Turtle WoW · 1.18.1
Privacy policy
What Turtle WoW — Browser Realm stores, why it is used and how long it remains.
Accounts and security
We store account names, display names, email addresses, verification state, password hashes, hashed email-link and session tokens, session metadata, login attempts and administrative audit records. Hidden game credentials are encrypted at rest. Game servers store characters, progress and GM tickets. Security records can contain IP addresses; the telemetry rule below does not apply to all security logs.
Performance telemetry
Performance and render diagnostics include random session identifiers, frame and hitch timings, coarse browser/OS/GPU information, map/zone identifiers and capped asset error names. IP and account identities use salted HMAC-SHA256 hashes. Telemetry does not store raw IP addresses or account IDs. A salted hash is pseudonymous, not anonymous. Collection can be disabled with ?telem=0; server switches can also disable it.
Retention
Performance telemetry keeps the current UTC day and 29 preceding UTC days (30 UTC days), with hourly maintenance and daily rollover. Verification links expire after 30 minutes; reset links after 1 hour. Expired token records are deleted by daily housekeeping once over 30 minutes past expiry. Session cookies and sessions last up to 30 days from issue or rotation; sessions rotate after 30 minutes, with a 60-second grace for the previous token. Daily housekeeping removes expired sessions. Login attempts are deleted after 90 days and IPs are removed from audit entries after 90 days; audit rows remain. Pending accounts remain until manually removed. No automatic deletion period is established here for other account/game data, GM tickets, audit rows or backups.
Support and your choices
Support uses the information you provide to investigate your request. Never send passwords or email links. The planned /bug reporting feature is awaiting integration; its final data fields and retention must be published when it becomes available. Registration uses an anti-abuse challenge and email delivery; when enabled, these providers process the information needed for those tasks. Contact the data controller below to ask about access, correction, deletion or other rights that apply to you. No response deadline or processing jurisdiction has been invented.
Operator details
- Legal name
- {{OPERATOR_LEGAL_NAME}}
- Address
- {{OPERATOR_ADDRESS}}
- Contact email
- {{OPERATOR_CONTACT_EMAIL}}
- Jurisdiction
- {{OPERATOR_JURISDICTION}}
- Data controller
- {{OPERATOR_DATA_CONTROLLER}}