Privacy & data ·

Last updated: 2026-05-04. Personal, non-commercial, community project.

TL;DR

The addon only collects the in-game scoreboard after Epic BG matches.
The server stores character name + realm, class, faction, damage / healing / kills / objective points per match.
Each Discord OAuth login records IP + country + ASN for scanner / fraud detection (see "OAuth audit log").
No e-mails, no chat, no private messages, no payment data.
Third-party data in uploaded scoreboards is public (same nature as armory or wowprogress) — not removable on individual request.
You can request removal of your own audit trail via delete-me — the request enters an admin review queue, no automation.

Who collects what

PremadeIQ addon (client)

After each Epic BG, the addon writes a scoreboard snapshot to the local file SavedVariables/PremadeIQ.lua:

Player GUID (Blizzard's technical id, not tied to e-mail)
Character name and realm (visible to anyone on the scoreboard)
Class and faction (visible to anyone on the scoreboard)
Stats: damage, healing, kills, objective points
BG map id, spec id, match duration, winner
Match start / end timestamps (Unix)

This data does not leave your machine without the Uploader installed.

PremadeIQ Uploader (app)

Reads SavedVariables/PremadeIQ.lua and sends only the delta since the last sync to our server. After login it caches a Discord token in %APPDATA%\PremadeIQ\auth.json for API auth.

Server

Accepts the delta, stores it in Postgres. An audit log records which Discord account sent what and when (only yours — not the other players on the scoreboard).

What we DON'T collect

E-mail addresses (yours or anyone's)
Chat / voice channels
Payment data (Patreon holds those; we only see role assignment)
Mouse movement, clicks, contents of windows outside WoW
Other addons, saves, backups

OAuth audit log (IP + geo)

Every Discord OAuth event (start, callback, success, fail) is recorded to the auth_events table:

Full IP address (not masked)
Country, city, ASN, ISP — via local DB-IP Lite lookup (IP geolocation by DB-IP, CC BY 4.0)
Browser User-Agent
Discord ID — only on successful callback

Why: catching automated scanners (Palo Alto Cortex Xpanse and similar), investigating suspicious logins, GOD-only admin dashboard. Not shared with anyone, no third-party analytics. Currently retained indefinitely — we'll update this section if a TTL gets introduced.

Third-party data

The addon records the entire scoreboard — which means the names of all 80 players in a match, not just yours. This data is publicly visible to every participant in the match in WoW and via Blizzard's official Battle.net API. We treat it as public information, same nature as armory profiles, Blizzard's leaderboards, and aggregations on wowprogress.com / raider.io / check-pvp.fr.

Third-party data is NOT removable on individual request. This is a deliberate stance: if we removed on demand from anyone who asked, the product would stop working (any context-collector could wipe out a competitor's data). There is no "delete someone else's player" form.

What we do instead:

Never show this data outside our dashboard
Never resell or share it with any third party
Never link it to real names, e-mails, or social media
Don't use it for harassment or mass deanonymization

If you have a specific concern about our storage of your public scoreboard data, DM @rezal on Discord with context. We handle one-off reasoned cases individually.

Blizzard Battle.net API enrichment

To display each character's item level, spec, honor level and guild we periodically query the public armory profile via the official Blizzard Battle.net API (by character name + realm). This data is already public — anyone can see it at worldofwarcraft.com/character/....

Caching on our side:

Live TTL: 15 minutes (a fresh armory call is treated as authoritative for that long).
Stale fallback: up to 7 days (if Blizzard's API is unreachable or returns 5xx, we serve a cached copy up to a week old instead of an error).

Where data is stored

The only server that holds the data is a DigitalOcean VM (Frankfurt, Germany, EU). No cloud mirrors, no third-party backup services, no Google Analytics, no Facebook pixel, no similar.

Who has access

Owner (coldo / Rezal) — full DB access as server administrator.
Patron (King of EBG tier) — community aggregates and per-player profiles via JWT on the dashboard.
Contributor (addon + Uploader installed) — community aggregates, no drill-down.
No bots, ad networks, or marketing partners — those entities do not exist in our stack.

Data deletion (GDPR)

You have the right to request deletion of your data at any time. Two options:

Option 1: via Uploader (admin-reviewed)

PremadeIQUploader.exe delete-me

The command sends DELETE /api/me, which now works as a queue rather than auto-delete:

The server creates a row in deletion_requests with status='pending', tied to your Discord ID.
No data is touched yet. Your local token is NOT cleared automatically — your data is still on the server, and your session keeps working.
An admin (GOD role) sees the request in the queue at /admin and manually clicks Approve or Reject. Without admin action, deletion never happens.
On Approve: your users row + all your uploads audit rows are deleted. Scoreboard samples (samples) keyed by your character GUID are NOT deleted (they belong to the character, not to the Discord account, and may have been uploaded by other players too).
On Reject: status flips to rejected with the admin's note explaining why.

Idempotent: running delete-me again shows the current status of your existing request ("Pending since DATE" / "Approved on DATE" / "Rejected: REASON") rather than creating a duplicate.

Data about other players in your matches stays — it's public scoreboard data. See "Third-party data" above.

Option 2: Discord request (for non-Uploader users)

If you don't use the Uploader but have a specific reasoned case, DM @rezal on the EPIC Discord server ("Delete data for GUID Player-XXXX-YYYYYYYY", with context). Manually reviewed by an admin.

Retention

Scoreboard samples: indefinite, until deletion is requested.
Upload audit log: 12 months (for abuse investigation), then auto-purged.
Discord OAuth token (our JWT): 7 days, then re-login.

Cookies & tracking

The site does not use cookies (beyond a language preference). JWT is stored in browser localStorage purely for auto-authentication on return visits — auth only, no tracking.

No Google Analytics, Yandex.Metrika, Facebook pixel, Hotjar, or similar.

Policy changes

If we change this policy, a notice goes to Discord (#⚔-king-of-ebg) 14 days before the change takes effect. Existing users disagreeing can run delete-me and close the matter.

Contact

Discord: @rezal (owner), EPIC server
E-mail: coldo [at] premadeiq.{TBD} — we'll add this once we buy a domain

Non-commercial project, supported by Patreon donations which pay for the server (~$6/mo) and future development. No ads, no data sales.