Privacy policy

Controller

Daniel Girster (“Wosande”)
c/o COCENTER
Koppoldstr. 1
86551 Aichach
Germany
Email: contact@forever-guides.com
Phone: +49 251 2081115929 (Mon–Fri, 9:30 am–4:00 pm CET)

We have not appointed a data protection officer because we do not reach the statutory thresholds. Send privacy questions to the address above.

Summary

• Reading needs no account. We use no analytics, advertising or tracking tools.
• Videos from YouTube, Twitch and Instagram and Wowhead tooltips load only after you consent.
• For an account we store only what each feature needs. What you make public (display name, clips, guilds, event sign-ups, talent setups) is visible to others.
• You can delete your account yourself at any time and request access, rectification and erasure.

Hosting, server logs and abuse protection

Website, database and login system run on servers of Hetzner Online GmbH in Germany, acting on our behalf (Art. 28 GDPR).

For every page request the server necessarily processes your IP address, the time, the requested address and technical browser details. We keep no access log. Error messages go to technical logs that overwrite themselves once they reach a fixed size.

Against abuse (e.g. mass form submissions) we count requests per IP address (shortened for IPv6) or per account in memory. For reports, account features, unlocking calendars and events and internal interfaces we also keep the counters in the database so they survive a restart. It holds neither IP address nor account, only a hash value built with a secret server key (pseudonymous) with a counter and expiry time. The counters expire with their time window (at most 24 hours); expired entries are deleted hourly.

Legal basis: Art. 6(1)(f) GDPR (secure and stable operation).

Images, videos and icons

Images, uploaded videos and game icons are stored in Hetzner Online GmbH’s object storage (Nuremberg) and delivered via the content delivery network of BunnyWay d.o.o. (Slovenia). Both process your IP address and request data on our behalf to transfer the files. We mirror game icons ourselves so your browser does not contact Wowhead servers for them. Legal basis: Art. 6(1)(f) GDPR.

Fonts

All fonts are served from our own server. There is no connection to Google Fonts or other font providers.

Cookies and browser storage

We store information in your browser only when strictly necessary for a feature you request (Section 25(2) no. 2 TDDDG) or with your consent (Section 25(1) TDDDG). All necessary cookies are our own.

These entries stay in your browser (localStorage) and are not sent to us, with one exception: the tutorial progress (see below):

Only with consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR): cookies and storage of YouTube, Twitch and Instagram (category “Video embeds”) and Wowhead (category “Wowhead”). These providers set their own names and durations. You can delete everything in your browser settings at any time.

Tutorials

So that we do not offer you a tutorial again on every visit, we store in your browser’s local storage (localStorage) under the key fg:tutorials which tutorials you have seen or skipped (tutorial ID, version number, time, “completed” or “skipped”), when you reset tutorials, whether tutorials should be offered automatically. Without signing in, this data does not leave your browser. When you are signed in, we also store the same data in your account so it applies on all your devices; your browser’s state is merged with that of your account. The data is not passed on to third parties and not used for analytics or advertising. Legal basis: for local storage Section 25(2) no. 2 TDDDG, for storage in your account Art. 6(1)(b) GDPR (providing the account feature you use). You can reset the data at any time via “Tutorials” in the footer or in your account (“Reset all”); when you delete your account it is deleted from the account, in the browser via your browser settings.

Whether the floating Help & feedback button is shown is stored in your browser’s local storage under the key fg:helpButton (shown or hidden, time of the change). It is kept until you clear it in your browser, does not leave your browser and is not stored in your account. Legal basis: Section 25(2) no. 2 TDDDG. You can turn the button back on at any time via “Show help button” in the footer.

Managing consent

On your first visit we ask whether you allow video embeds and Wowhead tooltips. “Necessary only” is as easy as “Accept all”; nothing is preselected. Your choice (categories, random ID, time, version) is stored in the cookie cc_cookie for 182 days so we can respect it (Art. 6(1)(c) with Art. 7(1) GDPR; Section 25(2) no. 2 TDDDG). The data stays in your browser.

You can change or withdraw your choice at any time via “Cookie settings” in the footer or here: Open cookie settings. Withdrawal applies to the future.

