Privacy & data ·

Last updated: 2026-10-14. Personal, non-commercial, community project.

TL;DR

The addon records the scoreboard and the rosters of an Epic BG — at the start, during and at the end of the match. Regular battlegrounds (10 and 15 a side) are recorded too, but stored apart and left out of every statistic on the site.
The server stores per-match character stats, team rosters, leavers and group leaders, plus public armory profiles from the Blizzard API.
You sign in to the site with Discord. We store your Discord ID, username, avatar, roles on the EPIC server and the list of accounts connected to your Discord.
Every sign-in and session renewal records IP, country, city, ISP and browser — for security (see "Logs").
No e-mails, no in-game chat, no private messages, no payment data.
Other players' data from scoreboards is what every participant in the match sees. It is not removed player by player on someone else's request. Some of the stats are publicly visible — see "What is publicly visible".
You can delete your own account and upload log with the delete-me command; an admin reviews the request manually.

Who collects what

PremadeIQ addon (client)

During each Epic BG, the addon writes to the local file SavedVariables/PremadeIQ.lua:

Player GUID (Blizzard's technical id, not tied to e-mail)
Character name and realm, class, race, faction, spec and role (all of it visible to anyone on the scoreboard)
Stats: damage, healing, kills, deaths, honorable kills, honor gained, honor level at the start and at the end of the match, objective points, rating
Both teams' rosters at the start of the match and how they changed: who left and at which second, who came in as a replacement
Who leads the groups and the raid — what the game shows in the raid and above characters
Map id, duration, winner, match start and end time
Your own character — to know who recorded the match

This data does not leave your machine without the Uploader installed. Your personal watchlist (players and guilds) is kept only on your side and is not sent to the server.

PremadeIQ Uploader (app)

Reads only SavedVariables/PremadeIQ.lua and sends new matches since the last sync to our server. During a match it sends the current team rosters to calculate the odds of winning — the server does not store these rosters. It downloads the premade catalog, win rates and the guild list for the addon. Every 6 hours it checks for updates, telling the server its version, operating system and architecture.

After login, the Uploader keeps our login tokens (not the Discord token) and your username:

Windows — %APPDATA%\PremadeIQ\auth.json, encrypted with Windows' own tools (DPAPI)
macOS — ~/Library/Application Support/PremadeIQ/auth.json, accessible only to your user account
Linux — ~/.config/premadeiq/auth.json, accessible only to your user account

Server

Accepts matches and stores them in a Postgres database. For each match it records which Discord account sent it and from which character.

Signing in with Discord

The site and the Uploader sign in through Discord. We request from Discord:

identify — Discord ID, username and avatar;
guilds.members.read — your roles on the EPIC server (that's how we recognise an admin);
connections — the list of accounts connected to your Discord (Battle.net, Steam, Twitch, etc.). The owner sees it in the admin panel to match a user with their BattleTag.

We don't store the Discord token. Your account holds the Discord ID, username, avatar, role, the list of connected accounts, the dates of first and last sign-in and the faction you chose. The Discord ID shows when the account was created — this is needed for the trial week (see "Who has access").

What we DON'T collect

E-mail addresses (yours or anyone's) — we don't ask Discord for e-mail access
In-game chat and voice channels
Payment data (Patreon holds those; we have no technical connection to Patreon)
Mouse movement, clicks, contents of windows outside WoW
Other addons and their saved data

Logs (IP and geo)

For security, the server keeps logs:

Sign-ins (auth_events) — every sign-in with Discord, every session renewal, every sign-in from another device: IP address (full, not masked), country, city, ASN and ISP (via a local DB-IP Lite lookup on the server; IP geolocation by DB-IP, CC BY 4.0), browser, Discord ID. When you sign in from another device, the confirmation page shows the country and city the sign-in was started from.
Downloads of the addon and the Uploader — IP, city, ISP, browser and the page you came from.
Web server logs — IP, page address, referring page and browser for every request. The owner uses them to look at a summary of visits: countries, cities, ISPs.

