats and gold of your characters, with the time of the snapshot.

  • Technical data: an ID of your Uploader installation, upload times and the files' checksums; if you link the Uploader to your account, the link to your account.

Character pages: Characters you capture are shown on public character pages (Armory). You can hide each character at any time in your profile, and stop capturing by switching the option off in the addon. Uploaded game observations are not shown with your name or character.

Legal basis: Art. 6 (1) (b) GDPR, as you use the Uploader to contribute to ForeverDB. For your characters and their public pages: your consent, given by switching on character capture in the addon (Art. 6 (1) (a) GDPR). You can withdraw it at any time by switching the option off and hiding or having us delete your characters.

9. Screenshots and contributions

If you upload a screenshot or edit content, we store it together with your account and the time. Published screenshots and contributions are visible to everyone; your account is only visible to our editors.

Legal basis: Art. 6 (1) (b) GDPR.

10. Feedback form

When you send feedback, we store your message, the page you sent it from, language, browser, window size, and optionally a screenshot of the page and your email address if you enter it. If you are signed in, we link the feedback to your account. We also store your IP address to fend off spam and abuse; it is deleted automatically after 90 days. We use the remaining data only to handle your feedback and delete it once it is no longer needed for that purpose.

Legal basis: Art. 6 (1) (b) GDPR if you are signed in, otherwise Art. 6 (1) (f) GDPR; our legitimate interest is answering and acting on feedback and preventing spam.

11. Embeds and tooltips on other websites

Other websites can embed ForeverDB content (for example talent builds or dungeon loot) or show our item tooltips. In that case your browser loads this content from our servers, and we receive the technical data described in section 3, including the address of the website that embeds it. Page views of embedded content are counted by Plausible as described in section 6.1. Links from embedded content carry the name of the embedding website as utm_source, so we can see which websites send visitors to ForeverDB.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is providing and measuring our embeddable content.

12. External links

We link to other websites such as Wowhead, GitHub, Discord and Ko-fi. No data is sent to them until you click a link. From then on, their own privacy policies apply.

13. Recipients

Personal data is only passed on as described in this policy, to the following recipients:

  • Vercel Inc.: website hosting and Speed Insights. USA (EU-US Data Privacy Framework).

  • Hetzner Online GmbH: servers, database, file storage and search. Finland (EU).

  • Sendinblue SAS (Brevo): sending sign-in emails. France (EU).

  • Google Ireland Limited: Google Analytics, only with your consent. Ireland and USA (EU-US Data Privacy Framework).

  • Discord Inc. and Blizzard Entertainment: sign-in, only if you choose it. USA.

14. Retention

We delete personal data as soon as it is no longer needed for the purpose for which it was collected, unless we are legally required to keep it. Specific periods are stated in the sections above.

15. Your rights

Under the GDPR you have the right to:

  • access the data we store about you (Art. 15),

  • rectification of incorrect data (Art. 16),

  • erasure (Art. 17),

  • restriction of processing (Art. 18),

  • data portability (Art. 20),

  • object to processing based on Art. 6 (1) (f) GDPR on grounds relating to your particular situation (Art. 21),

  • withdraw your consent at any time with effect for the future (Art. 7 (3)).

To exercise your rights, write to us at the email address in section 1.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
https://www.ldi.nrw.de

17. Changes

We update this policy when the site or the law changes. The current version is always available on this page; the date at the top shows when it was last changed.