Embedded videos (YouTube, Twitch, Instagram)

Guides and clip galleries embed videos, including clips submitted by users. Providers are Google Ireland Ltd. (YouTube; we use the privacy-enhanced mode, youtube-nocookie.com), Twitch Interactive, Inc. (USA) and Meta Platforms Ireland Ltd. (Instagram). Your browser loads a video only after you consent to “Video embeds”. The provider then receives your IP address and the page visited, may set cookies and may use data for its own purposes, for which it is responsible itself.

Data may be transferred to the USA. For US companies certified under the EU-US Data Privacy Framework an adequacy decision of the European Commission applies; otherwise the safeguards named in the provider’s privacy policy apply. Legal basis: consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Wowhead tooltips

If you consent to “Wowhead”, your browser loads a script, fonts and icons from Wowhead (servers wow.zamimg.com and wowhead.com) to show info boxes on item and spell links. Wowhead’s operator receives your IP address and the page visited and may set cookies; processing in the USA is possible. Without consent the links stay plain links and no request goes to Wowhead. Legal basis: consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

User account and sign-in

We run the Keycloak login system on our own servers (auth.forever-guides.com). You register with email address, username and password (stored only as a hash) and confirm your email address. Alternatively you sign in with Google or Twitch; we then receive your ID, name and email address from that service. Accounts with editorial or author rights must use two-factor sign-in. We send system emails via the mail server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland.

Once you use an account feature we create a site account: email address, internal ID from the login system, your display name (public with your content and sign-ups), optional profile details (visible only to you and our team) and settings such as leaderboard participation.

An account is intended for people aged 16 or over (see the terms of use). We do not ask for your age when you sign up.

After sign-in your session is kept in an encrypted, necessary cookie (at most 30 days). Signing out deletes it and ends the session in the login system.

Legal basis: Art. 6(1)(b) GDPR (user agreement). Retention: until you delete your account.

Profile picture

On the Account page you can voluntarily adopt the profile picture of your linked Twitch or Google account. Our server then downloads the picture once from Twitch or Google (only from their image servers, only over https), reduces it to 256 x 256 pixels and stores a copy in our media storage. For Google we store the picture address as an attribute in your login account when you sign in. Your browser does not connect to Twitch or Google for this.

For now we show the picture only to you, on your account page. The file lies under a random name in the public media storage (Hetzner, delivered through the BunnyWay CDN); anyone who knows the exact address can retrieve it. With “Reset to default” we delete the picture and the file. A copy already cached in the CDN may remain reachable for a short time.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by adopting the picture and withdraw with “Reset to default”. When you delete your account we delete the picture as well.

Battle.net link

You can optionally link your Battle.net account to import your World of Warcraft characters and show they are yours.

• You confirm the link at Blizzard (oauth.battle.net). We request only the “openid” and “wow.profile” scopes.
• We store BattleTag, region, a non-reversible checksum of your Battle.net ID, link and update times, and per character name, realm, class, level and faction (at most 200).
• We do not store Blizzard access tokens; they are used only briefly while linking.
• Blizzard Entertainment, Inc. (USA) is responsible for your Battle.net account. Our server and Blizzard exchange the authorisation code, our application ID and your Battle.net ID.
• Unlinking in your account immediately deletes the link, all characters imported from Battle.net, their event sign-ups (the waiting list moves up) and Battle.net collection entries. You can also revoke access at Battle.net.

Legal basis: Art. 6(1)(b) GDPR (account feature you trigger).

Character import and collection album

If you paste an export from our game addon, we store character name, realm, class, level, faction and the full export (including seen items) in your account. This data is not verified by Blizzard.

The collection album stores which items you own or have seen, since when and from which source. You start the Battle.net sync yourself; our server then fetches the equipment of your linked characters from Blizzard. Only you see your entries. You appear on the leaderboard with your display name only if you switch it on.

Legal basis: Art. 6(1)(b) GDPR; for the leaderboard your consent (Art. 6(1)(a)), which you can switch off at any time. Retention: until you delete the import, the link or your account.