Why: catching automated scanners, investigating suspicious sign-ins, understanding where players come from. The logs are not shared with anyone, no third-party analytics. Retention periods are under "Retention".

Other players' data

The addon records the entire scoreboard — which means all 80 players in a match end up in it, not just you. This data is seen by every participant in the match in WoW. We treat it as public information, same nature as armory profiles, Blizzard's leaderboards, and aggregations on wowprogress.com / raider.io / check-pvp.fr.

What we do with it:

We find premades — groups that play together again and again — along with their leaders and who leaves matches.
We link characters of the same Battle.net account ("alts") by the dates of public achievements.
Users can tag premade leaders (we record who tagged them) and keep private notes on players — a note is visible only to its author.

We don't link other players from the scoreboards to real names, e-mails, or social media and don't use the data for harassment. For those who have signed in to the site, there is a link: their Discord account, the accounts connected to it and the character a match was sent from (see "Signing in with Discord").

Third-party data in someone else's upload is NOT removable on individual request. This is a deliberate stance: if we removed on demand from anyone who asked, the product would stop working (any premade organizer could wipe out themselves or a competitor). There is no "delete someone else's player" form. We don't sell the data or share it with any third-party services.

If you have a specific concern about our storage of your scoreboard data, DM @rezal on Discord with context. We handle one-off reasoned cases individually.

Battle comments

What is stored: the comment text, the time, your account (Discord account) and the character the comment is signed with. Your Discord name and id are never shown on the site.
Who sees it: everyone with full access to the site. The signature is your character in that battle if the server itself has verified that it is your character and that you uploaded the battle; otherwise "PremadeIQ player". The form shows how you will sign before you post: keep in mind that the signature links your PremadeIQ account to that character for everyone who reads the comments.
Moderation: comments can be reported; after several reports a comment is hidden until the administrator decides. The administrator can delete a comment and bar its author from commenting. Authors are not told who reported them. Links are not allowed in comments.
Deletion: an approved data-deletion request removes all your comments and reports. A commenting ban, if there was one, is kept after deletion — otherwise signing in again would undo it.
Retention: deleted comments are kept for up to 90 days (so the administrator can review reports) and then erased. No IP address is stored with a comment.

What is publicly visible

Without signing in: the /rankings leaderboard (name, faction, averages); the player card (name, class, faction, number of matches); on the home page — the name of the leader of the most recently spotted premade.
In Twitch chat: the Nightbot bot shows a premade's roster by name on command; the stream overlay shows the top players by damage and healing.
To addon users who send in matches: the premade catalog with the names of leaders and members, win rates of known characters and their guilds — downloaded to the computer for in-game hints.

Blizzard Battle.net API enrichment

Every day we query the public armory profile of every character in the database via the official Blizzard Battle.net API (by name and realm): level, race, spec, item level, honor level and honorable kills, guild, achievement points and the list of achievements with dates, the time of the last login to the game. We keep the history of item level and honor. This data is already public — anyone can see it at worldofwarcraft.com/character/....

A fresh query is treated as current for 15 minutes.
The last copy of a profile we received is kept indefinitely and shown if the Blizzard API is unreachable.

AI helper

In the Help panel a signed-in user can ask a question about the site. The text of the question (and a few earlier messages of the same conversation), along with the page it was asked on and its language, is sent through our own proxy server to the OpenRouter service (USA). OpenRouter passes it to the open DeepSeek model at one of the providers that, under OpenRouter's terms, neither store requests nor train models on them — we forbid routing to any other provider. Nothing else is sent: not your Discord account, not any battle or player data — the helper has no access to our database. We do not store the questions or answers; only their count and cost are logged. OpenRouter's terms — openrouter.ai/privacy. Keep personal data out of your questions; if you would rather not, simply don't use the helper — everything else works without it.

