PatchVault
Not signed in. Everything you tick is kept in this browser only, and disappears if you clear your site data or switch device. Create an account

Privacy

What this site stores, where it stores it, and how long it keeps it.

PatchVault is a fan-made World of Warcraft reference run by one person. It is not a business, it sells nothing, and it has no interest in you beyond counting how many people find the site useful. This page says exactly what is kept, and it is written from the code rather than from a template: if it says a number, that number is in the source.

Without an account

You can use every page without signing up. In that case nothing you do is stored on the server.

Your ticks, which entries you track, how many steps count for you and your region are kept in your browser's local storage, on your own device. They are never uploaded. Clearing your site data removes them, and so does the button on the Settings page.

With an account

If you create an account, this is the complete list of what is stored:

  • Your email address. Used to sign in and to send a password reset. It is never used for anything else, never sent to anyone, and there is no newsletter.
  • A hash of your password. Argon2id, 64 MB of memory and four passes. A hash cannot be turned back into your password. Nobody, including the person running this site, can read it.
  • Your region, EU or NA, because it decides when your week resets.
  • Your checklist: which entries you ticked, which you track, and how many steps count as done, per patch.
  • The date you signed up and the date you last signed in.

That is all of it. There is no name, no profile, no character data, no payment details, and nothing is shared with anyone.

You can see everything held about you with the Download my data button on the Account page, and remove all of it with Delete your account on the same page. Deleting is immediate and permanent: the address, the hash and the progress are gone, and there is no backup to restore them from.

Sessions

Signing in sets a cookie holding a random token. The database stores only a SHA-256 of that token, so even a copy of the database contains nothing that could be used to sign in as you. The cookie lasts ninety days, is marked HttpOnly so no script can read it, and is marked SameSite=Lax so it is never sent along with a request from another site.

A second cookie, pv_acct, holds nothing but the value 1. The page reads it to decide whether to show you as signed in. It grants no access whatsoever.

Sign-in attempts

Every sign-in, sign-up and password reset attempt is logged with the time, the email address used, and a keyed hash of your IP address. The hash exists so repeated failures can be slowed down; the address itself is never stored. These rows are deleted after 30 days.

Counting visits

Two things count visits, and you should know about both.

The site's own counter records the page path, the patch, and a visitor hash. That hash is made from your IP address and browser string, salted with a key that changes every day, which means two visits on the same day group together and nothing can link you from one day to the next. It stores counts, never addresses, and never anything you typed. These rows are deleted after 400 days.

Google Analytics also runs on this site. That is a third party: it sets its own cookies and sends data about your visit to Google, which is subject to Google's own privacy policy rather than this one. If you would rather not be measured this way, a tracker blocker or your browser's "do not track" setting will stop it, and the site works exactly the same without it.

Other people's servers

Two things on this site cause your browser to talk to someone else:

  • Spec icons on the Classes page are loaded from Wowhead's image host. Your browser's request tells them your IP address. It does not tell them which page you were on, because the site sends no referrer.
  • Links to Wowhead and Maxroll are ordinary links. Nothing is sent to them until you click one.

Fonts are hosted here rather than at Google, so reading a page contacts nobody but this server.

What is not here

No advertising, no trackers beyond the two counters above, no fingerprinting, no selling or sharing of anything, no profiling, and no automated decisions about you.

Your rights

You can see, correct, take away or delete everything held about you, from the Account page, without asking anyone. If something on this page is unclear or you think something is wrong, say so on Bluesky and it will be looked at.