Calendars, events and sign-ups

• A sign-up stores your account, the chosen character (name, realm, class, level, faction), role, status (confirmed or waiting list), who confirmed it, and optional notes.
• The participant list and notes are visible to everyone allowed to see the event (public, link and password, or invited only, as the organiser chooses), the organiser, assistants and our team.
• Organisers can invite other accounts as assistants and add accounts to an allow list whose sign-ups are confirmed automatically.
• After the correct password a necessary cookie remembers the unlock (calendar 7 days, event 6 hours). Calendar and event passwords are stored only as a hash.

Organisers may use participant data only to organise their events. Legal basis: Art. 6(1)(b) GDPR; assistants and allow list Art. 6(1)(f) GDPR. Retention: until you cancel, the event or calendar is deleted, or you delete your account.

Polls

When you vote we set the necessary cookie fg_poll_voter (random ID, 1 year). The database stores only your choice and a hash of this ID and the poll, with no name, email, IP address or account. Against multiple votes we briefly count your IP address in memory. Legal basis: Art. 6(1)(f) GDPR; cookie Section 25(2) no. 2 TDDDG. As votes are not linked to an account, we cannot hand out or delete them individually.

Talent setups

Published talent setups show the creator’s display name. When you rate a setup we remember it in a necessary cookie and in your browser so you rate only once; views are counted with a cookie per setup (24 hours) without personal reference. Legal basis: Art. 6(1)(b) or (f) GDPR; Section 25(2) no. 2 TDDDG.

Macros

In the macro generator you can save macros. We store title, macro name, macro text, description, classes and categories, icon, visibility and your account. The default is private, so only you and our team see the macro. Only unlocked authors may make a macro public; its text and your display name (as it was when you published) are then publicly visible, and anyone can report the macro. Your browser remembers the view (list or icons) and the game language of the preview locally (fg:macroSpellView, fg:macroClientLocale). Legal basis: Art. 6(1)(b) GDPR. Retention: until you delete the macro or your account.

Submitting and reporting clips

Signed in, you can submit links to clips (YouTube, Twitch, Instagram). We store link, title, description, your account, timestamps, review status and any rejection reason. For YouTube links our server fetches title and thumbnail publicly from YouTube, without your data. Our team reviews every clip before publication. Afterwards link, title and description are public; your display name is shown only if you tick the box when submitting (consent, revocable at any time).

Anyone can report clips, also without an account. We store the reason and time of the report, not who reported. Against abuse we count reports per IP address or account (at most 24 hours, in the database only as a hash value, see “Hosting, server logs and abuse protection”).

Legal basis: Art. 6(1)(b) GDPR (submission), (a) (showing your name), (f) (moderation). Retention: published clips until deleted by you, our team or with your account; rejected clips 30 days after their last change.

Reporting guides, news, guilds, talent setups, macros and location images

Anyone can report guides, news, guild entries, talent setups, public macros and location images, also without an account. We store the reported content, the chosen reason, your optional note (at most 500 characters), time and handling status, not who reported. Please do not include personal data in the note. Against abuse we count reports per IP address (at most 5 per hour, one per content and day). The database only holds a hash value for this, never the IP address; it is deleted after at most 24 hours.

Legal basis: Art. 6(1)(f) GDPR (moderation, notices of illegal content). Retention: open reports until handled; rejected or resolved reports are deleted 180 days after their last change.

Feedback and bug reports

Via “Help & feedback” (floating button) or “Feedback / report a bug” in the footer you can send us bugs, ideas, praise or anything else, also without an account. We store the type, your message (at most 1,500 characters), an optional email address for follow-up questions, time, handling status and an internal note of the team. If the feedback refers to a tutorial, we store its ID and, where applicable, the step. Please do not include passwords or data of other people in the message.

Only if “Send technical info” is ticked (default), we also store: the page address without parameters (except “tutorial”, “event” and “occurrence”; access keys and similar parameters are removed in your browser already), the language, the window size and the browser family (e.g. “Firefox”, not the full browser identifier). When you are signed in, we link the feedback to your account only if you tick “Link to my account”; if you delete your account, this link is removed. We do not store the IP address. Against abuse we count messages per IP address (at most 5 per hour) and in total (at most 200 per day); the database only holds a hash value for this, never the IP address.

