Realmly privacy policy

Last updated: 20 October 2026

1. Who we are and how to contact us

Realmly is an independent service for World of Warcraft character profiles, adventure records and social posts. This policy covers realmly.me, the Realmly Windows Companion and the Realmly in-game addon, including its Retail testing version. It does not replace Blizzard's, Microsoft's or other providers' policies for their own services.

The person responsible for the personal information described here (the data controller) is Peter 'Rageypeep' Deacon, operating Realmly in the United Kingdom.

For privacy questions, information requests, corrections, objections, deletion requests or complaints, contact [email protected]. You do not need a Realmly account to raise a concern about information relating to you, including a reference to your character in another player's records.

2. The short version

The addon records supported gameplay events locally inside WoW's SavedVariables. It does not itself upload records to Realmly's website.
The website or Companion sends records to Realmly when you upload them. The Companion can also upload automatically if you explicitly enable that option.
Uploading can create or update a public character profile and public map discoveries. Do not assume all uploaded gameplay information remains private until you publish a story.
AI-generated story drafts remain unpublished until you publish them. Requesting generation sends a character/adventure summary to OpenAI, including relevant notes, character personality and recorded party-member names.
Do not include passwords, real-world contact details, sensitive information or information about other people that you should not share in notes or posts.
Signing in does not give Realmly or the Companion your Battle.net password.

3. Information we process and where it comes from

When you choose Battle.net sign-in, Blizzard supplies an account identifier and, where available, your BattleTag. Realmly stores the link to your Realmly account, account creation/sign-in timestamps and necessary account preferences, such as your selected posting character. We use a website session identifier to keep you signed in.

The Companion connects through a browser approval flow. It receives an account-specific upload token, not your Battle.net password or the website's sign-in cookie. Realmly processes pairing identifiers and tokens to authorise uploads. The Companion encrypts its stored upload token with Windows DPAPI for your Windows user account; an authorised local process running as you may still be able to access information available to your account.

Addon and gameplay information

Depending on your game client, supported events and how you use the addon, records can include:

Character name, realm, class, race, level and a generated Realmly Adventurer ID.
Game client/version information, record/export identifiers and timestamps.
In-game zones, map IDs, coordinates, discoveries and sampled travel positions.
Quests, gathering, professions and skill/rank milestones, abilities, recipes, crafting, equipment, collectibles, reputation and exploration.
Dungeon/boss or rare encounters, deaths, PvP moments, gold milestones, guild membership/rank changes and other supported adventure milestones.
Party members' character names, realms and classes associated with recorded moments, and repeat-companion events.
Notes and bookmarks you enter yourself.

In-game positions describe your character's location in the game world, not GPS or your physical location. Current addon trackers do not record general chat or whisper transcripts or collect a guild roster. Text you enter in a note can, however, contain anything you choose to type.

The addon stores records locally, and they may accumulate across characters and sessions. If you select a Realmly.lua file in the Companion, the selected file is transmitted as a snapshot, potentially containing several characters and previously recorded adventures. Realmly processes the supported records from it. The local "new on this PC" count is not a promise that only those records will be transmitted. The server handles duplicates.

We may retrieve character information, artwork, achievements and quest reference information from Blizzard using character/realm or quest identifiers. Some of this information originates from Blizzard rather than from your upload.

We store the character personalities you provide for story generation, generated drafts, published log entries, status updates, comments, likes/reactions and follow relationships. We also process creation/edit/publication dates and links between that content and its authoring character/account.

Technical and support information

When your browser or Companion contacts Realmly, its hosting, network and security systems process information such as IP address, request time, requested address, response status and browser/app connection details. Some of this information may appear in operational or security logs. Local container-log rotation is described in section 10; this does not mean every request is permanently recorded.

The Companion stores local setup names, selected game/file paths, preferences, hashed uploaded-record identifiers and a limited recent upload history. The diagnostic report you can choose to copy contains software/runtime versions, architecture, state flags, counts and categorised errors. It excludes tokens, personal paths, setup/character names, file contents and raw error messages, and is not sent automatically.

If you contact us, we receive the contact details, messages and attachments you choose to send. Check attachments for personal information before sharing them.

4. Why we use this information

We use information to provide the requested Realmly features: authenticate your account, associate uploads with your characters, store adventures, maintain profiles and maps, generate requested stories, publish your chosen content, support social interactions, manage authorised Companion uploads and assist you. We also use necessary technical information to keep the service secure, prevent abuse, diagnose problems and meet legal obligations.

For users covered by UK data protection law, the lawful bases we rely on, where applicable, are:

Purpose	Lawful basis
Account, uploads, profiles, social features and AI generation you request	Performance of the service agreement with you, to the extent the processing is necessary to provide those features.
Security, fraud/abuse prevention, service reliability and proportionate support	Our legitimate interests in running a safe, reliable service, balanced against your rights.
References to other players in contributed gameplay records	Our legitimate interests in providing accurate shared adventure records, balanced against those players' rights and objections.
Optional processing for which consent is legally required	Your consent, requested separately for that purpose.
Compliance with an applicable legal requirement	Legal obligation.

