Privacy
Accounts are optional. WoW Forever Tools can still be used without signing in. Account access supports Google OpenID Connect and a passwordless email-code fallback.
Account data
If you create or use an account, we store your email address, username, optional avatar URL, account creation time, last login time, account status, and your optional marketing consent choice. If you continue with Google, we also store the Google account identifier (the OpenID Connect sub) and may store the name and profile image supplied by Google so that the Google identity can remain linked to the same user account. Email addresses are used for authentication and account operations and are never displayed on public profile pages.
Authentication and sessions
Google sign-in uses the OpenID Connect authorization-code flow with server-side identity verification, a short-lived state value, and nonce validation. The email fallback uses a one-time code that expires after about 10 minutes and can be used only once; authentication codes are stored as cryptographic hashes. Successful sign-in creates a random session token, while only a hash of that token is stored in the database. The browser receives a Secure, HttpOnly, SameSite=Lax session cookie. Sessions expire automatically and are invalidated when you log out.
Public profiles
Your public profile may show your username, optional avatar, and account creation date. It does not expose your email address, login history, session information, or marketing preference. If you choose an avatar hosted on another HTTPS website, that host may receive normal web request information when the avatar is displayed.
Marketing consent
The option “Send me WoW Forever updates and community news” is separate and optional and is presented during profile setup rather than being inferred from authentication. Google sign-in and email sign-in do not automatically provide marketing consent. If you opt in, we store the consent state and the time it was granted. You can change this preference from your profile.
Security and service providers
Cloudflare hosts the site, stores account records in D1, and provides Turnstile bot protection. Turnstile is validated by the server before a login code can be sent. Resend is used to deliver transactional sign-in emails and therefore processes the destination email address and normal email-delivery metadata. These providers process data under their own terms and privacy policies.
Rate limiting and technical data
To protect sign-in, verification, profile updates, and other sensitive endpoints, the service applies rate limits. Security records may include cryptographic hashes derived from IP address and user-agent information rather than publishing those values. Cloudflare and related hosting infrastructure may also retain technical logs for security and troubleshooting.
Local browser data
Some interactive tools store preferences or challenge progress in your browser using localStorage. This data stays on your device unless you choose to share a build URL.
Microsoft Clarity analytics
With your optional consent, we use Microsoft Clarity to understand how visitors use our public website through aggregated heatmaps and session recordings. Clarity may process interactions, device/browser information and analytics cookies according to Microsoft Clarity's privacy information. Clarity does not load until you select “Allow analytics” in our consent panel. Rejecting optional analytics leaves it disabled. This choice is separate from account-related marketing consent. You can change it at any time using “Analytics preferences” in the site footer; withdrawing consent disables Clarity and requests removal of its cookies. We send no advertising storage consent to Clarity.
Managing data
You can clear local tool progress in your browser and can update your username, avatar, and marketing preference from your profile. Expired authentication codes, sessions, and rate-limit records are periodically cleaned from the account database.
Last reviewed: September 22, 2026.