Privacy Policy

1. Who we are

WA2GO is a community platform for sharing WeakAuras for World of Warcraft. This policy explains what personal data we process, why, and the rights you have over it.

The identity of the data controller and how to contact us are set out in our Legal Notice.

2. Data we collect

Account data: your username, email address, and a securely hashed password (we never store your password in clear text). For accounts created via Google or Discord, we store the provider, the provider email and username, and a provider identifier — never any provider password or access token.

Content you create: the WeakAuras you publish (including their versions and images), comments, and likes.

Preferences: your chosen interface language and theme.

The date you last signed in. We keep this single date to manage how long accounts are retained; we do not keep a history of your visits.

We do not use any analytics, advertising, or third-party tracking.

3. Purposes and legal bases

Providing the service (creating and managing your account, publishing and displaying your content): performance of our Terms of Service (contract).

Recording your acceptance of the Terms and this Policy at registration: your consent, which is stored as proof (policy version and timestamp).

Keeping the platform secure and preventing abuse: our legitimate interest.

4. Cookies and local storage

We only use cookies and local storage that are strictly necessary or functional. None of them are used for analytics, advertising, or tracking, so no consent banner is required — but we disclose them all here for transparency.

wa2go_token and wa2go_refresh_token (cookies): keep you signed in. Strictly necessary.

oauth_pending_token (cookie): temporarily carries your sign-in through the Google/Discord flow. Strictly necessary.

wa2go-theme (local storage): remembers your light/dark theme choice. Functional.

wa2go-locale (cookie): remembers your language choice so pages render in the right language. Functional.

5. Service providers (sub-processors)

We rely on a small number of providers to operate the service. They process personal data only on our behalf or as strictly needed to perform an action you request:

OVH (OVH SAS) — hosting and file storage, in France. Your account data and uploaded images are stored here.

Resend (Resend, Inc., United States) — delivery of account emails (verification, password reset). Receives your email address and username. Transfers are covered by the EU–US Data Privacy Framework and appropriate contractual safeguards.

Google (Google LLC, United States) and Discord (Discord Inc., United States) — only if you choose to sign in with them. The sign-in exchange shares your identifier, email, and username with us; these providers are covered by the EU–US Data Privacy Framework.

When self-hosted SMTP is used instead of Resend, email is delivered by the mail server chosen by the operator. Our host's details are given in the Legal Notice.

6. Data retention

We keep your account data for as long as your account exists. When you delete your account, your personal data (likes, linked OAuth accounts, avatar) is erased, and content intended to remain public (WeakAuras, comments) is anonymised rather than deleted.

Your recorded consent (policy version and timestamp) is kept as long as needed to demonstrate compliance.

Some data is removed automatically, without you having to ask. If you sign up but never confirm your email address, your account is deleted 30 days after registration, unless it holds a WeakAura, a comment or a like — published content is never removed this way. Confirming your address at any point during those 30 days keeps the account permanently. An account that has been banned is fully erased one year after the ban; until then we keep it to prevent the abuse from recurring.

Our web server keeps access logs for 30 days. Your IP address is shortened before it is written, so these logs cannot be traced back to you individually. The only exception is our security log, which records the full address of automated systems probing the site for vulnerabilities: we keep that for 30 days so those addresses can be blocked.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, and export your data, to restrict or object to processing, and to withdraw consent.

You can exercise the main rights directly from your account settings: use "Download my data" to obtain a machine-readable copy (access and portability), and "Delete my account" to erase your data.

For any other request, or to lodge a complaint, contact us using the details in the Legal Notice. You also have the right to lodge a complaint with your local data protection authority (in France, the CNIL).