Privacy — GuildOS

What we ask Discord for

Three permissions, and none of them grants access to messages. The bot reads and writes only in the channels the guild invited it to announce raids in.

identify

Your Discord name and avatar. It is how the site knows who you are without a new password.

guilds

Which servers you are in — so it can show your guilds, and not everybody else's.

guilds.members.read

Which roles you hold on those servers. It is what makes the site honour the same permissions the bot does.

we never ask foryour email · access to messages · your DMs · your other servers beyond the list

What we keep about you

Your Discord identityid, name and avatar. no email — we do not even ask.

The characters you declaredname, realm, class and spec. you delete them yourself, on the characters screen.

Your signupsyes, no, maybe or late · the role · and the reason, if you wrote one — in your own words.

Reminder preferenceswhether you want a nudge, where it goes, and which nights usually suit you.

What you wrote to supportthe message that leaves the ? in the corner of the screen, so we can answer it.

What the addon publishes

This is character data from a game, sent by an officer of the guild those characters belong to. It is the same thing anyone sees by inspecting you in the game — the difference is that here it is added up and dated.

about each character

name, class, race, level and guild rank
item level and gear slot by slot
which slots are missing an enchant or a gem
spec and talent points
professions and the level of each
attunements for each raid

about each night

who was there and in how many five-minute snapshots they appeared
when they arrived and when they left
whether the connection dropped
whether they had food and a flask
which bosses died, in how many attempts

about the loot

which item
who got it
when and on which raid
the method the guild used

The guild's two switches

Two decisions belong to the guild, not to us. And the default on each one is the most conservative answer available.

Combat logdefault · off

onThe companion parses the night's log and keeps damage, healing and deaths per pull.

offThe parser does not run. It is not runs and hides, nor collect now and show it if you pay later.

no guild starts with this on. whoever turns it on knows they turned it on.

Public showcasedefault · on

onThe public guild and character pages stay up, and a recruit opens them from the link.

offThe pages come down and the cast goes with them. The roster still exists inside, for the officers.

for whoever wants the tool without the shopfront. the internal roster never depends on this switch.

Who sees what

Three layers, and each one sees everything the previous one sees plus its own slice. The gate into the second is sharing a Discord server with the guild: a guild key in a URL answers 404 to anyone who does not pass it.

layer 1anyone on the internetno login

the guild's pagethe text the guild wroteroster with iLvl and attunementprogression

layer 2whoever shares the guild's Discordlogin + a server in common

raids and signupsnight historyattendance per personloot handed out

+ everything layer 1 sees

layer 3guild officerofficer role on Discord

create and lock raidsapprove signupsnotes about peopleboth switchesthe addon token

+ everything layer 2 sees

GuildOS staff come in only to investigate a problem, with a striped banner on the screen saying so, and in read-only mode.

Where the data goes

Discordpersonal dataidentity and the raid announcement in the channel the guild chose. it is the only destination that receives personal data — and it is where that data already was.

Wowhead / zamimgitem icons and 3D model data. they receive item numbers, never people's names, and go through a proxy of ours.

softres.itonly when the guild uses soft reserve, and only what the guild itself put there.

Nobody elsethere is no fourth destination.

No analytics, no trackers, no pixel, no ads. Nothing is sold.

the only cookie is your session. it can be checked: the code is open and there is no third-party call beyond the three above.code on GitHub

Security, unadorned

Sessiona signed JWT inside a cookie. there is no session table to leak.

Addon tokenkept as a sha256 hash. the text appears exactly once, at creation — not even we see it afterwards.

Secretslive only on the machine, in a mode-600 file. never in the repository, which is public.

Isolation between guildsone guild never reaches another's data. a guild key in a URL answers 404 to anyone who does not share the server.

How to delete

A declared characteryourself, right now, on the characters screen. no need to ask anyone.

A raid nightan officer deletes it, and the deletion sticks: it survives the next upload from another officer — otherwise the night would come back forever.

The account and the resttoday it is on request, through the ? or on Discord. we delete it and confirm.

Deleting the account and the rest is on request, through the ? or on Discord. There is no button today.

we would rather say that than fake a button. when it exists, this line changes.

Where this runs, and who we are

We are a small project, hosted on a single machine, in Brazil. If you are in Europe, your data crosses the Atlantic — we say so rather than hide it. We have no legal team and no data protection officer; we have one person who answers on the ? and on Discord.

if this policy changes, the date at the top changes and the notice goes out on your guild's Discord. a change that widens what we read needs notice beforehand, not afterwards.

read the Terms of Service back to the start

What we read, and what we never read.