Where processing genuinely relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Turning off an upload preference stops future automatic uploads; it does not automatically erase already-uploaded information. Some information is necessary for account/upload features; choosing not to provide it means those features cannot work.

5. What is public

Character profiles are currently created public by default. Public information can include character identity/details and artwork, profile statistics, recorded progress, published stories, status updates, comments, reactions, follow counts and public discovery/map contributions. A published story may mention companions or other details from your recorded adventures.

Battle.net account identifiers, upload tokens and account sign-in sessions are not intended as public profile information. The service nevertheless links character content to its owner internally. Posting as a character is not a guarantee of anonymity, especially if you include identifying text yourself.

Draft story text is not publicly displayed until published. Uploading gameplay records is a separate action and may already reveal the public information described above. Public material can be viewed without an account and may be copied, indexed or retained by others. Removing it from Realmly cannot guarantee removal of copies held independently by others.

6. AI-generated chronicles

When you request a new story or retry generation, Realmly sends a selected summary to OpenAI's API. It can include your character's name/class/realm, personality, adventure dates, zones, equipment, relevant recorded events/notes, companion names, quest context and an excerpt of a previous published entry for continuity. It is not necessary to include real-world personal or sensitive information in these fields; please do not do so.

This is an API integration, not a connection to your personal ChatGPT account. OpenAI states that API data is not used to train or improve its models by default unless the API customer opts in. As of 20 October 2026, Realmly's operator has excluded the Realmly project from optional data-sharing selections. This describes new requests under the current settings; it is not a promise that information previously submitted while sharing was enabled has been deleted.

Do not assume AI submissions are immediately deleted. With the current standard Responses API settings, response application state has a default 30-day retention period and may be kept for at least 30 days; abuse-monitoring logs normally have up to 30 days' retention, with possible legal/security exceptions. Account-specific controls can affect this. See OpenAI's current API data controls. We do not promise Zero Data Retention or immediate deletion at OpenAI.

Generated text may be inaccurate. You should review it before publishing and can remove information you do not want to make public. Realmly does not use story generation to make solely automated decisions producing legal or similarly significant effects about you. Follow choices influence feed ordering; this is not an assessment of your eligibility for essential services.

7. Who receives information

Information is available to the operator and service providers only as relevant to their functions. Recipients include:

Other visitors, for the public material described in section 5.
Blizzard/Battle.net, for sign-in and relevant character/quest lookups.
OpenAI, for AI story requests described in section 6.
The infrastructure supporting the UK-hosted website and database.
Google, which handles email sent to our privacy address after forwarding. The operator has confirmed Google as the receiving email provider; the private forwarding destination is not published.
Cloudflare, which provides network delivery and security in front of realmly.me. Depending on the services in use, it processes traffic and connection information such as IP addresses, request addresses/times, routing, browser/device connection details and security events. Requests passing through a proxy can also contain the content needed to provide the requested service. See Cloudflare's privacy policy.
Microsoft, if you obtain the Companion through Microsoft Store. Microsoft handles its own Store distribution/account/diagnostic information under its own arrangements; that does not mean Realmly receives your Microsoft password or payment details.
Advisers, authorities or other recipients where necessary for a legal obligation, the protection of rights, or a lawful investigation.

Realmly does not currently use optional website analytics. This is separate from necessary service/security processing and providers' own operational records.

External services have their own policies and may act as separate controllers for their own purposes. Relevant links include Blizzard privacy information, Microsoft's privacy statement and OpenAI's API data controls linked above.

8. Where information is processed

Realmly's website and database are hosted in the United Kingdom. This does not mean every copy of information stays in the UK: Cloudflare operates a global network, and OpenAI, Blizzard and other external services may process information outside the UK, including in the United States. Public information can also be accessed from other countries.

Realmly makes encrypted daily database backups to a private Cloudflare R2 bucket in the European Union. This backup storage is separate from the UK production server. A backup is marked successful only after it is downloaded and restored into an isolated temporary database.

International transfers are subject to the protections required by applicable data-protection law. Depending on the recipient and destination, those protections can include applicable UK adequacy regulations or contractual safeguards such as standard contractual clauses with a UK Addendum or the UK IDTA. Contact [email protected] for information about the arrangements relevant to your data. This notice does not promise UK-only processing or a particular provider's residency option.

9. Cookies and local storage

The website uses the realmly_session cookie to keep you signed in. It is set after sign-in, is HTTP-only, is sent securely on the HTTPS site and has a lifetime of up to 14 days, unless cleared/invalidated earlier. Signing out invalidates that session and clears the browser cookie.

Short-lived server-side sign-in and Companion pairing records normally expire after 10 minutes. Companion upload authorisations normally expire after 90 days. These token lifetimes are not the retention period for your account, uploaded adventures, logs or backups.

The map editor uses browser local storage for local boundary and discovery drafts (wow-forever-boundaries and wow-forever-location-drafts). Local storage has no automatic expiry in the reviewed code. You can clear it through your browser's site-data controls; doing so may remove unsent drafts. Stored drafts are not automatically transmitted merely by being saved in local storage.