Legal basis: Art. 6(1)(f) GDPR (fixing bugs, improving the site), or (a) for the optional email address and the account link. Retention: done or rejected feedback is deleted 180 days after its last change, open feedback 12 months after receipt at the latest. Whether the help button is shown is stored with the tutorials (see “Tutorials”).

Guild directory

Signed in, you can list a guild (e.g. name, tag, faction, server, description, contacts). Our team reviews the entry; if rejected we store a reason. Once approved the entry is public. We notify our team of later changes by email. Legal basis: Art. 6(1)(b) GDPR, review (f). Retention: until you delete the entry or your account.

Becoming an author and the studio

If you apply to write content, we store display name, chosen areas and your text; only our team sees the application. Rejected applications are deleted 90 days and accepted ones 365 days after the decision; unanswered applications are treated as rejected after 180 days. Published content shows your name; uploaded images are public on the CDN. Unsaved drafts stay in your browser only. Legal basis: Art. 6(1)(b) GDPR.

Streamer directory

Via “Get listed as a streamer” (account required) we collect the link to your account, streamer name, platform, channel link, email address and your message to review the request and contact you (Art. 6(1)(b) GDPR). Once listed, your profile is public. Requests are deleted 180 days after receipt; a profile stays until you ask for removal.

For listed streamers we query public data from the Twitch API every 5 minutes (live or not, title, viewer count, preview image) (Art. 6(1)(f) GDPR). Our server loads profile and preview images from Twitch and passes them to your browser; your browser does not connect to Twitch for them. Embedded live players load only with your consent.

Twitch supporter badge

If you subscribe to Wosande’s Twitch channel (also as a gift), Twitch Interactive, Inc. (USA) sends us your Twitch user ID and subscription tier via the Twitch API. We store only ID, tier and the date of the last tier change, no Twitch name and no payment data. If your account here is linked to Twitch, we show a supporter badge next to your display name. This also applies if you have no account with us (yet): ID and tier are then kept so the badge appears if you link an account later; we delete such entries 365 days after the last tier change. Legal basis: Art. 6(1)(f) GDPR (recognising support). You may object and request erasure at any time.

Location guessing game (game and leaderboard)

In the location guessing game (“Ortsraten”) you play rounds of five screenshots each. You can play without an account.

• Without an account we set the necessary cookie __Host-fg_ortsraten (signed random ID, 30 days) so that a round stays together across requests. In the database we store, per round, a one-way hash of this ID (formed with a secret server key), the images shown, your guesses, scores, distances and times. No IP address, no name. We delete these rounds after 30 days, unfinished rounds after 1 day.
• With an account we assign rounds to your account and show you “My statistics”. They stay until you delete your account.
• Local history: your browser stores date and score under fg:ortsraten:history. It never leaves your browser.
• Leaderboard: you only appear if you switch on “Show me on the leaderboard with my display name” (default: off). Display name, total points, best round and number of rounds are then public. You can switch it off at any time.
• Abuse protection: we count requests per IP address or account only as a hash value with an expiry time (at most 24 hours), see “Hosting, server logs and abuse protection”.

Legal basis: Art. 6(1)(b) GDPR (game with an account), (f) (progress without an account, abuse protection), (a) (leaderboard). The cookie is strictly necessary for the game you asked for (Section 25(2) no. 2 TDDDG).

Submitting location screenshots

With an account you can submit WoW Forever screenshots for the location guessing game. We store:

• the image (resized and converted to WebP by us, without EXIF data and without the original file name),
• your account, the time of your consent and the version of the consent text,
• zone, map position, facing direction and capture time,
• addon details (client build, addon version, entry ID, checksum status).

Your browser reads the file ForeverGuides.lua itself; it is not uploaded. Our team reviews every image before release. We show released images in the game without the submitter’s name. The images are stored privately in the object storage of Hetzner Online GmbH under a random file name. We serve them only through our application (to you, to our team and, once released, as a puzzle image), not through the CDN.

Screenshots can show character names, name plates, chat or guild names, that is, data of other people. We expressly ask you not to upload such images or to crop them first, and we sort them out during review. Anyone can report a puzzle image with “Report” (see “Reporting guides, news, guilds, talent setups, macros and location images”).

Legal basis: consent (Art. 6(1)(a) GDPR) and user agreement (b). You can delete your own submissions at any time; when you delete your account we delete all of them. Only you and our team see rejected submissions; there is no automatic deadline for them, we delete them on request or with your account. Rights in the images: see the submission terms.