Where data is stored

The data lives on a single rented virtual server. Every night an encrypted backup of the database is made on that same server; the last 30 are kept. In addition, the owner keeps separate copies of the database in his personal cloud storage (Google Drive, OneDrive). No Google Analytics, no Facebook pixel, nothing similar.

Who has access

Owner (coldo / Rezal) — full DB access as server administrator.
Full access — 5 matches contributed in the last 7 days. New users with a Discord account older than 30 days get a trial week of full access after their first sign-in. Unlocks aggregates and player profiles on the dashboard.
Contributor — at least one match contributed in the last 7 days: community aggregates, and in the addon, the premade catalog (see "What is publicly visible").
Signed in with Discord — your own profile, the rankings, the AI helper.
Not signed in — public pages (see "What is publicly visible").
Ad networks and marketing partners have no access — we don't have any.

Data deletion (GDPR)

You have the right to request deletion of your data at any time. Two options:

Option 1: via Uploader (admin-reviewed)

PremadeIQUploader.exe delete-me

The command sends DELETE /api/me, which works as a queue rather than auto-delete:

The server creates a request in deletion_requests with status pending, tied to your Discord ID; the request records the IP, country and browser it was sent from.
No data is touched yet. Your local token is NOT cleared automatically — your data is still in place, and your session keeps working.
An admin sees the request on the /admin page and manually approves or rejects it. Without admin action, deletion never happens.
On approval, your account (Discord ID, username, roles, connected accounts) and your upload log are deleted, and the link to your character is erased. The matches from scoreboards themselves stay — they belong to the characters, not to the Discord account, and may have been uploaded by other players too.
Records of which battles you uploaded and whose leaves your client saw stay anonymised — no longer linked to your account: deleting them would rewrite other players' statistics.
On rejection, the status flips to rejected with the admin's note.

Running delete-me again shows the status of your existing request rather than creating a duplicate. A resolved request is shown for 30 days; after that you can file a new one.

What remains after deletion: sign-in and download log entries (IP), the request itself, the matches from scoreboards. Nightly backups containing your data are gone within 30 days; the owner's personal copies — when he deletes them.

Data about other players in your matches stays — see "Other players' data" above.

Option 2: Discord request (for non-Uploader users)

If you don't use the Uploader but have a specific reasoned case, DM @rezal on the EPIC Discord server ("Delete data for GUID Player-XXXX-YYYYYYYY", with context). Manually reviewed by an admin.

Retention

Matches: stats, rosters, leavers — indefinitely.
Account — until you delete it (see above).
Upload log — indefinitely.
Sign-in and download logs — indefinitely.
Web server logs — 14 days; the application log — until it fills its allotted space (currently about two weeks).
Armory profiles and their history — indefinitely.
Signing in on the site and in the Uploader: access token — 7 days, refresh token — 90 days, renewed on every refresh. You stay signed in as long as you visit at least once every 90 days.
Nightly backups — 30 days.
Sign-in from another device — the record lives for 10 minutes.

Cookies & browser storage

The site sets two cookies, both needed for it to work, not for tracking:

premadeiq_lang — the chosen language, kept for a year;
piq_oauth_nonce — protects the Discord sign-in, lives for 10 minutes and is deleted after sign-in.

Browser localStorage holds the login tokens (for 7 and 90 days) and marks for news you have read and tours you have finished; sessionStorage holds the page to return to after signing in.

No Google Analytics, Yandex.Metrika, Facebook pixel, Hotjar, or similar on the site.

Policy changes

If we change how we collect or use data, a notice goes to Discord (#⚔-king-of-ebg) 14 days before the change takes effect. Corrections that only describe more accurately how things already work are published right away and also announced on Discord. Anyone who disagrees with the changes can run delete-me and close the matter.

Contact

Discord: @rezal (owner), EPIC server

Non-commercial project, supported by Patreon donations which pay for the server and future development. No ads, no data sales.