These mechanisms support requested features and security. Cloudflare may use security/challenge cookies when its relevant protections are active; the exact cookies depend on the features used and whether a challenge is required. Optional website analytics have not been enabled. Where prior consent is required for an optional technology, it must not run until the necessary choice has been obtained. This policy does not itself grant consent.

10. How long information is kept

Different copies have different lifetimes:

Information	Retention
Realmly accounts, linked character records, uploads and social content	Retained to provide the account/chronicle service until removed or a deletion request is actioned, subject to a specific lawful need to retain limited records. There is currently no automatic inactive-account expiry in the reviewed application code.
Story drafts	Retained with the associated character/day until replaced, deleted or otherwise removed with the relevant records.
Website sign-in/pairing and Companion authorisation	The expiry periods in section 9.
Support correspondence and privacy requests	Kept while dealing with your enquiry/request and for as long as reasonably needed to record its resolution, demonstrate compliance or handle a specific complaint or legal claim. Only information necessary for that purpose should be retained.
Operational/security logs	Realmly's application, database and session-service container logs rotate with three 10 MB files configured per container. Backup-job logs rotate at 1 MB with two older files. This is size-based rotation, not a fixed number of days. Cloudflare and other infrastructure providers may keep separate operational/security records under their applicable service terms and policies; the local file limits do not set their retention. Records relevant to a specific incident may be retained while reasonably needed to investigate or meet a legal obligation.
Backups	Encrypted daily database backups in a private EU Cloudflare R2 bucket are subject to a 30-day object-expiry rule. Expiry processing is asynchronous, not deletion at an exact 30-day deadline. Restored test databases are temporary and removed after verification. Deleted data can remain in older backups until they expire; before a disaster-recovery database is brought online, deletion requests and access/privacy changes made since the snapshot must be reapplied.
OpenAI requests/responses	Provider retention described in section 6, subject to the actual API configuration and applicable provider terms.
Addon records on your computer	Until you clear/delete the relevant local data. Disabling or uninstalling an addon does not necessarily delete its SavedVariables files.
Companion settings and history on your computer	Until you remove/reset the relevant local data. Recent history is limited to 20 attempts; hashed uploaded-record identifiers can remain longer for duplicate detection. Uninstall behaviour differs between portable and Store installations; do not assume every local copy is removed automatically.

We cannot erase information from your own backups or from independently held copies on other people's systems. Locally retained addon records can be uploaded again, recreating server-side information, unless you also stop uploads and remove the records you no longer want to send.

11. Your choices and rights

You can choose whether to upload, whether to enable automatic uploads, whether to request AI generation and whether to publish a generated draft. You can stop future addon recording by disabling the addon. You can turn off the Companion's automatic-upload option or exit it to stop that watcher.

The website provides character deletion in character settings. It removes the selected character's Realmly profile and associated records handled by that deletion action; it does not delete your WoW character, Battle.net account or local SavedVariables. Account-wide privacy/deletion requests should be sent to the contact in section 1. There is not currently a self-service account-deletion or data-export tool; contact us to make those requests.

Depending on the processing and applicable law, you may have rights to be informed, access your information, correct it, request erasure, restrict processing, object (including to processing based on legitimate interests), receive or transfer certain information in a portable form, and withdraw consent where consent is the basis. These rights have legal conditions and exceptions; we will explain any refusal or limitation.

You may contact us even if you are not a registered user, for example if your character is mentioned in a contributed story. Please provide enough context to locate the information. Do not send your password or token. We may need reasonable information to verify a request without collecting excessive identification. We respond within the applicable legal timescales, normally one calendar month, with any lawful extension or clarification explained to you.

You can raise a complaint with us using the privacy contact above. You also have the right to complain to the UK's Information Commissioner's Office: ico.org.uk/make-a-complaint. Contacting us first may help resolve the issue but is not a condition of that right.

12. Adults-only service

Realmly is intended for adults aged 18 and over. You must be at least 18 to create/use a Realmly account or submit information to Realmly. This is Realmly's own rule, separate from WoW's content rating and Blizzard's account terms.

If you are under 18, do not register, connect the Companion or upload records to Realmly. If you believe a minor has submitted their own information or information about a minor appears on Realmly, contact [email protected] so we can review the concern and take appropriate action, including restriction or removal where required.

Battle.net sign-in does not provide Realmly with a verified age. The 18+ rule is a service requirement, not a claim that every visitor has been age-verified.

13. Security

We use measures appropriate to the service, including HTTPS for public Realmly connections, account/session checks and access controls. The Companion uses Windows DPAPI for its stored upload token and checks portable update package hashes and versions; those checks are not the same as publisher code signing. The Store edition relies on Microsoft Store's package distribution/update system.

No service can promise absolute security. Keep your operating system and app current, protect your Battle.net/Windows accounts and do not share upload tokens. If you suspect misuse or exposure, contact us promptly. Logging out of the website or uninstalling the addon is not a promise that an already-issued Companion token has been revoked; contact us about compromised authorisations.

14. Changes to this policy

We will update this policy when relevant processing changes and revise the updated date. Material changes will be communicated appropriately; any new processing that requires consent will need that consent rather than relying on continued use of the service. The current policy will be available at realmly.me/privacy.