Contact form and email

If you write to us via the form or by email, we process name, email address and message to reply. We fight spam with an invisible form field and an in-memory IP count. Legal basis: Art. 6(1)(f) GDPR, or (b) for questions about your account. Form messages are deleted 180 days after receipt unless legal obligations or a dispute require longer storage.

After you submit the form we automatically send a confirmation email to the address you gave. It is sent through our mail server at Hetzner, the sender is website@forever-guides.com and replies go to contact@forever-guides.com. It contains only the reference number and a timestamp; we store nothing additional for it. Legal basis: Art. 6(1)(b) or (f) GDPR (confirmation of receipt). The retention period is the same as for the contact message.

Internal notifications

We notify our team of new contact requests, streamer and author applications, clip submissions, guild changes, content reports and feedback by email (via the mail server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland); the email contains the submitted details (for reports only type and reason, for feedback type, message, page and tutorial, no email address). We also receive a notice via Discord (Discord Inc., USA) that contains only the type of submission and a link to our admin area, no content and no contact details. Legal basis: Art. 6(1)(f) GDPR (prompt handling).

Partner links

A few links are partner links labelled “Werbung” (advertisement), currently RestedXP. Nothing is stored and no partner code is loaded on our site. Only after you click does the partner learn from a code in the address that you came from us; its own privacy policy applies. More in the legal notice.

Protection against attacks

Requests to typical attack paths that do not exist on this site (e.g. /wp-admin) are redirected to an alert service (Canarytokens by Thinkst Applied Research) that tells us about the attempt; the service receives the IP address of the requesting device. This does not happen during normal use. Legal basis: Art. 6(1)(f) GDPR.

Recipients and third countries

On our behalf (Art. 28 GDPR) data is processed by:

• Hetzner Online GmbH, Germany: servers, object storage
• BunnyWay d.o.o., Slovenia: delivery of images and icons
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland: sending and receiving email

As independent controllers, data reaches the following when you use the feature or consent: Google and Twitch (sign-in, videos), Meta (Instagram videos), Blizzard (Battle.net), Wowhead’s operator (tooltips), Twitch (live status, supporter badge), Discord (notices without content, see above), Thinkst (attack attempts) and partners such as RestedXP (only after your click).

For editorial news drafts we may use an AI service (Anthropic, USA). Only publicly available source texts are transmitted, no user data.

Some of these recipients are based in or process data in the USA. Transfers rely on the European Commission’s adequacy decision (Art. 45 GDPR) where the recipient is certified under the EU-US Data Privacy Framework, otherwise on the recipient’s appropriate safeguards (Art. 46 GDPR) or, for embeds, on your consent.

Retention and account deletion

Deleting your account

You can delete your account yourself at any time under Account → “Delete account”. This removes:

• profile, display name, profile details and settings (including tutorial progress)
• your copy of the profile picture, including the file
• imported characters, the Battle.net link and your collection album
• your event sign-ups and notes (the waiting list moves up)
• your own calendars with their events, keys and team, and community events you host
• your submitted clips and listed guilds
• your streamer profile and your streamer application
• feedback you linked to your account
• your macros, your location game rounds and your submitted location screenshots, including the files
• open author applications and the link to your supporter badge
• your login account, including any Google or Twitch link

What remains without any link to you: published talent setups, guides and posts (without your name), anonymous poll votes and images you uploaded in the studio that appear in published posts. We delete contact requests after 180 days. While your Twitch subscription runs, the sync may create a supporter badge entry again (ID and tier, with no link to an account); it is deleted after 365 days without a tier change. After deletion we send one confirmation to your email address. If the login account cannot be removed right away for technical reasons, we delete it by hand. Copies in backups disappear when the backups are overwritten.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to contact@forever-guides.com.

Right to object (Art. 21 GDPR): where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We then stop processing unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

You may lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Obligation to provide data, no automated decisions

Use is voluntary. For an account we need at least an email address and a display name; without them we cannot offer an account. We make no automated decisions within the meaning of Art. 22 GDPR.

Changes

We update this policy when features or the law change. The version published here applies.